I'm learning about the debug API's and I'm having a degree of success thanks to Icelions tut's but I dont understand
a few things. When I arrive at the EXCEPTION_BREAKPOINT event, how am I supposed to suspend the debuggee.
I've currently got the debugger loop in a thread and I suspend that thread, which suspends the debuggee as it was
created in that thread. Is this ok or is there a "proper" way ?

Also, if I suspend a debuggee that has threads of its own running, would I have to enumerate and suspend those
threads too ? I've not got that far yet but thought I'd ask while I'm here.

And the last one is maybe a stupid one but if the debuggee has grabbed some memory, from the heap for example,
and the debuggee is terminated prematurely, the memory wont be freed. Is there anything that I can do to exit
gracefully or is that just the way it is ?

Quite educational the debug API stuff, just not many full fetured examples around to learn from.
Still, keep trying eh ?

Posted on 2004-08-02 12:03:05 by Emerson
All threads will be automatically suspended when a debug event occurs, so you don't have to do it yourself. They will be resumed when you call ContinueDebugEvent.

If you want the process to exit in a normal manner, you could have a thread resume execution at the ExitProcess function.
Posted on 2004-08-02 12:22:22 by Sephiroth3
All memory is freed no mater how the process ends, since the kernel keeps list of allocated chunks in its internal data structures.
Posted on 2004-08-02 13:04:35 by omega_red
Thanks Guys !!

"All memory is freed no mater how the process ends"

Does this include things like LoadImage, CreateDC, CreateBitmap, etc ?. Is this a feature of creating a process for
debugging or will these objects still constitute a memory leak ? Does this apply to all OS's ?

Posted on 2004-08-02 14:07:34 by Emerson
GDI objects aren't freed, since the system doesn't keep track of which application created them.
Posted on 2004-08-02 20:14:15 by Sephiroth3
I am sure they are freed!
Posted on 2004-08-02 21:36:12 by comrade
Thanks comradeSephiroth3,

Seems a difference of opinion here so I wrote a quick test prog that created several thousand objects, DC's, bitmaps etc,
loaded it into my debugger, and terminated it without cleaning up. This whole process was then put into a loop and run a
few thousand times.

Over 1 million objects later, it seems that it had no adverse efferct on my system. Although I'm thinking maybe this
is because I am testing under NT based memory management OS's (2k and XP). Would be nice if this applied to Win9x too.

Anyone else with any thoughtsknowledge ??

Posted on 2004-08-03 03:41:34 by Emerson
GDI on 9x is VERY unstable, it's easy to crash the system by allocating too many objects. So I suppose they aren't freed too :)
Posted on 2004-08-03 05:28:16 by omega_red
like you said win nt/2k handles memory differently. win9x will suffer a lot when there are too many gdi objects in memory. that is why it is always recommended to properly free all unused stuff.

have fun keeping on learning!

Posted on 2004-08-03 05:30:27 by
looks i was a little late =)
Posted on 2004-08-03 05:31:30 by