Home/ Questions/Q 6030771
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-23T05:05:11+00:00

When debugging a Windows process, it would sometimes be convenient to break as early

  • 0

When debugging a Windows process, it would sometimes be convenient to break as early as possible.

Inital Callstack looks like this: (you get this e.g. when you set a breakpoint in a DllMain function on DLL_PROCESS_ATTACH)

    ...
    ntdll.dll!_LdrpCallInitRoutine@16()  + 0x14 bytes   
    ntdll.dll!_LdrpRunInitializeRoutines@4()  + 0x205 bytes 
>   ntdll.dll!_LdrpInitializeProcess@20()  - 0x96d bytes    
    ntdll.dll!__LdrpInitialize@12()  + 0x6269 bytes 
    ntdll.dll!_KiUserApcDispatcher@20()  + 0x7 bytes

so setting a breakpoint in one of these ntdll routines should really break the process very early.

However, I can’t figure out how to set a breakpoint there prior to starting the process in the debugger. Is it possible in Visual Studio (2005)? How? Can it be done in WinDbg?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I have found out how to do it in Visual Studio.

    The problem here is, that setting a breakpoint in any assembly function will be remembered as a “Data Breakpoint”. These breakpoints are disabled as soon as the process stops, so even if I set one in this function (I can do this because I have the function on the stack if I set a breakpoint in any DllMain function) this breakpoint will be disabled for a new process run.

    However for ntdll.dll (and kernel32.dll) the load addresses are pretty much fixed and won’t change (and least not until reboot).

    So, before starting the process, I just have to re-enable the Data Breakpoint for the address that corresponds to this NtDll function and the debugger will then stop there.

    • 0