WinDbg newbie: debugging spawned program

WINDBG
1

How do I break at the WinMain of a program if it is some other program that
is spawning it? E.g., prog1.exe starts prog2.exe. I want to break at the
WinMain of prog2.exe. In addition, prog1.exe is already running and
contains no debug information.

Thanks for any guidance.

2

There are a few things you could do:

  • you could put a debug breakpoint at the top of WinMain and let
    the JIT debugger catch it (windbg -I to set that up)
  • you could put a Sleep(10000) at the top of winmain and attach to
    the process while it’s still starting
  • you could use image file execution options to start a debugger on
    start-up (look at gflags.exe)
  • including, you could use it to spawn a remote debugger server
    or client and connect to a debugger on your desktop

-sd

On Jul 9, 2007, at 11:10 AM, Neil Weicher wrote:

How do I break at the WinMain of a program if it is some other
program that is spawning it? E.g., prog1.exe starts prog2.exe. I
want to break at the WinMain of prog2.exe. In addition, prog1.exe
is already running and contains no debug information.

Thanks for any guidance.

You are currently subscribed to windbg as:
xxxxx@positivenetworks.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

File-> Open Executable -> After You Select the executable
tick mark the Debug Child Process Also CheckBox
in gui mode

if you are command liner use .childdebug 1
and do a .restart

raj_r

On 7/9/07, Neil Weicher wrote:
> How do I break at the WinMain of a program if it is some other program that
> is spawning it? E.g., prog1.exe starts prog2.exe. I want to break at the
> WinMain of prog2.exe. In addition, prog1.exe is already running and
> contains no debug information.
>
> Thanks for any guidance.
>
>
> —
> You are currently subscribed to windbg as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

4

Hello,

* On Mon, Jul 09, 2007 at 12:10:43PM -0400 Neil Weicher wrote:

How do I break at the WinMain of a program if it is some other program that
is spawning it?

Note: I am using WinDBG mainly for kernel-mode debugging, so, I am not
very familiar with the user-mode stuff. Anyway, I have done this before,
and I believe it was with the “sxe ld:prog2.exe” command.

Perhaps, you would have to use another event than “ld”. “cpr” might be a
good candidate, too. Have a look at the help to “sxe” and at the link
“Controlling Exceptions and Events” from there.

HTH,
Spiro.

–
Spiro R. Trikaliotis http://opencbm.sf.net/
http://www.trikaliotis.net/ http://www.viceteam.org/

5

One of the best ways to do this is to use the “Image File Execution Options” registry key. Use your favorite search engine. Below is a link to one article that describes how to do this, in the “Using WinDbg” section.

http://support.microsoft.com/default.aspx?kbid=238788

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Neil Weicher
Sent: Monday, July 09, 2007 9:11 AM
To: Kernel Debugging Interest List
Subject: [windbg] WinDbg newbie: debugging spawned program

How do I break at the WinMain of a program if it is some other program that
is spawning it? E.g., prog1.exe starts prog2.exe. I want to break at the
WinMain of prog2.exe. In addition, prog1.exe is already running and
contains no debug information.

Thanks for any guidance.

You are currently subscribed to windbg as: xxxxx@microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

raj,

Thanks for the tip, but I am not able to debug the parent process, so I
don’t think that will work.

Neil

----- Original Message -----
From: “raj_r”
To: “Kernel Debugging Interest List”
Sent: Monday, July 09, 2007 12:40 PM
Subject: Re: [windbg] WinDbg newbie: debugging spawned program

> File-> Open Executable -> After You Select the executable
> tick mark the Debug Child Process Also CheckBox
> in gui mode
>
> if you are command liner use .childdebug 1
> and do a .restart
>
> raj_r
>
> On 7/9/07, Neil Weicher wrote:
>> How do I break at the WinMain of a program if it is some other program
>> that
>> is spawning it? E.g., prog1.exe starts prog2.exe. I want to break at
>> the
>> WinMain of prog2.exe. In addition, prog1.exe is already running and
>> contains no debug information.
>>
>> Thanks for any guidance.
>>
>>
>> —
>> You are currently subscribed to windbg as: xxxxx@gmail.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>
> —
> You are currently subscribed to windbg as: xxxxx@netlib.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>