I am trying to write a simple debugger on Windows to debug 32-bit applications, my machine is 64-bits. I am using C language.
When I add breakpoint (0xCC
) at the specified address, I expect to get EXCEPTION_BREAKPOINT
value in debugEvent.u.Exception.ExceptionRecord.ExceptionCode
However I get STATUS_WX86_BREAKPOINT(0x4000001F)
instead.
MSDN website define it as "An exception status code that is used by the Win32 x86 emulation subsystem.". Without any further explanation for this behavior.
Can I handle this exception the same way as EXCEPTION_BREAKPOINT
? So the code will be as
switch(debugEvent.u.Exception.ExceptionRecord.ExceptionCode)
{
...
case EXCEPTION_BREAKPOINT:
case STATUS_WX86_BREAKPOINT:
HandleBreakPoint();
break;
...
}
When breakpoint (int 3
) exception was from code executed in WOW64 mode (32 bit code in 64 bit Windows) 64-bit debugger really got STATUS_WX86_BREAKPOINT
. When breakpoint from 64-bit code - STATUS_BREAKPOINT
. Also on single step exception 64-bit debugger got STATUS_SINGLE_STEP
if this exception from 64-bit code and STATUS_WX86_SINGLE_STEP
if exception from WOW64 code.
Can I handle this exception the same way as
EXCEPTION_BREAKPOINT
?, so the code will be as
Yes, you can. Same is true for STATUS_WX86_SINGLE_STEP
- you can handle it in the same way as STATUS_SINGLE_STEP
. the WX86_
gives you additional information from which mode (WOW64 or native) was breakpoint. But in both case this is breakpoint exception. And logic how handle it usually common. However this is your choice decide what do and how handle breakpoint, single step or other exception.
Also note that STATUS_WX86_BREAKPOINT
and STATUS_WX86_SINGLE_STEP
got only 64bit debugger. 32-bit debugger always gets STATUS_BREAKPOINT
where 64-bit debugger gets STATUS_WX86_BREAKPOINT
and nothing got where x64 debugger got STATUS_BREAKPOINT
. The same for single step. For example on WOW64 process startup - 64-bit debugger got 2 breakpoints - first STATUS_BREAKPOINT
form 64-bit mode (inside 64-bit ntdll.LdrpDoDebugBreak
) and then STATUS_WX86_BREAKPOINT
from 32-bit ntdll.LdrpDoDebugBreak
. While 32-bit debugger got only second breakpoint (from 32-bit code) with STATUS_BREAKPOINT
.
User contributions licensed under CC BY-SA 3.0