Re: State of process at CREATE_PROCESS_DEBUG_EVENT


After creating a process with DEBUG_PROCESS flag, when
CREATE_PROCESS_DEBUG_EVENT occurs, what is the state of the process? I
mean when the CREATE_PROCESS_DEBUG_EVENT event occurs is the process's
loading or initialization or dll loading etc is done or just the
address space created. And what would be contents of EIP when this
event occur? If anybody having any idea please let me know.


When "create process" event is sent, the .exe and ntdll.dll have already
been mapped into the process' address space, but code hasn't run yet.

When you let the debuggee continue, the loader runs and loads dlls,
notifying you about it with "load dll" debug events (entry points of
the dlls do not run yet).

The next event is "initial breakpoint" ("exception" event for breakpoint exception).
When you continue the debuggee after that, dll entry points will be called,
and then the entry point of the main executable.

--
Oleg
[VC++ MVP http://www.debuginfo.com/]





.

Relevant Pages

  • Re: MYWEB~SearchBar DLL
    ... | "MYWEB~SearchBar DLL loading error".. ... shows up everytime i start up my ... | Is this a DLL that is needed???? ... Maybe after a recent anti malware scan it removed the file but NOT the ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Win32::API cannot load any DLL?
    ... running 'perl msdll.dll' prints out 144. ... I can compile the dll correctly but Win32::API ... of this dll loading stuff because I can use other script language such ... as Ruby to load my dll without any problem. ...
    (comp.lang.perl.misc)
  • LoadLibrary() returns ErrorCode 193
    ... I'm having an issue with DLL loading under WIndows CE 5 that I don't ... The LoadLibraryfunction returns en error code of 193. ... Am I missing something with DLL loading in Windows CE 5? ...
    (microsoft.public.windowsce.embedded)
  • Re: Firefox and Sound
    ... number of loads that app performed. ... only references to entry points in the dll. ... specified entry points in it can't be found, ... but the download manager said it was only 78.8 MB. ...
    (comp.os.os2.apps)
  • Re: SAVE-SYSTEM and DLLs
    ... Win32Forth uses a system of pointing all Windows DLL calls on ... and calls the entry point for this time. ... IMP-RESOLVE is called first time through on a Windows call. ... Since my Forth uses EBP as a stack, the stacks are switched for a ...
    (comp.lang.forth)