breakpointserv.h

PE Monitor是一个小调试器和反汇编器

#ifndef __BREAKPOINT_SERV_H__
#define __BREAKPOINT_SERV_H__

#define MAXBREAKPOINTCOUNT  101
#define FUNCTIONNAMELEN     50

typedef enum tagFUNCTION_NAME
{
    FN_CREATEFILEA,
    FN_DELETEFILEA,
    FN_COPYFILEA,
    FN_REGCREATEKEYA,
    FN_REGCREATEKEYEXA,
    FN_REGDELETEKEYA,
    FN_REGSETVALUEA,
    FN_REGSETVALUEEXA,
} FUNCTION_NAME;

typedef struct tagBPDATA
{ 
    LPVOID lpAddr;
    BYTE   byData;
    char   szFuncName[FUNCTIONNAMELEN];
    FUNCTION_NAME fnFuncName;
} BPDATA;

typedef struct tagFUNCTION_BREAKPOINT
{
    char *szFuncName;
    FUNCTION_NAME fnFuncName;
} FUNCTION_BREAKPOINT;

extern const FUNCTION_BREAKPOINT g_FuncBP[];
extern const int g_nFuncBPCount;

extern BPDATA g_bpData[MAXBREAKPOINTCOUNT];

int SetBreakPoint(
    /* [in] */ const HANDLE hProcess,
    /* [in] */ const LPVOID lpAddr,
#ifdef _MY_DEBUG
    /* [in] */ const char szFuncName[],
#endif
    /* [in] */ const FUNCTION_NAME fnFuncName,
    /* [in] */ const int nNum
);

int RemoveBreakPoint(
    /* [in] */ const HANDLE hProcess,
    /* [in] */ const int nNum
);

int GetBreakPointIndex(
    /* [in] */ const LPVOID lpAddr
);

int SetFunctionsBreakPoint(
    /* [in] */ const HANDLE hProcess
);

int AnalyzeBreakPointAndWriteToLog(
    /* [in] */ const HANDLE hProcess,
    /* [in] */ const unsigned long Esp,
    /* [in] */ const FUNCTION_NAME fnFuncName
);

int GetTextFromStack(
    /* [in] */ const HANDLE hProcess,
    /* [in] */ const unsigned long Esp,
    /* [in] */ const int nNum,  // Item's Number of stack, start from 1
    /* [in] */ const unsigned int unBufSize,
    /* [out] */ char *buf
);

/**
 * Get unsigned long value from stack.
 */
int GetULValueFromStack(
    /* [in] */ const HANDLE hProcess,
    /* [in] */ const unsigned long Esp,
    /* [in] */ const int nNum,  // Item's Number of stack, start from 1
    /* [out] */ unsigned long *ulParamValue
);

#endif  // __BREAKPOINT_SERV_H__