sedivyk Guest
|
Posted: Fri Mar 09, 2007 8:58 pm Post subject: ReadProcessMemory |
|
|
Hi
I'm trying to write a little debugger. I have succeeded in opening/
attaching myself to any process and capturing debug events even for
system services which is the main purpose of my debugger. I am able to
get outputdebugstrings without a problem. The problem I am having is
that I would like to retieve information about delphi raised
exceptions. As I understand it, delphi exceptions have the exception
code $0EEDFADE. Delphi also stores the exception object in
ExceptionInformation array.
"On Win32, if the calling application or library is written in another
language, the exception can be handled as an operating-system
exception with the exception code $0EEDFADE. The first entry in the
ExceptionInformation array of the operating-system exception record
contains the exception address, and the second entry contains a
reference to the Delphi exception object."
I tried the followig code:
case ii_DebugEvent.dwDebugEventCode of
$0EEDFADE:
begin
if DebugEvent.Exception.ExceptionRecord.NumberParameters > 0 then
begin
if DebugEvent.Exception.ExceptionRecord.NumberParameters > 1 then
lp_ObjPtr :=
Pointer(DebugEvent.Exception.ExceptionRecord.ExceptionInformation[1]);
// Test if pointer points to an TClass - possibly a TObject
if Assigned(lp_AccessAddress) and
ReadProcessMemory(ProcHandle, lp_ObjPtr, @lp_Pointer,
SizeOf(lp_Pointer), BytesRead) and
ReadProcessMemory(ProcHandle, Pointer(Integer(lp_Pointer) +
vmtSelfPtr), @lp_Exception, SizeOf(lp_Exception), BytesRead) and
(lp_Pointer = lp_Exception) then
begin
if ReadProcessMemory(ProcHandle,
Pointer(Integer(lp_Exception) + vmtClassName), @ls_ShortStr,
SizeOf(ShortString), BytesRead) then
// **** ls_ShortStr contains garbage !!!
// **** Can't seem to be able to retrieve the exception
object into lp_exception!!!
end;
end;
end;
end;
I tried typecasting the lp_Pointer to TObject but it seems that its
not a valide adress.
Does any one have any ideas how to access the Exception object ? I
want to get its message property.
thanks for any help |
|