Why do I get STATUS_WX86_BREAKPOINT instead of EXCEPTION_BREAKPOINT when debugging 32 bit application on 64 machine?

1

I am trying to write a simple debugger on Windows to debug 32-bit applications, my machine is 64-bits. I am using C language.

When I add breakpoint (0xCC) at the specified address, I expect to get EXCEPTION_BREAKPOINT value in debugEvent.u.Exception.ExceptionRecord.ExceptionCode

However I get STATUS_WX86_BREAKPOINT(0x4000001F) instead. MSDN website define it as "An exception status code that is used by the Win32 x86 emulation subsystem.". Without any further explanation for this behavior.

Can I handle this exception the same way as EXCEPTION_BREAKPOINT? So the code will be as

switch(debugEvent.u.Exception.ExceptionRecord.ExceptionCode)
{
...
   case EXCEPTION_BREAKPOINT:
   case STATUS_WX86_BREAKPOINT:
      HandleBreakPoint();
   break;
...
}
c
windows
debugging
breakpoints
asked on Stack Overflow Aug 19, 2018 by Mostafa • edited Aug 19, 2018 by StaceyGirl

1 Answer

4

When breakpoint (int 3) exception was from code executed in WOW64 mode (32 bit code in 64 bit Windows) 64-bit debugger really got STATUS_WX86_BREAKPOINT. When breakpoint from 64-bit code - STATUS_BREAKPOINT . Also on single step exception 64-bit debugger got STATUS_SINGLE_STEP if this exception from 64-bit code and STATUS_WX86_SINGLE_STEP if exception from WOW64 code.

Can I handle this exception the same way as EXCEPTION_BREAKPOINT ?, so the code will be as

Yes, you can. Same is true for STATUS_WX86_SINGLE_STEP - you can handle it in the same way as STATUS_SINGLE_STEP. the WX86_ gives you additional information from which mode (WOW64 or native) was breakpoint. But in both case this is breakpoint exception. And logic how handle it usually common. However this is your choice decide what do and how handle breakpoint, single step or other exception.


Also note that STATUS_WX86_BREAKPOINT and STATUS_WX86_SINGLE_STEP got only 64bit debugger. 32-bit debugger always gets STATUS_BREAKPOINT where 64-bit debugger gets STATUS_WX86_BREAKPOINT and nothing got where x64 debugger got STATUS_BREAKPOINT. The same for single step. For example on WOW64 process startup - 64-bit debugger got 2 breakpoints - first STATUS_BREAKPOINT form 64-bit mode (inside 64-bit ntdll.LdrpDoDebugBreak) and then STATUS_WX86_BREAKPOINT from 32-bit ntdll.LdrpDoDebugBreak. While 32-bit debugger got only second breakpoint (from 32-bit code) with STATUS_BREAKPOINT.

answered on Stack Overflow Aug 19, 2018 by RbMm • edited Aug 19, 2018 by StaceyGirl

User contributions licensed under CC BY-SA 3.0