调试启动程序行为
我想在我的 Windows 7 Professional 笔记本电脑中调试一个名为 Freecall 的程序。现在它在“系统配置”控制台中显示为启动项。我尝试在启动项中取消选中它并重新启动，但它不断将自身添加到 HKCU\Software|Microsoft\Windows\CurrentVersion\Run。 我认为雅虎信使也是如此。即使我手动从注册表中删除了该条目，这些程序仍会继续添加到启动中。我想调试并查明启动可执行文件后程序是否写入注册表。我怎样才能做到这一点？有没有办法在沙盒模式下运行二进制文件？有没有VS工具可以做到这一点？
I want to Debug a program called Freecall in my Windows 7 Professional laptop. Now it shows as a Startup item in "System Configuration" console. I tried to uncheck it in the Startup item and restart, but it keeps on adding itself to HKCU\Software|Microsoft\Windows\CurrentVersion\Run.
i think its the same for Yahoo messenger..these programs keep on adding to startup even after I manually deleted the entry from the registry. I want to debug and find out if after starting the executable, the program writes to the registry. How can I do that? Is there a way I can run the binary in Sandbox mode? Are there any VS tools for this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您可以使用进程监视器来准确了解进程正在执行哪些注册表访问操作。如果要在应用程序启动时对其进行调试，可以使用 GFlags 实用程序的“图像文件选项”选项卡，您可以在其中指定要在执行特定应用程序时启动的调试器。
You can use Process Monitor to figure out exactly what the process is doing w.r.t. registry accesses. If you want to debug the application while it's starting, you can use the GFlags utility's "Image File Options" tab, where you can specify a debugger to be launched instead when a specific application is executed.