Fucntion 69 - debugging.
A process can load other process as debugged by set of corresponding
bit by call to subfunction 7 of function 70.
A process can have only one debugger; one process can debug some
others. The system notifies debugger on events occuring with
debugged process. Messages are written to the buffer defined by
subfunction 0.
Format of a message:
- +0: dword: message code
- +4: dword: PID of debugged process
- +8: there can be additional data depending on message code
Message codes:
- 1 = exception
- in addition dword-number of the exception is given
- process is suspended
- 2 = process has terminated
- comes at any termination: both through the system function -1,
and at "murder" by any other process (including debugger itself)
- 3 = debug exception int 1 = #DB
- in addition dword-image of the register DR6 is given:
- bits 0-3: condition of the corresponding breakpoint (set by
subfunction 9) is satisfied
- бит 14: exception has occured because of the trace mode
(flag TF is set TF)
- process is suspended
When debugger terminates, all debugged processes are killed.
If debugger does not want this, it must previously detach by
subfunction 3.
All subfunctions are applicable only to processes/threads started
from the current by function 58 or 70 with set debugging flag.
Debugging of multithreaded programs is not supported yet.
The full list of subfunctions: