一位曾在微软调试器平台团队工作的开发者分享了用Rust从零开始编写调试器DbgRs的第一部分教程 [1]。该教程重点讲解如何在Windows上附加到进程并监控调试事件 [1]。
作者编写这个项目的目的是学习Rust并教他人调试器的开发方法 [1]。调试器通过CreateProcessW和WaitForDebugEventEx等Windows API实现了基本框架，能够捕获并处理进程的各类调试事件，包括DLL加载、线程创建、异常等 [1]。
调试器的核心基于事件循环机制：WaitForDebugEventEx用于等待调试事件，ContinueDebugEvent则继续进程执行 [1]。在Windows上附加到进程有两种方式——使用DebugActiveProcess附加到已运行的进程，或在使用CreateProcessW创建进程时指定DEBUG_ONLY_THIS_PROCESS标志 [1]。
DEBUG_EVENT结构包含进程ID、线程ID和事件代码，支持包括EXCEPTION_DEBUG_EVENT、CREATE_THREAD_DEBUG_EVENT、LOAD_DLL_DEBUG_EVENT在内的9种事件类型 [1]。进程初启动时会触发来自ntdll!LdrpDoDebuggerBreak的初始断点异常（int 3），这是调试过程中的重要事件 [1]。
完整代码已上传至GitHub，其中part1分支包含本部分的实现代码，建议使用VS Code和rust-analyzer插件进行查看 [1]。
An author who previously worked twice on Microsoft's debugger platform team has published the first part of a tutorial on building a debugger called DbgRs using Rust [1]. The project aims to both teach the author Rust and help others understand how debuggers are constructed [1].
The tutorial focuses on the mechanics of attaching to processes on Windows and monitoring debugging events [1]. The core of the debugger operates through an event loop: WaitForDebugEventEx waits for debugging events to occur, while ContinueDebugEvent allows process execution to resume [1]. Two methods enable attachment to processes—DebugActiveProcess for connecting to already-running processes, or CreateProcessW with the DEBUG_ONLY_THIS_PROCESS flag when launching a new process [1].
The DEBUG_EVENT structure captures essential information including process ID, thread ID, and event code [1]. The debugger can handle nine different event types, including EXCEPTION_DEBUG_EVENT, CREATE_THREAD_DEBUG_EVENT, and LOAD_DLL_DEBUG_EVENT [1]. When a process starts, an initial breakpoint exception originating from ntdll!LdrpDoDebuggerBreak is triggered—a critical event in the debugging workflow [1].
The complete code has been made available on GitHub in the part1 branch [1]. The author recommends using VS Code with the rust-analyzer plugin for viewing the implementation [1].