In terms of the debugger architecture, a process:

  • Is a container for a set of programs. It is closely analogous to a Windows process, which is a container for a set of threads.

  • Can identify itself by name, identifier, or physical identifier.

  • Can enumerate all running programs (and their threads).

  • Can describe itself, the port it is running in, and the machine that contains it.

  • Can create one or more programs, terminate any of the programs it creates, or cause a program to stop.

  • Is represented by an IDebugProcess2 interface, which is created when the process is launched. A process is launched by either the session debug manager (SDM) or IDebugEngineLaunch2::LaunchSuspended.

The debug package can attach a debug engine (DE) to a process by calling IDebugProcess2::Attach. This means that the DE attaches to all possible programs running in the process that it can handle. For example, if the common language runtime DE attaches to a process, it attaches only to programs that are running managed code.

Community Additions