다음을 통해 공유


Debugging services..

How to debug Windows services covers the main points – but I think a common issue is debugging why a service won’t start.

When the service is failing on start – you can’t simply start it and then quickly attach the debugger – you need to have the debugger attach to it on start.

I like to do this via gflags.exe which is included with the debugger package when you install it. Here is an example of connecting to spoolsv.exe when you start the spooler service:

 

 

 

On any services General tab, you can see the path to the .exe ..in this case spoolsv.exe, which you place in the image file.

 

This will also create a registry key such as HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution

Options\spoolsv.exe with the “debugger” value set to the value you placed in gflags.exe

 

 

One of the big problems is the SCM timeout when you launch the service under the debugger the service times out – the ServicesPipeTimeout reg value will get around that.

The next problem you may run into is that the debugger is not visible when the service launches.

This is because the service is not configured to interact with the desktop:

Many services run as Local Service or Network Service or some other account and will not be able to interact with the desktop. In these cases I like to do something a little more complex.

First, I change the debugger to cdb.exe and set it up to immediately start a server which I can attach to remotely.

 

Then, I create a batch file like so:

It’s all a one liner.

Debug_svc.bat

C:\debugger\windbg.exe -remote tcp:server=localhost,port=1234 -g –c “$$< :c\debugger\commands.txt” -y srv*c:\symbols*https://msdl.microsoft.com/download/symbols

The switches are summarized below:

-remote : Connect to the server which was kicked off when the service started via cdb.exe

-g : Ignores the initial breakpoint in target application. This option will cause the target application to continue running after it is started or WinDbg attaches to it.

-c : Specifies the initial debugger command to run at start-up. The $$< basically says look to this script file and do what it says.

-y : The symbol path.

 

The c:\debugger\commands .txt looks like this:

 

Bp advapi32!regqueryvalue

Bp foo!func1

Bd*

Bp foo!func2

G

I like to do this to save time from resetting breakpoints each time I need to try and start the service, as well as the flexibility of easy changes and a history of my breaks. The file above shows that I set some BP’s , then when I wanted to add\remove etc… So, I set a breakpoint on regqueryvalue(), and Func1(), decided I didn’t need them disabled all previous bp’s and set a bp on func2() then did a “go”

You then can do a “net start service” and then “debug_svc.bat”.

You will basically see the windbg.exe GUI come up and then hit your breakpoint at the exact spot you want to start debugging at, and it wont time out on you since you set ServicesPipeTimeout.

The last thing which could cause you some pain is the fact that many services run under svchost.exe.

 

Debugging an instance of svchost with 10 other dependant services in it, well it’s not always acceptable to put them all on hold J

Like the CertPropSvc

You can split it out into its own service by running:

“sc config <service> type= own”

And revert it via

“sc config <service> type= share”

Here we can see that it is in a shared svchost:

C:\debugger>tasklist /svc

Image Name

======================

System Idle Process

System

<snip>

svchost.exe

svchost.exe

Ati2evxx.exe

svchost.exe

svchost.exe

svchost.exe

audiodg.exe

SLsvc.exe

    PID

=======

      0

      4

    972

   1004

   1100

   1116

   1148

   1164

   1260

   1316

Services

============================================

N/A

N/A

RpcSs

WinDefend

Ati External Event Utility

Audiosrv, Dhcp, Eventlog, lmhosts, wscsvc

AudioEndpointBuilder, CscService, EMDMgmt,

hidserv, Irmon, Netman, PcaSvc, SysMain,

TabletInputService, TrkWks, UxSms,

WdiSystemHost, Wlansvc, WPDBusEnum, wudfsvc

AeLookupSvc, BITS, CertPropSvc, EapHost,

gpsvc, IKEEXT, iphlpsvc, LanmanServer,

MMCSS, ProfSvc, RasMan, Schedule, seclogon,

SENS, ShellHWDetection, Themes, Winmgmt,

wuauserv

N/A

slsvc

We will change it like so:

C:\debugger>sc config CertPropSvc type= own

[SC] ChangeServiceConfig SUCCESS

 

Make sure you get that space in the after the ='s sign

 

Then you restart the service..and note that it’s in it’s own instance of svchost.exe

C:\debugger>tasklist /svc

Image Name

=======================

System Idle Process

System

smss.exe

csrss.exe

csrss.exe

wininit.exe

services.exe

winlogon.exe

<snip>

WmiPrvSE.exe

svchost.exe

tasklist.exe

   PID

======

     0

     4

   396

   528

   576

   584

   632

   660

  1672

  5680

  2032

Services

==============

N/A

N/A

N/A

N/A

N/A

N/A

N/A

N/A

N/A

CertPropSvc

N/A

When you are done – revert it via:

C:\debugger>sc config CertPropSvc type= share

[SC] ChangeServiceConfig SUCCESS

 

 

If you want to break it into its own svchost but named something unique so you can use image file executions on it

 

See https://support.microsoft.com/kb/934650

 

Basic steps are - copy svchost.exe to a unique name ( like svchost_1.exe ) , find the service's and modify the imagepath to use your svchost_1.exe and restart the service.

 

 

 

Have a great day!

 

Spat

Comments

  • Anonymous
    September 17, 2007
    With admin privileges, you can also attach to the services.exe process and then enable child debugging.

  • Anonymous
    July 22, 2013
    Awesome article.