[Autogenerated] Here's win debug launch just an empty environment
Let's just launch some executable Let's go,
to see Windows Maybe we'll find something.
To launch such as the right application.
It doesn't really matter for our purposes here.
So when we want to attach, to the process very early.
In the process.
Uh Time we can see that We're just uh using NT data data at this point.
To initialize stuff within the process.
So let's go, to file, and then go, to settings,
and Let's go, to events, and exceptions.
This is where you can configure first chance,
and second chance exceptions by the way but also some other interesting events.
For example, you can see there.
The part here called events which is not really about exceptions.
It's about, well, events, things, that are happening.
That might be interesting.
For example, what happens when the threat gets created?
You can see Here it, says ignore which means nobody cares.
On the other hand, we can specify something else like break,
which means first chance, second chance break means second chance.
But for events there,
is really no difference between the two because there's no meaning
for these kind of uh event as a first or second.
Just because it's not an exception.
So it's just uh something which is this is kind of weird here.
In the UI of win debug and probably should be changed.
But for consistency, we have these four options,
the other option, that remains is saying,
output Let's just output something, and then Continue on our merry way.
Same goes for other kinds of events.
For example, loading of a module module means DLL for example.
So currently we just get an output which in fact,
are very familiar with but we can change,
that to something like break, and again,
break, and second chance just mean the same thing.
Let's try it out.
TIFF You go ahead, and run this.
Now you notice that We get a module load here.
Uh but we are also getting a break point.
Why?
Because exactly that happened.
A module has been loaded because this is exactly what we asked for.
We had to ask, to get a break point when that happens.
So it happens in some point while the DLL is being loaded specifically
when its being mapped into the virtual andrew space.
But these by this native a P I ANT map view of section.
Let's go back here.
And uh and remove that Well, let's just keep it.
And continue running and Obviously,
when the process just starts up many other DLL LS might be loaded.
And That's why we're hitting this break point multiple times.
Now, here's another DLL that has been loaded at this point.
Let's go back.
And remove that go back, to the settings,
and for loading of DLL Let's just go ahead.
And Resume the first option of output But notice that Now we create thread,
we do get an output we can change, that to break.
So let, let's now break when your thread comes up.
So let's run and Again, we get a break point here,
in the function, our TLS user thread start which is the internal function,
an TL L, that is the basis of every thread out there.
So its just the 3rd 3rd has just started running a new third
just started running Yout see the call stack is very small only
having that initial function there, and we can change,
that back.
But this time not to ignore, but just to output So every time a thread comes up,
we'll be seeing some kind of output indicating that So going back here,
the debugger we can see We get these notifications,
that a thread has been created which is Nice.
So we have these events.
On the other hand, going back to the same dialogue here,
we have exceptions, this is about exceptions,
providing something similar.
To what we've seen in Visual Studio For every type of exception,
you can specify whether we'd like that to be brain broken
into first chance or second chance.
So for example, access violation,
is going to be breaking us on first chance because access violation,
is considered a very severe exception.
So if that happens.
I usually want to know why this is happening before any attempt of handling.
That exception might take place.
And many Most cases we don't really handle that kind of exception.
We can see that all four other exceptions, that are not specified.
In the list, this is what's called here, an node exception.
We would like to only break.
If it is not handled.
That's what second chance means.
If it's not handled, I would like to break.
So you can see other exception types here.
One of the examples we see here, is something like C L R exception,
which is a .NET exception does that mean that win debug
understands .NET in any significant way,
not really but .NET uses a particular number for representing
its exceptions as S C H exceptions internally,
and So win debug knows about these numbers.
So it can in fact break on any .NET exception,
first chance,
or check second chance without any issues because it just looks for that
Particular number doesn't really know whether that's,
in fact, .NET or something else, same.
Go for C++ This is number selected by Microsoft for their compiler,
that is used to represent C++ exceptions generated
normally using the row instruction, plus plus But behind the scenes,
sc is used raise exception.
Is used behind the scenes with a very specific number
known to win debug and So it's possible.
To change, that for example, to break in any first chance exception,
that is coming.
From C++ for a high level C++ language, and there,
are some other exceptions here which are low level,
most of them coming from the processor.
By the way, the second column here you have to specify not handled.
Otherwise the debugger will handle that internally,
and you won't get a chance, to do anything in that regard,
and In some cases, it makes sense such as a control,
see and control break,
these kinds of things you would like the debugger to handle for you.
But in most cases, you want to keep that as not handled.
So whatever you five here in fact makes sense.
And will take effect you.
Can see here, that integer, divide by zero.
Is An example if you look back at our previous code
is specified here as first chance.
Although in Visual Studio it, was specified by default as second chance,
only again, this is just a matter of choice,
and we can definitely change, that one way or the other