1
0
Fork 0
x64dbg/help/Callbacks.htm

135 lines
7.2 KiB
HTML

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Callback Structures</title>
<meta name="GENERATOR" content="WinCHM">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style>
html,body {
/* Default Font */
font-family: Courier New;
font-size: 11pt;
}
</style>
</head>
<body>
<P><STRONG>Callback structures<BR></STRONG>These&nbsp;structures are used inside event
callbacks (registered using _plugin_registercallback). Notice that the pointer
'void* callbackInfo' is never NULL, but the members of the various structures
can be NULL. Also remember that <U>you cannot use any of the provided pointers
out of the callback function scope</U>. In general
<U>
<STRONG>AVOID</STRONG> time-consuming operations inside
callbacks</U> , do these in
separate
threads.</P>
<P>//Called on debug initialization, useful to initialize
some variables.<BR>struct <STRONG>PLUG_CB_INITDEBUG</STRONG>
<BR>{<BR>&nbsp;&nbsp;&nbsp; <STRONG>const char*</STRONG>
szFileName;<BR>};</P>
<P>//Called when the debugging has been stopped, useful to
reset some variables.<BR>struct <STRONG>PLUG_CB_STOPDEBUG</STRONG>
<BR>{<BR>&nbsp;&nbsp;&nbsp;
<STRONG>void*</STRONG>
reserved;<BR>};</P>
<P>//Called after process creation (in the debug loop),
after the initialization of the symbol handler, the database file and setting
breakpoints on TLS callbacks / the entry breakpoint.<BR>struct <STRONG>PLUG_CB_CREATEPROCESS <BR></STRONG>{<BR>&nbsp;&nbsp;&nbsp;
<STRONG>CREATE_PROCESS_DEBUG_INFO*</STRONG>
CreateProcessInfo;<BR>&nbsp;&nbsp;&nbsp; <STRONG>IMAGEHLP_MODULE64*</STRONG>
modInfo;<BR>&nbsp;&nbsp;&nbsp; <STRONG>const char*</STRONG>
DebugFileName;<BR>&nbsp;&nbsp;&nbsp;
<STRONG>PROCESS_INFORMATION*</STRONG>
fdProcessInfo;<BR>};</P>
<P>//Called after the process exits (in the debug loop),
before the symbol handler is cleaned up.<BR>struct <STRONG>PLUG_CB_EXITPROCESS</STRONG> <BR>{<BR>&nbsp;&nbsp;&nbsp;
<STRONG>EXIT_PROCESS_DEBUG_INFO*</STRONG>
ExitProcess;<BR>};</P>
<P>//Called after thread creation (in the debug loop),
after adding the thread to the internal thread list, before breaking the
debugger on thread creation and&nbsp;after setting breakpoints on the thread
entry.<BR>struct <STRONG>PLUG_CB_CREATETHREAD<BR></STRONG>{<BR>&nbsp;&nbsp;&nbsp;
<STRONG>CREATE_THREAD_DEBUG_INFO*</STRONG>
CreateThread;<BR>&nbsp;&nbsp;&nbsp; <STRONG>DWORD</STRONG>
dwThreadId;<BR>};</P>
<P>//Called after thread termination (in the debug loop),
before the thread is removed from the internal thread list, before breaking on
thread termination.<BR>struct <STRONG>PLUG_CB_EXITTHREAD</STRONG> <BR>{<BR>&nbsp;&nbsp;&nbsp; <STRONG>EXIT_THREAD_DEBUG_INFO*</STRONG>
ExitThread;<BR>&nbsp;&nbsp;&nbsp; <STRONG>DWORD</STRONG>
dwThreadId;<BR>};</P>
<P>//Called at the system breakpoint (in the debug loop),
after setting the initial dump location, before breaking the debugger on the
system breakpoint.<BR>struct <STRONG>PLUG_CB_SYSTEMBREAKPOINT</STRONG>
<BR>{<BR>&nbsp;&nbsp;&nbsp;
<STRONG>void*</STRONG> reserved;<BR>};</P>
<P>//Called on DLL loading (in the debug loop), after the
DLL has been added to the internal library list, after setting the DLL entry
breakpoint.<BR>struct <STRONG>PLUG_CB_LOADDLL</STRONG> <BR>{<BR>&nbsp;&nbsp;&nbsp;
<STRONG>LOAD_DLL_DEBUG_INFO*</STRONG>
LoadDll;<BR>&nbsp;&nbsp;&nbsp; <STRONG>IMAGEHLP_MODULE64*</STRONG>
modInfo;<BR>&nbsp;&nbsp;&nbsp; <STRONG>const char*</STRONG> modname;<BR>};</P>
<P>//Called on DLL unloading (in the debug loop), before
removing the DLL from the internal library list, before breaking on DLL
