Debugging WINLOGON.EXE at startup on Windows 10

WINDBG
10

Don’t use ntsd in this case. It is a limited way to debug the startup of user-mode processes. To debug the startup of user-mode processes when using the kernel-mode debugger you can use the following steps:

  1. bcdedit /set halbreakpoint on

x86

  1. ad /q ImageFileName; bp nt!PspInsertProcess “aS /ma ${/v:ImageFileName} @@c++(((nt!_EPROCESS *) @ecx)->ImageFileName); .block { .if ($spat("${ImageFileName}", "winlogon*")) { } .else { gc }}”; g
  2. .process /r /p @ecx; eb @$peb+2 1; g
  3. .reload /user; bu winlogon!WinMain; g

x64

  1. ad /q ImageFileName; bp nt!PspInsertProcess “aS /ma ${/v:ImageFileName} @@c++(((nt!_EPROCESS *) @rcx)->ImageFileName); .block { .if ($spat("${ImageFileName}", "winlogon*")) { } .else { gc }}”; g
  2. .process /r /p @rcx; eb @$peb+2 1; g
  3. .reload /user; bu winlogon!WinMain; g

Enjoy!