First called DLL

Question

So, I have one may be simple question. First of all I want to notice that I'm beginner in debugging process with IDA, then please don't laugh at me...

I want to debug windows service, exactly svchost.exe. I use IDA with Windbg. So, I attached to appropriate process. I see in the right window special list - what dll files my process uses. My question is: how can I get to know - what dll will be used firstly? I want to add a breakpoint, but I don't know - in what function I need to add it... This process uses 5355 remote port in Windows 7, I send some data to this port and I wish to see the trace of my data ... May be it's possible to find out the first used dll.

I'll thank anybode for any help or explanation.

This is a bit of a convoluted question. By the time you attach to the process, the loader must have created it already, so all statically imported DLLs have been loaded at that point. That is on Windows prior to 7 `ntdll.dll` followed by `kernel32.dll` for all Win32 subsystem processes. Starting with Windows 7, IIRC, they changed that order, but it doesn't affect your case, I think. Also: http://whathaveyoutried.com ??? — 0xC0000022L, Jul 16 '12 at 16:05

score 1 · Accepted Answer · answered Jul 18 '12 at 02:10

1

You can tell windows to attach a debugger as soon as the process is started by following MS KB824344 http://support.microsoft.com/kb/824344. Look for the section called Configure a service to start with the WinDbg debugger attached.

answered Jul 18 '12 at 02:10

Zipper

7,034
8
49
66

First called DLL

1 Answers1