On 28.01.2020 19:00, RĂ©mi Bernon wrote:
However it still wouldn't solve the issue I described previously, where WaitForDebugEvent would return as soon as the exception debug event is linked, and the debugger could then assume the process is stopped although some threads are still possibly running system apcs.
It should be fine that they are running system APCs. Suspended process should handle system APCs as well, otherwise you wouldn't be able to do calls like VirtualQueryEx in debugger while debuggee is suspended. The important part is that only system APCs are ran at this point, no user code.
Jacek