/
githubmirror
/
x64dbg
Обзор
Документация
Войти
/
githubmirror
/
x64dbg
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
Bitbucket
help/Callbacks.htm
135 строк
7 KB
Mr. eXoDia
PROJECT: updated help
28 июл 2014, 03:57
28 июл 2014, 03:57
acedd49
Код
Авторство
О чём код?
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Callback Structures</title> <meta name="GENERATOR" content="WinCHM"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <style> html,body { /* Default Font */ font-family: Courier New; font-size: 11pt; } </style> </head> <body> <P><STRONG>Callback structures<BR></STRONG>These structures are used inside event callbacks (registered using _plugin_registercallback). Notice that the pointer 'void* callbackInfo' is never NULL, but the members of the various structures can be NULL. Also remember that <U>you cannot use any of the provided pointers out of the callback function scope</U>. In general <U> <STRONG>AVOID</STRONG> time-consuming operations inside callbacks</U> , do these in separate threads.</P> <P>//Called on debug initialization, useful to initialize some variables.<BR>struct <STRONG>PLUG_CB_INITDEBUG</STRONG> <BR>{<BR> <STRONG>const char*</STRONG> szFileName;<BR>};</P> <P>//Called when the debugging has been stopped, useful to reset some variables.<BR>struct <STRONG>PLUG_CB_STOPDEBUG</STRONG> <BR>{<BR> <STRONG>void*</STRONG> reserved;<BR>};</P> <P>//Called after process creation (in the debug loop), after the initialization of the symbol handler, the database file and setting breakpoints on TLS callbacks / the entry breakpoint.<BR>struct <STRONG>PLUG_CB_CREATEPROCESS <BR></STRONG>{<BR> <STRONG>CREATE_PROCESS_DEBUG_INFO*</STRONG> CreateProcessInfo;<BR> <STRONG>IMAGEHLP_MODULE64*</STRONG> modInfo;<BR> <STRONG>const char*</STRONG> DebugFileName;<BR> <STRONG>PROCESS_INFORMATION*</STRONG> fdProcessInfo;<BR>};</P> <P>//Called after the process exits (in the debug loop), before the symbol handler is cleaned up.<BR>struct <STRONG>PLUG_CB_EXITPROCESS</STRONG> <BR>{<BR> <STRONG>EXIT_PROCESS_DEBUG_INFO*</STRONG> ExitProcess;<BR>};</P> <P>//Called after thread creation (in the debug loop), after adding the thread to the internal thread list, before breaking the debugger on thread creation and after setting breakpoints on the thread entry.<BR>struct <STRONG>PLUG_CB_CREATETHREAD<BR></STRONG>{<BR> <STRONG>CREATE_THREAD_DEBUG_INFO*</STRONG> CreateThread;<BR> <STRONG>DWORD</STRONG> dwThreadId;<BR>};</P> <P>//Called after thread termination (in the debug loop), before the thread is removed from the internal thread list, before breaking on thread termination.<BR>struct <STRONG>PLUG_CB_EXITTHREAD</STRONG> <BR>{<BR> <STRONG>EXIT_THREAD_DEBUG_INFO*</STRONG> ExitThread;<BR> <STRONG>DWORD</STRONG> dwThreadId;<BR>};</P> <P>//Called at the system breakpoint (in the debug loop), after setting the initial dump location, before breaking the debugger on the system breakpoint.<BR>struct <STRONG>PLUG_CB_SYSTEMBREAKPOINT</STRONG> <BR>{<BR> <STRONG>void*</STRONG> reserved;<BR>};</P> <P>//Called on DLL loading (in the debug loop), after the DLL has been added to the internal library list, after setting the DLL entry breakpoint.<BR>struct <STRONG>PLUG_CB_LOADDLL</STRONG> <BR>{<BR> <STRONG>LOAD_DLL_DEBUG_INFO*</STRONG> LoadDll;<BR> <STRONG>IMAGEHLP_MODULE64*</STRONG> modInfo;<BR> <STRONG>const char*</STRONG> modname;<BR>};</P> <P>//Called on DLL unloading (in the debug loop), before removing the DLL from the internal library list, before breaking on DLL unloading.