Visual Studio - 如何将调试器附加到重新启动的应用程序? [英] Visual Studio - how to attach debugger to restarted application?
问题描述
谢谢
我发现在感染一些使用相同技术的恶意软件后,如何将所有呼叫都包含到防病毒产品中以将其重定向到自己的可执行文件!
总结此处介绍的步骤,它只涉及一些注册表编辑。 FWIW,诸如 DebugDiag
等工具也用于使用此方法来捕获应用程序启动并激活调试器:
设置应用程序以自动启动调试器
-
启动注册表编辑器(regedit)。
-
在注册表编辑器中,打开
HKEY_LOCAL_MACHINE
文件夹。 -
导航到
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\image文件执行选项
。 -
在图像文件执行选项文件夹中,找到要调试的应用程序的名称,例如 myapp .exe 。如果您找不到要调试的应用程序:
a。右键单击图像文件执行选项文件夹,然后在快捷菜单上单击新建密钥。
b。右键单击新密钥,然后在快捷菜单上单击重命名。
c。将密钥名称编辑为应用程序的名称; myapp.exe ,在这个例子中。 -
右键单击 myapp.exe 文件夹,然后在快捷菜单上单击新建字符串值。
-
右键单击新的字符串值,然后在快捷菜单上单击重命名。
-
将名称更改为
debugger
。 -
右键单击新字符串值,然后在快捷菜单上单击修改。
出现编辑字符串对话框。
-
在价值数据框中,键入 vsjitdebugger.exe 。
-
点击确定。
-
从注册表菜单中,点击退出。
-
包含 vsjitdebugger.exe 的目录必须位于系统路径中。有关完整说明,请参阅上述链接。
现在,使用任何方法启动您的应用程序。 Visual Studio将启动并加载调试器中的应用程序。
I have an application in C++ developed in VS2010. This application has an ability to restart itself when needed (some changes that requires it to reboot). Now there's some bug that occurs only under certain circumstances on the beginning of the new instance after the restart. The problem is that I can't find out what it is, because the new instance does not have the debugger attached (VS debug mode ends with the initial instance closing). Any idea how to automatically attach a debugger to the new instance?
Thank you
I "discovered" how this is done after getting infected with some malware that used the same technique to wrap all calls to anti-virus products to redirect them to it's own executable!
Summarising the steps described here, it just involves some registry editing. FWIW, tools like DebugDiag
also used to use this method to trap an application launch and activate the debugger:
To setup an application to launch the debugger automatically
Start the Registry Editor (regedit).
In the Registry Editor, open the
HKEY_LOCAL_MACHINE
folder.Navigate to
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\image file execution options
.In the Image File Execution Options folder, locate the name of the application you want to debug, such as myapp.exe. If you cannot find the application you want to debug:
a. Right-click the Image File Execution Options folder, and on the shortcut menu, click New Key.
b. Right-click the new key, and on the shortcut menu, click Rename.
c. Edit the key name to the name of your application; myapp.exe, in this example.Right-click the myapp.exe folder, and on the shortcut menu, click New String Value.
Right-click the new string value, and on the shortcut menu, click Rename.
Change the name to
debugger
.Right-click the new string value, and on the shortcut menu, click Modify.
The Edit String dialog box appears.
In the Value data box, type vsjitdebugger.exe.
Click OK.
From the Registry menu, click Exit.
The directory containing vsjitdebugger.exe must be in your system path. See the above link for the full instructions.
Now, use any method to start your application. Visual Studio will start and load the application in the debugger.
这篇关于Visual Studio - 如何将调试器附加到重新启动的应用程序?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!