IDebugEventCallbacks::CreateProcess

The CreateProcess callback method is called by the engine when a create-process debugging event occurs in the target.

HRESULT
  IDebugEventCallbacks::CreateProcess(
    IN ULONG64  ImageFileHandle,
    IN ULONG64  Handle,
    IN ULONG64  BaseOffset,
    IN ULONG  ModuleSize,
    IN PCSTR  ModuleName,
    IN PCSTR  ImageName,
    IN ULONG  CheckSum,
    IN ULONG  TimeDateStamp,
    IN ULONG64  InitialThreadHandle,
    IN ULONG64  ThreadDataOffset,
    IN ULONG64  StartOffset
    );

HRESULT
  IDebugEventCallbacksWide::CreateProcess(
    IN ULONG64  ImageFileHandle,
    IN ULONG64  Handle,
    IN ULONG64  BaseOffset,
    IN ULONG  ModuleSize,
    IN PCWSTR  ModuleName,
    IN PCWSTR  ImageName,
    IN ULONG  CheckSum,
    IN ULONG  TimeDateStamp,
    IN ULONG64  InitialThreadHandle,
    IN ULONG64  ThreadDataOffset,
    IN ULONG64  StartOffset
    );

#ifdef UNICODE
#define IDebugEventCallbacksT IDebugEventCallbacksWide
#else
#define IDebugEventCallbacksT IDebugEventCallbacks
#endif

Parameters

ImageFileHandle

Specifies the handle to the process's image file. If this information is not available, ImageFileHandle will be NULL.

Handle

Specifies the handle to the process. This parameter corresponds to the hProcess field in the CREATE_PROCESS_DEBUG_INFO structure. If this information is not available, ImageFileHandle will be NULL.

BaseOffset

Specifies the base address of the process's executable image in the target's memory address space. If this information is not available, BaseOffset will be NULL.

ModuleSize

Specifies the process's executable image size in bytes. If this information is not available, ModuleSize will be zero.

ModuleName

Specifies the simplified module name that is used by the debugger engine. In most cases, this matches the image file name excluding the extension. For details, see Executable Image Path. If this information is not available, ModuleName will be NULL.

ImageName

Specifies the process's executable-image file name, which can include the path. If this information is not available, ImageName will be NULL.

CheckSum

Specifies the checksum of the process's executable image. If this information is not available, CheckSum will be zero.

TimeDateStamp

Specifies the time and date stamp of the process's executable-image file. If this information is not available, TimeDateStamp will be zero.

InitialThreadHandle

Specifies the handle to the process's initial thread. This parameter corresponds to the hThread field in the CREATE_PROCESS_DEBUG_INFO structure. If this information is not available, InitialThreadHandle will be NULL.

ThreadDataOffset

Specifies a block of data that the operating system maintains for this thread. The actual data in the block is operating system–specific. If this information is not available, ThreadDataOffset will be NULL.

StartOffset

Specifies the starting address of the thread in the process's virtual address space. If this information is not available, StartOffset will be NULL.

Return Value

This method returns a DEBUG_STATUS_XXX value, which indicates how the execution of the target should proceed after the engine processes this event. For details on how the engine treats this value, see Monitoring Events.

Comments

This method is only called by the engine if the DEBUG_EVENT_CREATE_PROCESS flag is set in the mask returned by IDebugEventCallbacks::GetInterestMask.

For more information about handling events, see Monitoring Events. For information about threads, see Threads and Processes.

Requirements

Headers: Defined in dbgeng.h. Include dbgeng.h.