debugging multiple processes

WINDBG
1

Hi all,

I have a process P1.exe that spawns rundll32.exe within it and calls it with
specific functions and dll names.

In user land, how do I set a breakpoint so that when ever rundll32.exe’s
main is called the debugger breaks in?

–

  • amitr0
2

Once p1.exe is attached to windbg, you can use the following command to debug child processes spawned by p1.exe -

.childdbg 1

You can refer to windbg documentation for further information relating to this command.

Kamala

-------------- Original message --------------
From: amitr0

Hi all,

I have a process P1.exe that spawns rundll32.exe within it and calls it with specific functions and dll names.

In user land, how do I set a breakpoint so that when ever rundll32.exe’s main is called the debugger breaks in?

–

- amitr0
— You are currently subscribed to windbg as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Kamala,

thanks for the reply…it helps…

4

amitr0 wrote:

I have a process P1.exe that spawns rundll32.exe within it and calls
it with specific functions and dll names.

In user land, how do I set a breakpoint so that when ever
rundll32.exe’s main is called the debugger breaks in?

Why would you invoke rundll32.exe instead of just calling LoadLibrary
and GetProcAddress? Rundll32.exe is intended for use when you DON’T
have a program that can call the entry point.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

5

I don’t call them the exe p1.exe calls it. I dont have teh code for p1, was
just debugging to know which dll and which api inside that was being called