BOOL FixBugRun (LPTSTR lpCommandLine, LPCTSTR lpCurrentDirectory, DWORD dwFlags);
DWORD BreakPointSet (BPHANDLER bpHandler, LPCTSTR lpExeName, LPCTSTR lpDllName, LPCSTR lpProcName, DWORD dwOffset, DWORD dwExpectedByte, PVOID pvUser);
BOOL BreakPointClear (DWORD dwBreakpointId);
BOOL BreakPointEnable (DWORD dwBreakpointId);
BOOL BreakPointDisable (DWORD dwBreakpointId);
BOOL SingleStep (BPHANDLER bpHandler, PVOID pvUser);
BOOL PatchBytes (LPCTSTR lpExeName, LPCTSTR lpDllName, LPCSTR lpProcName, DWORD dwOffset, const LPBYTE lpbNew, DWORD dwLen, const LPBYTE lpbExpected);
DWORD GetModuleBase (LPCTSTR lpExeName, LPCTSTR lpDllName);
BOOL ReadFunctionArgs (HANDLE hProcess, DWORD dwAddress, LPCSTR lpFormat, ...);
DWORD ReadStringA (HANDLE hProcess, DWORD dwAddress, LPSTR lpStr, LPDWORD pcchStr);
DWORD ReadStringW (HANDLE hProcess, DWORD dwAddress, LPWSTR lpStr, LPDWORD pcchStr);
DWORD FBGetLastError (void);
LPCSTR FBErrorStr (DWORD dwCode);
typedef DWORD (*BPHANDLER) (HANDLE hProcess, CONTEXT *pContext, PVOID pvUser);
The FixBugInit function initializes the Win-Fix-Bug library.
Parameters
This function has no parameters.
Return Value
If the library has initialized itself successfully, the return value is TRUE.
If the function fails, the return value is FALSE.
Remarks
This function must be called before using any of the other functions in the Win-Fix-Bug package.
The FixBugRun function creates a child process under the Win-Fix-Bug system. It does not return until the child process has exited.
Parameters
Value Meaning
Return Value
If the function succeeds, the return value is TRUE.
If the function fails, the return value is FALSE. To get extended error information, call GetLastError.
Remarks
Win-Fix-Bug only supports Win32 programs. If lpCommandLine specifies a DOS or 16-bit Windows program the function will fail and the extended error information will be set to ERROR_INVALID_PARAMETER.
See Also
BreakPointSet, BPHANDLER, PatchBytes
The BreakPointSet function sets a break point whose address is specified by exe, module, function name, and offset. When the break point is reached, the process thread is suspended and control is transferred to the user-defined break point handler.
Parameters
If this parameter is NULL, the base address of the executable image is used.
If the first character of the string is null (ie, lpProcName points to a null string "") then the address used is the absolute address given by dwOffset, otherwise the break point address is given by the function address plus the offset specified in the dwOffset parameter.
If EB_ANY is specified, no check is made.
This parameter may be useful when specifying an address relative to the base of the executable as an additional safety check that the correct address is being used.
Return Value
If the function succeeds, the return value is a non-zero break point identifier. Break points are initially enabled when they are set. The identifier can passed to the other break point functions to enable, disable, or clear it.
If the function fails, it returns 0.
Remarks
Keep in mind that a typical scenario involves calling BreakPointSet before running the program with FixBugRun. In this case, the program to be debugged will not be loaded into memory, so it is impossible to determine whether the break point can be successfully applied. The return of a break point identifier only indicates that Win-Fix-Bug was able to internally process the break point.
See Also
FixBugRun, BPHANDLER, BreakPointClear, BreakPointEnable, BreakPointDisable
The BreakPointClear function permanently deletes a break point.
Parameters
Return Value
If the function succeeds, the return value is TRUE.
If an invalid break point identifier is specified, the function returns FALSE.
Remarks
Once a break point has been cleared it may no longer be referred to.
