IDebugEventCallbacks::CreateProcess method (dbgeng.h)

Article
10/21/2021

The CreateProcess callback method is called by the engine when a create-process debugging event occurs in the target.

Syntax

HRESULT CreateProcess(
  [in]           ULONG64 ImageFileHandle,
  [in]           ULONG64 Handle,
  [in]           ULONG64 BaseOffset,
  [in]           ULONG   ModuleSize,
  [in, optional] PCSTR   ModuleName,
  [in, optional] PCSTR   ImageName,
  [in]           ULONG   CheckSum,
  [in]           ULONG   TimeDateStamp,
  [in]           ULONG64 InitialThreadHandle,
  [in]           ULONG64 ThreadDataOffset,
  [in]           ULONG64 StartOffset
);

Parameters

[in] ImageFileHandle

Specifies the handle to the process's image file. If this information is not available, ImageFileHandle will be NULL.

[in] Handle

Specifies the handle to the process. This parameter corresponds to the hProcess field in the CREATE_PROCESS_DEBUG_INFO structure. If this information is not available, ImageFileHandle will be NULL.

[in] BaseOffset

Specifies the base address of the process's executable image in the target's memory address space. If this information is not available, BaseOffset will be NULL.

[in] ModuleSize

Specifies the process's executable image size in bytes. If this information is not available, ModuleSize will be zero.

[in, optional] ModuleName

Specifies the simplified module name that is used by the debugger engine. In most cases, this matches the image file name excluding the extension. If this information is not available, ModuleName will be NULL.

[in, optional] ImageName

Specifies the process's executable-image file name, which can include the path. If this information is not available, ImageName will be NULL.

[in] CheckSum

Specifies the checksum of the process's executable image. If this information is not available, CheckSum will be zero.

[in] TimeDateStamp

Specifies the time and date stamp of the process's executable-image file. If this information is not available, TimeDateStamp will be zero.

[in] InitialThreadHandle

Specifies the handle to the process's initial thread. This parameter corresponds to the hThread field in the CREATE_PROCESS_DEBUG_INFO structure. If this information is not available, InitialThreadHandle will be NULL.

[in] ThreadDataOffset

Specifies a block of data that the operating system maintains for this thread. The actual data in the block is operating system-specific. If this information is not available, ThreadDataOffset will be NULL.

[in] StartOffset

Specifies the starting address of the thread in the process's virtual address space. If this information is not available, StartOffset will be NULL.

Return value

This method returns a DEBUG_STATUS_XXX value, which indicates how the execution of the target should proceed after the engine processes this event. For details on how the engine treats this value, see Monitoring Events.

Remarks

This method is only called by the engine if the DEBUG_EVENT_CREATE_PROCESS flag is set in the mask returned by IDebugEventCallbacks::GetInterestMask.

For more information about handling events, see Monitoring Events. For information about threads, see Threads and Processes.

Requirements

Requirement	Value
Target Platform	Desktop
Header	dbgeng.h (include Dbgeng.h)

Share via