Early Debugging
Early debugging is a wide topic, on a Windows PC it might be:
- Application startup
- Service startup
- WinLogon
- CSRSS (Client/Server Runtime Subsystem)
- Windows Setup and OS Loader
- MBR (Master boot record)
- BIOS POST (Power-on self-test)
Application Startup
As we have demonstrated in the user mode debug event loop, when an application was launched from a debugger, the first debug event is CREATE_PROCESS_DEBUG_EVENT. Process creation event is the earliest point a user mode debugger could even reach to.
Windows debuggers by default would break at ntdll!LdrpDoDebuggerBreak, but we can alter this behavior:
cdb.exe -xe cpr -xe ld notepad.exe
CommandLine: notepad.exe
ModLoad: 01000000 01014000 notepad.exe
0:000> lm
start end module name
01000000 01014000 notepad (deferred)
0:000> !teb
TEB at 7ffdf000
error InitTypeRead( TEB )...
As you can see, debugger extension complains since we are too early. However there are always workarounds as we discussed in Undocumented WinDBG:
0:000> .imgscan; * Where is Mark Zbikowski?
MZ at 01000000, prot 00000002, type 01000000 - size 14000
Name: notepad.exe
MZ at 7c900000, prot 00000002, type 01000000 - size b2000
Name: ntdll.dll
0:000> .reload /s /f ntdll.dll=7c900000
0:000> lm
start end module name
01000000 01014000 notepad (deferred)
7c900000 7c9b2000 ntdll (pdb symbols)
0:000> !teb
TEB at 7ffdf000
ExceptionList: ffffffff
StackBase: 00080000
StackLimit: 0006f000
SubSystemTib: 00000000
FiberData: 00001e00
ArbitraryUserPointer: 00000000
Self: 7ffdf000
EnvironmentPointer: 00000000
ClientId: 000007d4 . 000005b4
RpcHandle: 00000000
Tls Storage: 00000000
PEB Address: 7ffd8000
LastErrorValue: 0
LastStatusValue: 0
Count Owned Locks: 0
HardErrorMode: 0
If the application is launched by another process, IFEO might help, but always keep in mind there can be side effects.
Service Startup
Most of the knowledge about application debugging applies to services, since they are both user mode processes. The only difference is that service can share a single hosting process (e.g. svchost.exe), and would normally start in a different session.
An excellent article about service debugging can be found at:
Windows Setup, OS Loader, CSRSS and WinLogon
The document shipped with Debugging Tools for Windows has some brief introduction.
MSDN also described these debugging tasks in Specialized Debugging Techniques.
POST and MBR
Most of these are real mode code (although MBR might switch CPU to protected mode) dealing with the low level hardware. Not many people are still working on the old memory models (e.g. TINY, SMALL, COMPACT, MEDIUM, LARGE and HUGE) and the A20 line (do you remember Tim Paterson and his debug program?).
MBR is relatively small, and can be simply debugged using a software emulator.
I have never worked on POST, but I think people would use software emulators in combination with ICE (In-circuit emulator).
WinDBG has limited support for real mode debugging.
(to be continued...)