Break points can also be cleared upon exit from their handler by returning the value BPH_CLEAR.
See Also
BreakPointSet, BreakPointEnable, BreakPointDisable
The BreakPointEnable function reactivates break points that were disabled.
Parameters
Return Value
If the function succeeds, the return value is TRUE.
If an invalid break point identifier is specified, the function returns FALSE.
Remarks
See Also
BreakPointSet, BreakPointClear, BreakPointDisable
The BreakPointDisable function is used to temporarily deactivate break points.
Parameters
Return Value
If the function succeeds, the return value is TRUE.
If an invalid break point identifier is specified, the function returns FALSE.
Remarks
Disabled break points may be reactivated with the BreakPointEnable function.
Break points can also be disabled upon exit from their handler by returning the value BPH_DISABLE.
See Also
BreakPointSet, BreakPointClear, BreakPointEnable
The SingleStep function begins single stepping a process thread. It may only be called from within a break point handler.
Parameters
Return Value
If the process thread is able to be set up for single stepping, the
function returns TRUE.
If the function fails it returns FALSE.
Remarks
This function can only be called from within a break point handler. Single stepping begins after executing the instruction that the break point occurred at. The function specified in bpHandler will be called prior to each instruction in the process thread. To disable single stepping, the handler must return BPH_CLEAR otherwise if BPH_REENABLE is returned single stepping continues.
See Also
The PatchBytes function replaces bytes of an executable in memory.
Parameters
If this parameter is NULL, the base address of the executable image is used.
If the first character of the string is null (ie, lpProcName points to a null string "") then the address used is the absolute address given by dwOffset, otherwise the patch address is given by the function address plus the offset specified in the dwOffset parameter.
Return Value
If the function succeeds, the return value TRUE.
If the function fails, it returns FALSE.
Remarks
Keep in mind that a typical scenario involves calling PatchBytes before running the program with FixBugRun. In this case, the program to be patched will not be loaded into memory, so it is impossible to determine whether the patch can be successfully applied. A return value of TRUE only indicates that Win-Fix-Bug was able to add the patch to its internal list.
See Also
The GetModuleBase function returns the base address for a module which has been loaded into memory by a process running under Win-Fix-Bug.
Parameters
Return Value
If the module specified is currently in memory then the load address is
returned.
If the function fails due to the module not being loaded or otherwise, 0
is returned.
Remarks
This function is provided so that data which is global to a module can be addressed. Global module data is always located at a specific offset from the load address.
See Also
The ReadFunctionArgs function reads data from the processes memory and stores it to the location given by the pointers following lpFormat string. Its operation is analogous the scanf() C function.
Parameters
specifier | corresponding C data type |
c | character |
s | short integer |
i | integer / 32 bit pointer |
l | __int64 |
f | float |
d | double |
Return Value
If the function succeeds by reading all arguments specified by the
format string, it returns TRUE.
If the function fails FALSE is returned.
Remarks
See Also
The ReadStringX function reads a nul terminated ascii or unicode string from another processes memory.
Parameters
Return Value
If the function succeeds by successful reading a text string it returns TRUE.
If the function fails FALSE is returned.
If the size of the buffer pointed to by lpStr is too small,
FBGetLastError will return FB_ERROR_BUFSIZE.
Remarks
See Also
The FBGetLastError function returns the code of the most recent error encountered.
Parameters
This function has no parameters.
Return Value
The last error that occurred or 0 (FB_ERROR_SUCCESS) if the last operation was successful.
Remarks
See Also
The FBErrorStr function returns a null-terminated string with the text representation of an error code.
Parameters
Return Value
The string representation of the error code is returned.
Remarks
See Also
A BPHANDLER function is a user-defined break point handler. The break point handler is called when a break point or single step break point occurs.
Parameters
Return Value
The function must return one of the following values:
Remarks
See Also
BreakPointSet, SingleStep, FixBugRun, BreakPointClear, BreakPointEnable, BreakPointDisable