Hi, I am trying to code a custom debugger. So after CreateProcess(), I use WaitForDebugEvent(). I observed that in every LOAD_DLL_DEBUG_EVENT, a new file handle is created (u.LoadDll.hFile). After the process is terminated, the numerous file handles still remains. Over time, wouldn't this cause a low virtual memory?
The code is straightforward, pasted here.
Thanks for any help.
Code:
bool continueDebugging = true;
if ( CreateProcess( NULL, szProcCmd, NULL, NULL, FALSE, CREATE_NEW_CONSOLE|DEBUG_PROCESS, NULL, NULL, &si, &pi) )
{
while (continueDebugging )
{
memset (&DebugEvent, 0, sizeof(DEBUG_EVENT));
if(WaitForDebugEvent(&DebugEvent, 1000))
{
if (DebugEvent.dwDebugEventCode == CREATE_PROCESS_DEBUG_EVENT)
{
//do something
}
else if (DebugEvent.dwDebugEventCode == EXIT_PROCESS_DEBUG_EVENT)
{
continueDebugging = false;
}
else if (DebugEvent.dwDebugEventCode == CREATE_THREAD_DEBUG_EVENT)
{
//do something
}
else if (DebugEvent.dwDebugEventCode == EXIT_THREAD_DEBUG_EVENT)
{
//do something
}
else if (DebugEvent.dwDebugEventCode == LOAD_DLL_DEBUG_EVENT)
{
//do something
}
else if (DebugEvent.dwDebugEventCode == UNLOAD_DLL_DEBUG_EVENT)
{
//do something
}
else if (DebugEvent.dwDebugEventCode == OUTPUT_DEBUG_STRING_EVENT)
{
//do something
}
else if (DebugEvent.dwDebugEventCode == RIP_EVENT)
{
//do something
}
else if (DebugEvent.dwDebugEventCode == EXCEPTION_DEBUG_EVENT)
{
//do something
}
else
{
//"Undefined Event!!
}
ContinueDebugEvent( DebugEvent.dwProcessId, DebugEvent.dwThreadId, DBG_CONTINUE);
}
}
DebugActiveProcessStop(pi.dwProcessId);
TerminateProcess(pi.hProcess, );
CloseHandle(pi.hThread);
CloseHandle(pi.hProcess);
}