I have to catch first-chance exceptions occurring in user-mode application during kernel-mode debugging session.
I have written simple example application called Exceptions.exe:
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpCmdLine, int nShowCmd)
{
MessageBox(NULL, "Press OK to generate exception.", "Title", MB_OK);
__try
{
__asm
{
xor eax, eax
mov dword ptr[eax], eax // I wanna break here
}
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
MessageBox(NULL, "In exception handler.", "Title", MB_ICONINFORMATION);
}
return 0;
}
I launch it in the being debugged system. Then go to windbg, press 'ctrl+break' and enter following commands:
3: kd> !process 0 0 Exceptions.exe
PROCESS 853b37e0 SessionId: 1 Cid: 0f48 Peb: 7ffdf000 ParentCid: 06c4
DirBase: be658280 ObjectTable: 8f97acf8 HandleCount: 35.
Image: Exceptions.exe
3: kd> .process /i 853b37e0
You need to continue execution (press 'g' ) for the context
to be switched. When the debugger breaks in again, you will be in
the new process context.
3: kd> g
Break instruction exception - code 80000003 (first chance)
nt!RtlpBreakWithStatusInstruction:
82ab6110 cc int 3
2: kd> sxe *
2: kd> g
I expect to break on the instruction mov dword ptr[eax], eax but nothing occurred. In the being debugged system I've got message box "In exception handler".
Is there any way to get what I want? I can't debug target process in user mode, because it's protected from attaching debugger.