#ifndef _NTDBG_H

//
// System calls
//

/**
 * Creates a debug object.
 *
 * \param DebugObjectHandle A pointer to a variable that receives the debug object handle.
 * \param DesiredAccess The access rights desired for the debug object.
 * \param ObjectAttributes Optional. A pointer to an OBJECT_ATTRIBUTES structure that specifies the attributes
 * of the debug object.
 * \param Flags Flags for the debug object creation. (DEBUG_KILL_ON_CLOSE)
 * \return NTSTATUS Successful or errant status.
 * \remarks Creates a debugger event object; it does not attach to any process. The Flags mask admits only bit
 * 0x1. That bit controls kill-on-close policy. Pass zero to leave kill-on-close disabled, and close the
 * returned debug-object handle with NtClose.
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateDebugObject(
    _Out_ PHANDLE DebugObjectHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
    _In_ ULONG Flags
    );

#endif
View code on GitHub

#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwCreateDebugObject(
    _Out_ PHANDLE DebugObjectHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
    _In_ ULONG Flags
    );

#endif
View code on GitHub

NtDoc

No description available.

Edit description on GitHub

NTinternals.net (undocumented.ntinternals.net)

Function NtCreateDebugObject is used for Debug Object creation. Debug Object it's a new functionality implemented in Windows XP and above as support for debugging User Mode applications. In previous versions of NT debugging was implemented with Port objects (see NtCreatePort). Application can debug one or few different applications in the same time, but need to create as many Debug Objects as number of debugged processes.

There're two methods of start debugging. To start application in debug mode, user need to use NtCreateProcessEx function (available on XP+) with HANDLE to previously created Debug Object. Or just attach debugger to working process by calling NtDebugActiveProcess.

DebugObjectHandle

Pointer to newly created Debug Object HANDLE.

DesiredAccess

Access mask for Debug Object. Can be one or more of following:

DEBUGOBJECT_WAIT_STATE_CHANGE
DEBUGOBJECT_ADD_REMOVE_PROCESS
DEBUGOBJECT_ALL_ACCESS

ObjectAttributes

Optionally can define object's name.

KillProcessOnExit

If set, debugged process will be terminated with closing Debug Object.

Documented by

Tomasz Nowak

NtCreateDebugObject - NtDoc