1

I am writing a little tracer using the Win32 Debug Api (not dbgeng). The general flow is:

DEBUG_EVENT event;
WaitForDebugEvent(&event);
...
ContinueDebugEvent(event.pid, event.tid,...)

My question is: How can I switch the debugger to a different thread than the one that reported the current debugging event (event.tid)? IE Thread A reports an event in WaitForDebugEvent, but I want to continue stepping Thread B.

ContinueDebugEvent documentation on the second parameter says:

The thread identifier of the thread to continue. The combination of process identifier and thread identifier must identify a thread that has previously reported a debugging event.

So I cant pass the id of a different thread.

I know this is possible because you can do it in Visual Studio GUI as well as windbg: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/-s--set-current-thread-

Neitsa
  • 7,693
  • 1
  • 28
  • 45
bernd feinman
  • 324
  • 2
  • 11
  • 2
    this is not possible. when debug event ocur in thread - system freeze all other threads in process and send debug event to debugger from A thread. and wait on debugger responce. until you not responce to debug event in thread A - you can not continue. the pid/tid exist because more that one process can be conected to the single debug object – RbMm Sep 20 '21 at 22:42
  • But then how do windbg and visual studio do it? – bernd feinman Sep 20 '21 at 22:46
  • thay not do it. this not possible – RbMm Sep 20 '21 at 22:49
  • in self code, from thread (A) create thread (B) which simply call `MessageBoxW(0,0,0,0)` and after this (you may insert `Sleep` for give time for display messagebox) insert for instance `*(int*)0=0;` after your got *Unhandled exception at ..* in thread (A) - please switch to thread (B) - let it continue show `MessageBox` and describe in question - how you do this in VS or windbg. if of couse you do this – RbMm Sep 20 '21 at 23:00
  • The only solution I can think, is to call `SuspendThread` on all threads except the one, you want to trace, wait the next debug event in this thread and call `ResumeThread` on these. To handle the case when the debug event does not occur for a long time, you can set a timer and resume the threads when it fires.I would also suggest to raise the priority of the thread you want to execute above the value of all other threads in the process with `SetThreadPriority`. – nevilad Sep 21 '21 at 10:03

0 Answers0