<BR>struct <STRONG>PLUG_CB_UNLOADDLL</STRONG> <BR>{<BR> <STRONG>UNLOAD_DLL_DEBUG_INFO*</STRONG> UnloadDll;<BR>};</P> <P>//Called on a DebugString event (in the debug loop), before dumping the string to the log, before breaking on a debug string.<BR>struct <STRONG>PLUG_CB_OUTPUTDEBUGSTRING</STRONG> <BR>{<BR> <STRONG>OUTPUT_DEBUG_STRING_INFO*</STRONG> DebugString;<BR>};</P> <P>//Called on an unhandled (by the debugger) exception (in the debug loop), after setting the continue status, after locking the debugger to pause.<BR>struct <STRONG>PLUG_CB_EXCEPTION</STRONG> <BR>{<BR> <STRONG>EXCEPTION_DEBUG_INFO*</STRONG> Exception;<BR>};</P> <P>//Called on a normal/memory/hardware breakpoint (in the debug loop), after locking the debugger to pause.<BR>struct <STRONG>PLUG_CB_BREAKPOINT</STRONG> <BR>{<BR> <STRONG>BRIDGEBP*</STRONG> breakpoint;<BR>};</P> <P>//Called after the debugger has been locked to pause (in the debug loop), before any other callback that's before pausing the debugger.<BR>struct <STRONG>PLUG_CB_PAUSEDEBUG</STRONG> <BR>{<BR> <STRONG>void*</STRONG> reserved;<BR>};</P> <P>//Called after the debugger has been unlocked to resume (outside of the debug loop).<BR>struct <STRONG>PLUG_CB_RESUMEDEBUG</STRONG> <BR>{<BR> <STRONG>void*</STRONG> reserved;<BR>};</P> <P>//Called after the debugger stepped (in the debug loop), after locking the debugger to pause.<BR>struct <STRONG>PLUG_CB_STEPPED</STRONG> <BR>{<BR> <STRONG>void*</STRONG> reserved;<BR>};</P> <P>//Called before attaching to a process.<BR>struct <STRONG>PLUG_CB_ATTACH</STRONG><BR>{<BR> <STRONG>DWORD</STRONG> dwProcessId;<BR>};</P> <P>//Called before detaching from the process.<BR>struct <STRONG>PLUG_CB_DETACH</STRONG><BR>{<BR> <STRONG>PROCESS_INFORMATION*</STRONG> fdProcessInfo;<BR>};</P> <P>//Called on any debug event, even the ones that are handled internally, <U><STRONG>AVOID</STRONG> doing stuff that takes time here</U>, this will slow the debugger down a lot!<BR>struct <STRONG>PLUG_CB_DEBUGEVENT</STRONG> <BR>{<BR> <STRONG>DEBUG_EVENT*</STRONG> DebugEvent;<BR>};</P> <P>//Called when a menu entry created by the plugin has been clicked, the GUI will resume when this callback returns.<BR>struct <STRONG>PLUG_CB_MENUENTRY</STRONG><BR>{<BR> <STRONG>int</STRONG> hEntry;<BR>};</P> <P>//Called before TranslateMessage and DispatchMessage Windows functions (PreTranslateMessage). Avoid calling user32 functions without precautions here, there <STRONG>will</STRONG> be a recursive call if you fail to take countermeasures.<BR>struct <STRONG>PLUG_CB_WINEVENT<BR></STRONG>{<BR> <STRONG>MSG*</STRONG> message;<BR> <STRONG>long*</STRONG> result;<BR> <STRONG>bool</STRONG> retval; //only set this to true, never to false<BR>};</P> <P>//Called before TranslateMessage and DispatchMessage Windows functions (PreTranslateMessage). Avoid calling user32 functions without precautions here, there <STRONG>will</STRONG> be a recursive call if you fail to take countermeasures. This function is global, so it also captures hotkeys (see Qt documentation).<BR>struct <STRONG>PLUG_CB_WINEVENTGLOBAL<BR></STRONG>{<BR> <STRONG>MSG*</STRONG> message;<BR> <STRONG>bool</STRONG> retval; //only set this to true, never to false<BR>};</P></body></HTML>