System function 68 - debugging.
A process can load other process as debugged by set of corresponding bit by call to subfunction 7 of function 70.
A process can have only one debugger; one process can debug some others. The system notifies debugger on events occuring with debugged process. Messages are written to the buffer defined by subfunction 0.
Format of a message:
+0: dword: message code;
+4: dword: PID of debugged process;
+8: there can be additional data depending on message code.
Message codes:
1 = exception in addition dword-number of the exception is given process is suspended;
2 = process has terminated comes at any termination: both through the system function -1, and at "murder" by any other process (including debugger itself);
3 = debug exception int 1 = #DB in addition dword-image of the register DR6 is given: bits 0-3: condition of the corresponding breakpoint (set by subfunction 9) is satisfied bit 14: exception has occured because of the trace mode (flag TF is set TF) process is suspended.
When debugger terminates, all debugged processes are killed. If debugger does not want this, it must previously detach by
subfunction 3.
All subfunctions are applicable only to processes/threads started from the current by function 70 with set debugging flag. Debugging of multithreaded programs is not supported yet.
The full list of subfunctions:
subfunction 0 - define data area for debug messages
subfunction 1 - get contents of registers of debugged thread
subfunction 2 - set contents of registers of debugged thread
subfunction 3 - detach from debugged process
subfunction 4 - suspend debugged thread
subfunction 5 - resume debugged thread
subfunction 6 - read from the memory of debugged process
subfunction 7 - write to the memory of debugged process
subfunction 8 - terminate debugged thread
subfunction 9 - set/clear hardware breakpoint