[nikola]

I'm trying to write a small "debugger" for one specific app. For starters i want to get to EP but i dont know how to do that. Here is how i tried to do so, but when i sompare used memory of app how Olly loaded and how i loaded it, Ollys child process has occupied more memory.

  if DWORD(CreateProcess('1.exe',nil,nil,nil,FALSE,DEBUG_PROCESS or DEBUG_ONLY_THIS_PROCESS,nil,nil,si,pi)) = 0 then begin
    ShowLastError();
    ExitProcess(0);
  end;
  WaitForDebugEvent(dbevent, INFINITE);
  ContinueDebugEvent(pi.dwProcessId , pi.dwThreadId, DBG_EXCEPTION_NOT_HANDLED);
  if dbevent.dwDebugEventCode <> CREATE_PROCESS_DEBUG_EVENT then begin
    MessageBox(0, 'Couldnt get to EP !', 'Error !!!', MB_ICONERROR);
    Exit;
  end;
  if dbevent.dwDebugEventCode = CREATE_PROCESS_DEBUG_EVENT then MessageBox(0, 'Got to EP !', 'OK !!!', MB_ICONERROR);

  stop := False;
  while not stop do begin
    stop := True;
    if dbevent.dwDebugEventCode = LOAD_DLL_DEBUG_EVENT then Stop := False;
    if dbevent.dwDebugEventCode = CREATE_THREAD_DEBUG_EVENT then Stop := False;
    if dbevent.dwDebugEventCode = CREATE_PROCESS_DEBUG_EVENT then Stop := False;

    WaitForDebugEvent(dbevent, INFINITE);
 		dwStat := DBG_EXCEPTION_NOT_HANDLED;
    case dbevent.dwDebugEventCode of
      EXCEPTION_DEBUG_EVENT:  begin
                                case dbevent.Exception.ExceptionRecord.ExceptionCode of
                                  EXCEPTION_BREAKPOINT: dwStat := DBG_CONTINUE;
                                end;
                              end;
      EXIT_PROCESS_DEBUG_EVENT: begin
                                  MessageBoxA(0, 'Prog exited :/', 'Error', MB_ICONERROR);
                                  CloseHandle(hFile);
                                  ExitProcess(0);
                                end;
    end;
		ContinueDebugEvent(dbevent.dwProcessId,dbevent.dwThreadId,dwStat);
  end;

I've also tried to write $CC to EP and run until debug exception, but it doesnt break ir just runs. Like i wrote int3 to wrong process. But i didnt miss the handles for sure...