unloading.<BR>struct <STRONG>PLUG_CB_UNLOADDLL</STRONG> <BR>{<BR>&nbsp;&nbsp;&nbsp;
<STRONG>UNLOAD_DLL_DEBUG_INFO*</STRONG>
UnloadDll;<BR>};</P>
<P>//Called on a DebugString event (in the debug loop),
before dumping the string to the log, before breaking on a debug
string.<BR>struct <STRONG>PLUG_CB_OUTPUTDEBUGSTRING</STRONG>
<BR>{<BR>&nbsp;&nbsp;&nbsp;
<STRONG>OUTPUT_DEBUG_STRING_INFO*</STRONG>
DebugString;<BR>};</P>
<P>//Called on an unhandled (by the debugger) exception (in
the debug loop), after setting the continue status, after locking the debugger
to pause.<BR>struct <STRONG>PLUG_CB_EXCEPTION</STRONG> <BR>{<BR>&nbsp;&nbsp;&nbsp;
<STRONG>EXCEPTION_DEBUG_INFO*</STRONG>
Exception;<BR>};</P>
<P>//Called on a normal/memory/hardware breakpoint (in the
debug loop), after locking the debugger to pause.<BR>struct <STRONG>PLUG_CB_BREAKPOINT</STRONG> <BR>{<BR>&nbsp;&nbsp;&nbsp; <STRONG>BRIDGEBP*</STRONG>
breakpoint;<BR>};</P>
<P>//Called after the debugger has been locked to pause (in
the debug loop), before any other callback that's before pausing the
debugger.<BR>struct <STRONG>PLUG_CB_PAUSEDEBUG</STRONG> <BR>{<BR>&nbsp;&nbsp;&nbsp;
<STRONG>void*</STRONG>
reserved;<BR>};</P>
<P>//Called after the debugger has been unlocked to resume
(outside of the debug loop).<BR>struct <STRONG>PLUG_CB_RESUMEDEBUG</STRONG> <BR>{<BR>&nbsp;&nbsp;&nbsp;
<STRONG>void*</STRONG>
reserved;<BR>};</P>
<P>//Called after the debugger stepped (in the debug loop),
after locking the debugger to pause.<BR>struct <STRONG>PLUG_CB_STEPPED</STRONG> <BR>{<BR>&nbsp;&nbsp;&nbsp;
<STRONG>void*</STRONG>
reserved;<BR>};</P>
<P>//Called before attaching to a process.<BR>struct <STRONG>PLUG_CB_ATTACH</STRONG><BR>{<BR>&nbsp;&nbsp;&nbsp;
<STRONG>DWORD</STRONG> dwProcessId;<BR>};</P>
<P>//Called before detaching from the process.<BR>struct <STRONG>PLUG_CB_DETACH</STRONG><BR>{<BR>&nbsp;&nbsp;&nbsp;
<STRONG>PROCESS_INFORMATION*</STRONG> fdProcessInfo;<BR>};</P>
<P>//Called on any debug event, even the ones that are
handled internally, <U><STRONG>AVOID</STRONG> doing stuff that takes time
here</U>, this will slow the debugger down a lot!<BR>struct <STRONG>PLUG_CB_DEBUGEVENT</STRONG> <BR>{<BR>&nbsp;&nbsp;&nbsp;
<STRONG>DEBUG_EVENT*</STRONG> DebugEvent;<BR>};</P>
<P>//Called when a menu entry created by the plugin has
been clicked, the GUI will resume when this callback returns.<BR>struct <STRONG>PLUG_CB_MENUENTRY</STRONG><BR>{<BR>&nbsp;&nbsp;&nbsp;
<STRONG>int</STRONG> hEntry;<BR>};</P>
<P>//Called before TranslateMessage and DispatchMessage
Windows functions (PreTranslateMessage). Avoid calling user32 functions without
precautions here, there <STRONG>will</STRONG> be a recursive call if you fail
to take countermeasures.<BR>struct
<STRONG>PLUG_CB_WINEVENT<BR></STRONG>{<BR>&nbsp;&nbsp;&nbsp; <STRONG>MSG*</STRONG>
message;<BR>&nbsp;&nbsp;&nbsp; <STRONG>long*</STRONG>
result;<BR>&nbsp;&nbsp;&nbsp; <STRONG>bool</STRONG> retval; //only set this to true, never to
false<BR>};</P>
<P>//Called before TranslateMessage and DispatchMessage
Windows functions (PreTranslateMessage). Avoid calling user32 functions without
precautions here, there <STRONG>will</STRONG> be a
recursive call if you fail to take countermeasures. This function is global, so it also captures hotkeys
(see Qt documentation).<BR>struct
<STRONG>PLUG_CB_WINEVENTGLOBAL<BR></STRONG>{<BR>&nbsp;&nbsp;&nbsp; <STRONG>MSG*</STRONG>
message;<BR>&nbsp;&nbsp;&nbsp; <STRONG>bool</STRONG> retval; //only set this to true, never to
false<BR>};</P></body></HTML>