Trying to understand how ChangeDebuggeeState works

WINDBG
1

I need to be able to receive a notification from my WinDbg extension when the target's virtual or physical memory changes. I was hoping to use ChangeDebuggeeState callback for that.

I wrote my own class MyCallbacks, that implements IDebugEventCallbacksWide interface. I then used it in SetEventCallbacksWide, as such:

    CComPtr<IDebugControl4> pDebugControl;
    DebugCreate(IID_PPV(pDebugControl));

    CComPtr<IDebugClient5> pDbgClient;
    pDebugControl->QueryInterface(IID_PPV(pDbgClient));

    MyCallbacks* pC = new MyCallbacks;
    pDbgClient->SetEventCallbacksWide(pC);

The AddRef method of my MyCallbacks class is called after the sequence above, as well as the GetInterestMask, where I specify what exactly I want to trap:

HRESULT STDMETHODCALLTYPE MyCallbacks::GetInterestMask(
        _Out_ PULONG Mask
        )
{
    *Mask = DEBUG_EVENT_CHANGE_DEBUGGEE_STATE;

    return S_OK;
}

But then when I work with WinDbg by stepping through the live target, my implemented ChangeDebuggeeState function is never called. Where I would expect it to be called since the target's virtual/physical memory is being changed.

Any idea what am I doing wrong?

PS. I tried adjusting it a little bit, and used the DEBUG_EVENT_BREAKPOINT mask for GetInterestMask and then checked if my IDebugEventCallbacksWide::Breakpoint method was called when a kernel breakpoint was hit in the WinDbg - and my callback was never called either.

2

Do you mean the CONTENTS of the memory? That's impossible, of course. You can monitor a few words.

The "state" in DEBUG_EVENT_CHANGE_DEBUGGEE_STATE basically means running vs stopped.

3

Sure, but why doesn't DEBUG_EVENT_BREAKPOINT work either?