在Win32 API函数调试中断 [英] Debug Break on Win32 Api functions

问题描述

我想有才能的SetTimer函数休息，看看哪些组件注册什么样的价值观是什么定时器。这可能吗？

I would like to have a break on the SetTimer function in order to see which components register what timers with what values. Is this possible?

推荐答案

是的，你可以做到这一点。首先请确保您有为您调试安装的公共符号。

Yes, you can do this. First make sure you have public symbols setup for your debugger.

的SetTimer 住在USER32但是，这只是它是什么导出为。要做到这一点，最简单的方法是使用命令行调试器， NTSD 。我们需要它的真实姓名，所以寻找在USER32匹配符号：

SetTimer lives in user32 but that is just what it is exported as. The easiest way to do this is with the command line debugger, NTSD. We need its real name, so look for symbols in user32 that match:

0:000> x user32!*timer*
759992b9 USER32!NtUserValidateTimerCallback = <no type information>
759977d5 USER32!NtUserSetTimer = <no type information>
759e4f13 USER32!NtUserSetSystemTimer = <no type information>
759993bf USER32!NtUserKillTimer = <no type information>

啊，哈！它的调试符号是NtUserSetTimer：

Ah-ha! Its debug symbol is NtUserSetTimer:

0:000> bp user32!NtUserSetTimer

在Visual Studio中，你可以找出其中的SetTimer住书面方式通过一个简单的耐刮划，然后设置一个断点，右击并选择转到拆卸

In Visual Studio, you can figure out where SetTimer lives by writting a simple scratch program and then setting a breakpoint and right clicking and selecting "Go to Disassembly":

int _tmain(int argc, _TCHAR* argv[]) {
  SetTimer(NULL, 0, 0, NULL);
004113BE  mov         esi,esp 
004113C0  push        0    
004113C2  push        0    
004113C4  push        0    
004113C6  push        0    
004113C8  call        dword ptr [__imp__SetTimer@16 (418338h)] 

如果我们步入了电话，然后我们的土地位置：

If we step into that call, then we land here:

_NtUserSetTimer@16:
759977D5  mov         eax,123Dh 
759977DA  mov         edx,7FFE0300h 
759977DF  call        dword ptr [edx] 
759977E1  ret         10h  

因此​​，在Visual Studio中有设置一个断点，你必须使用的在断点上下文运算符。从菜单中选择：调试 - >新建断点 - >歇在功能，然后输入：

So the to set a breakpoint there in Visual Studio, you have to use the context operator in the breakpoint. Select from the menus: Debug -> New Breakpoint -> Break at Function, then enter:

{,,user32.dll}_NtUserSetTimer@16

这篇关于在Win32 API函数调试中断的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！