32位调试API
_debugThread_procprocuses esi edi ebx lpParam
LOCAL@nReaderNumber
invokeRtlZeroMemory,addr @nReaderNumber,sizeof @nReaderNumber
invokeGetStartupInfo,offset stStartUp
invokeCreateProcess,offset szFilePath,NULL,NULL,NULL,NULL,DEBUG_PROCESS or DEBUG_ONLY_THIS_PROCESS,NULL,\
NULL,offset stStartUp,offset stPF
.whileTRUE
invokeWaitForDebugEvent,offset stDebugEvent,INFINITE
invoke_showerror_proc,stPF.hProcess
invoke_showerror_proc,stPF.hThread
.break.ifstDebugEvent.dwDebugEventCode == EXIT_PROCESS_DEBUG_EVENT
.ifstDebugEvent.dwDebugEventCode == CREATE_PROCESS_DEBUG_EVENT
invokeReadProcessMemory,stPF.hProcess,lpEntryPointer,offset Oldcommand,1,@nReaderNumber
invokeWriteProcessMemory,stPF.hProcess,lpEntryPointer,offset dbINT3,1,@nReaderNumber
.endif
invokeContinueDebugEvent,stPF.hProcess,stPF.hThread,DBG_CONTINUE
.endw
invokeExitThread,12
ret
_debugThread_proc endp
