从零开始编写调试器

一位曾在微软调试器平台团队工作的开发者分享了用Rust从零开始编写调试器DbgRs的第一部分教程 1。该教程重点讲解如何在Windows上附加到进程并监控调试事件 1。

作者编写这个项目的目的是学习Rust并教他人调试器的开发方法 1。调试器通过CreateProcessW和WaitForDebugEventEx等Windows API实现了基本框架，能够捕获并处理进程的各类调试事件，包括DLL加载、线程创建、异常等 1。

调试器的核心基于事件循环机制：WaitForDebugEventEx用于等待调试事件，ContinueDebugEvent则继续进程执行 1。在Windows上附加到进程有两种方式——使用DebugActiveProcess附加到已运行的进程，或在使用CreateProcessW创建进程时指定DEBUG_ONLY_THIS_PROCESS标志 1。

DEBUG_EVENT结构包含进程ID、线程ID和事件代码，支持包括EXCEPTION_DEBUG_EVENT、CREATE_THREAD_DEBUG_EVENT、LOAD_DLL_DEBUG_EVENT在内的9种事件类型 1。进程初启动时会触发来自ntdll!LdrpDoDebuggerBreak的初始断点异常（int 3），这是调试过程中的重要事件 1。

完整代码已上传至GitHub，其中part1分支包含本部分的实现代码，建议使用VS Code和rust-analyzer插件进行查看 1。

---

An author who previously worked twice on Microsoft's debugger platform team has published the first part of a tutorial on building a debugger called DbgRs using Rust 1. The project aims to both teach the author Rust and help others understand how debuggers are constructed 1.

The tutorial focuses on the mechanics of attaching to processes on Windows and monitoring debugging events 1. The core of the debugger operates through an event loop: WaitForDebugEventEx waits for debugging events to occur, while ContinueDebugEvent allows process execution to resume 1. Two methods enable attachment to processes—DebugActiveProcess for connecting to already-running processes, or CreateProcessW with the DEBUG_ONLY_THIS_PROCESS flag when launching a new process 1.

The DEBUG_EVENT structure captures essential information including process ID, thread ID, and event code 1. The debugger can handle nine different event types, including EXCEPTION_DEBUG_EVENT, CREATE_THREAD_DEBUG_EVENT, and LOAD_DLL_DEBUG_EVENT 1. When a process starts, an initial breakpoint exception originating from ntdll!LdrpDoDebuggerBreak is triggered—a critical event in the debugging workflow 1.

The complete code has been made available on GitHub in the part1 branch 1. The author recommends using VS Code with the rust-analyzer plugin for viewing the implementation 1.

---