3

I have to catch first-chance exceptions occurring in user-mode application during kernel-mode debugging session.

I have written simple example application called Exceptions.exe:

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpCmdLine, int nShowCmd)
{
    MessageBox(NULL, "Press OK to generate exception.", "Title", MB_OK);
    __try
    {
        __asm
        {
            xor eax, eax
            mov dword ptr[eax], eax  // I wanna break here
        }
    }
    __except(EXCEPTION_EXECUTE_HANDLER)
    {
        MessageBox(NULL, "In exception handler.", "Title", MB_ICONINFORMATION);
    }
    return 0;
}

I launch it in the being debugged system. Then go to windbg, press 'ctrl+break' and enter following commands:


3: kd> !process 0 0 Exceptions.exe
PROCESS 853b37e0  SessionId: 1  Cid: 0f48    Peb: 7ffdf000  ParentCid: 06c4
    DirBase: be658280  ObjectTable: 8f97acf8  HandleCount:  35.
    Image: Exceptions.exe

3: kd> .process /i 853b37e0
You need to continue execution (press 'g' ) for the context
to be switched. When the debugger breaks in again, you will be in
the new process context.
3: kd> g
Break instruction exception - code 80000003 (first chance)
nt!RtlpBreakWithStatusInstruction:
82ab6110 cc              int     3
2: kd> sxe *
2: kd> g

I expect to break on the instruction mov dword ptr[eax], eax but nothing occurred. In the being debugged system I've got message box "In exception handler".

Is there any way to get what I want? I can't debug target process in user mode, because it's protected from attaching debugger.

4

In WinDbg: !gflag +soe

You can see http://www.openrce.org/blog/view/1564/Kernel_debugger_vs_user_mode_exceptions for more details.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.