Search code examples
debuggingwindows-serviceswindbgida

First called DLL


So, I have one may be simple question. First of all I want to notice that I'm beginner in debugging process with IDA, then please don't laugh at me...

I want to debug windows service, exactly svchost.exe. I use IDA with Windbg. So, I attached to appropriate process. I see in the right window special list - what dll files my process uses. My question is: how can I get to know - what dll will be used firstly? I want to add a breakpoint, but I don't know - in what function I need to add it... This process uses 5355 remote port in Windows 7, I send some data to this port and I wish to see the trace of my data ... May be it's possible to find out the first used dll.

I'll thank anybode for any help or explanation.


Solution

  • You can tell windows to attach a debugger as soon as the process is started by following MS KB824344 http://support.microsoft.com/kb/824344. Look for the section called Configure a service to start with the WinDbg debugger attached.