Hello Serge, thanks for your reply.
Should I set the breakpoint in user mode or kernel mode?
If in user mode, I can set break point, but I can not step into the user mode API dure to lack of source code.
If in kernel mode, I don't know where to set the breakpoint. My idea is to know when I call Sleep or HeapAlloc in user mode, which kernel function does the kernel use to handle the API call.
最近有了小宝宝,他比较淘气,所以来这里的时间少了挺多。非常抱歉。