Hex-Rays logo State-of-the-art binary code analysis tools
email icon
Debugger functions

Detailed Description

Control the debugging of a process.

Debugger functions complete either SYNCHRONOUSLY or ASYNCHRONOUSLY:

  • SYNCHRONOUS FUNCTIONS execute the entire action before the function returns.
  • ASYNCHRONOUS FUNCTIONS return before the action has executed in its entirety. They simply start the action, but the result of the action will only be available later. For example, run_to() can execute a lot of instructions before terminating. Such functions provide a notification code to indicate the end of their execution (see the 'Notification' keyword in the function documentation). Install a callback using hook_to_notification_point() to be notified when the action is terminated.

DEBUGGER COMMANDS are functions who influence the execution of the debugged process. They are available in 2 forms:

  • COMMAND(): (e.g. suspend_process()) In this mode, the command will be directly executed. However, it is forbidden to use asynchronous commands in this mode from a debugger notification handler (see dbg_notification_t).
  • request_COMMAND(): (e.g. request_suspend_process()) In this mode, a REQUEST to run the command will be memorized at the end of the REQUEST QUEUE (see below). This is mandatory to use this mode for asynchronous commands from a debugger notification handler (see dbg_notification_t).

The REQUEST QUEUE contains a list of planned debugger commands. These commands will be started only in the following cases:

  • the previous command terminated, and no call to suspend_process() or continue_process() occurred in the asynchronous function result notification handler (if any).
  • run_requests() was called. Please note that when called from a debugger notification handler the queued requests will only be started after the execution of all notification handlers.

A request which fails to start (by returning 0) will generate a dbg_request_error notification.


 Process commands
 Use these functions to manipulate the debugged process.
 Inspect/Manipulate threads of debugged process.
 Functions to enumerate modules loaded into the process.
 Execution flow control
 Use these functions to run instructions in the debugged process.
 Inspect/Manipulate registers for debugged process.
 Work with debugger breakpoints.
 Trace instructions/functions/basic blocks.
 High level functions
 These functions can be used from scripts.
 Source information providers
 These providers supply information about the source files and lines to the source level debugger.
 Debugger memory functions for UI
 Inspect debugged process memory.
 Convenience functions offered by the user interface.