// System calls
_Out_ PHANDLE DebugObjectHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ ULONG Flags
Function NtCreateDebugObject is used for Debug Object creation. Debug Object it's a new functionality implemented in Windows XP and above as support for debugging User Mode applications. In previous versions of NT debugging was implemented with Port objects (see NtCreatePort). Application can debug one or few different applications in the same time, but need to create as many Debug Objects as number of debugged processes.
There're two methods of start debugging. To start application in debug mode, user need to use NtCreateProcessEx function (available on XP+) with HANDLE to previously created Debug Object. Or just attach debugger to working process by calling NtDebugActiveProcess.
Pointer to newly created Debug Object HANDLE.
Access mask for Debug Object. Can be one or more of following:
Optionally can define object's name.
If set, debugged process will be terminated with closing Debug Object.