I've set breakpoints on some Windows kernel functions using WinDBG. When the breakpoints are hit, I can query information about the invoking user-mode process using the !process or !peb commands.
How are these commands implemented? How can I find the relevant memory structures and "manually" trace back to the user-mode caller when one of my BPs hit?
currentprocess KPROCESS offset is returned by
IDebugSystemObjects::GetCurrentProcessDataOffset
peb is returned by
IDebugSystemObjects::GetCurrentProcessPeb method
both are implemented in dbgeng
you can set process specific breakpoints so that the kernel api will break only in the correct process context
bp /p [eprocess] {kernel api}
to look at the stack use kb when the breakpoint is hit
windbg comes with sample src code that shows various forms of implementation right from the very old wdbgext extensions to the latest engextcpp extension
a basic implementation is simple and straightforward Call DebugCreate() to obtain a IDebugClient Interface Query the Other Interfaces from this Client Interface and call the methods
to find a series of articles that show how to use the dbgeng functions explore here http://www.woodmann.com/forum/entry.php?246-A-Simple-Dbgeng-Based-User-Mode-Debugger
