How to Remotely Debug a System Startup Component? - remote-debugging

Because of the possibility of full system failure, I am using VM's as the environment for debugging a system startup component like "userinit", which executes before the desktop appears. How do I configure the VM's remote debugger and system so I can debug from the first line of code?

Look here:
Setting Up Kernel-Mode Debugging Manually

Related

Unable to debug .net core2 application over vpn with vs2017

I am able to run my web application on the remote machine (after logging into VM using VPN) without debug but when I try to attach the process I don't find application process to attach for debugging even after I checking the option of show processes from all users.
If I try to start application with debug dotnet.exe crashes immediately, I believe this problem is due to VPN which is blocking the process but not sure how to fix it.

Application hangs when debugged with Application Verifier

I added my C++ application to Application Verifier. I am able to run it by directly executing the exe. But if I run it from VS 2013 or WinDbg, it just hangs with 0 CPU usage.
Even if I directly execute the exe, at a certain point it uses all my memory (10GB), and I have to restart the computer. So now I do not have a way to use Application Verifier to debug it.
There is only one line log created when my application starts. I do not see any other logs in Application Verifier.
Does anyone know what is wrong with my case?
If I disable the TLS option in Application Verifier, it will work in a debugger.

Automating DLL Debugging "attach to process" in Visual Studio?

I'm writing an SNMP extension agent DLL for Windows.
Is there a way to automatically attach the DLL to the SNMP service each time I want to test/debug?
This is a very tedious and time consuming process, as I currently have to stop the SNMP service, compile, restart the service and then attach the process. I'm trying to automate it more.
This may be what you want to have a look at.
Visual Studio debugger offers some command line option to attach to running process. You can probably write a Python script to enumerate running processes and attach the debugger to the service. I think you need admin priviledge to do that.
.Net has a convinient Debugger.Launch(), but I can't find an equivalent for the native.

Windows event log service holding executable file handle

I have a service application that on startup and shutdown logs an event log record.
I rebuild the application frequently and also then the executable on the host machine. And here is the problem, after my service shutdown the Windows Eventlog service (not the event log viewer) is holding an open handle to the executable so I cant update it.
I have the event log messages embedded in the executable, i could move it out but then I just move the update problem to another file.
I've double checked and I have paired ::RegisterEventSource/::DeregisterEventSource correctly.
Anyone encountered this problem ?
I've also run into this issue, so just adding some of my experiences.
I have a Windows 2008 Service system (have not seen this on 2003 Server), and when I stop my service, and instance of svchost.exe loads the service executable (visible using vmmap.exe or Process Hacker) preventing it from being deleted/overwritten during uninstall/install. The instance of svchost.exe is running the DHCP Client (Dhcp), TCP/IP NetBIOS Helper (lmhosts), and Windows Event Log (EventLog) services.
In our case, we have created a registry entry to make our service executable an event source. (though I'm unsure exactly why we are doing this, or whether we should be doing this).
Empirically, if I remove that registry entry before stopping the service, the executable is not loaded by svchost.exe and all is fine. If the service has already been stopped and executable loaded by svchost.exe, restarting the Event Log service (or killing the process) also frees up the executable.
I'm guessing our service is not well-behaved (perhaps a side effect of being a 32-bit process on 64-bit OS?) or correctly installed, but haven't isolated the issue yet.
Update: It appears this issue is only happening on HP systems (and not Dell or IBM) which is curious. There are HP-specific management components installed, so perhaps one of them is altering the behavior somehow?
I've also run into this issue. In my case, nxlog service reading logs. Simply stop nxlog service before replace event source file.
I think it is probably the event log viewer. Close the viewer and you'll be fine.

How remote debugging is implemented in general

I have been using remote debugging from JDeveloper to Weblogic server for quite sometime and found it's very useful. But I am interested in understanding how remote debugging is implemented technically.
When I make any java code change and rebuild the class in jdeveloper on a remote machine from where I am debugging the server, the code changes are automatically picked up the server. How does this happen? Does the tool send the compiled java class on the network to server?
Can any one please share any documents / links explaining the technicalities of remote debugging.
Thanks & Regards,
Harish
Not sure if you're asking about remote debugging in general, or for the particular tools you're describing.
I don't know much about Java/jdeveloper, but in general remote debugging works as follows:
On the target machine, a special server process hooks into the executable you want to debug, just like a debugger would when running locally. This server doesn't have to know about symbols and source code, just have the executable running. Using system commands it can ask it to stop and examine its memory space.
On the host machine the debugger itself runs and also has a copy of the executable, and of its source code. The debugger communicates with the server on the target machine using some kind of protocol (TCP/IP or maybe serial for embedded devices) and asks it to step, examines certain memory locations it knows about from the debug info in the executable, can show the source code being debugged to the user, etc.
Read, for example, on gdbserver which is probably the most popular remote debugging server out there.
Hope this helps :)