生产时调试 - 会话 0 进程
我有以下场景：
- Windows 2008
- 服务以特定用户凭据（即不是系统帐户）运行。
- 该服务启动一个子进程
- 子进程启动，一秒钟后出现异常并崩溃
我正在尝试将调试器附加到子进程并在崩溃之前对其进行调试
我正在尝试使用 gflags 并设置调试器。问题是该服务正在会话 0 中运行，因此 Windbg 不可见。我无法将服务设置为“允许与桌面交互”，因为该服务无法使用本地系统帐户，而必须使用特定用户的凭据。
我不确定它是否打算像这样工作，但我还尝试使用 Windbg -pe 从 Windbg 的另一个实例连接到会话 0 中的 Windbg（这样我就会运行两个 Windbg）。但它不起作用 - 第二个实例似乎无法停止进程并查看其调用堆栈。
有什么想法如何在子进程崩溃之前将调试器附加到子进程以进行调试吗？
I have the following scenario:
- Windows 2008
- A Service running running with a specific user credential (i.e. not the System Account).
- That service starts a child process
- The child process starts, gets an exception after a second and crashes
I am trying to attach a debugger to the child process and debug it before it crashes
I was trying to use gflags and set the debugger. Problem is that the service is running in session 0 hence Windbg is not viewable. I cannot set the service to "allow interact with desktop" as the service cant use Local System account but rather has to use credentials of specific user.
I wasn't sure if it is intended to work like that, but I also tried to connect to that windbg in session 0 from another instance of Windbg using Windbg -pe (so I would have two Windbg running). But it doesn't work - the second instance doesn't seem to be able to stop the process and see its call stack.
Any ideas how to attach a debugger to the child process before it crashes to debug it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
您可以使用命令行调试器 cdb 来实现此目的。
启动带有 cdb 的服务，并作为调试服务器启动。
您可以添加以下命令
到注册表项的注册表值 Debugger（类型字符串）
然后使用windbg连接到调试服务器
You can use the command line debugger cdb for that.
Start your service with cdb attached, and launched as a debugging server.
You can add the following command
to the registry value Debugger (type string) of the registry key
Then use windbg to connect to the debugging server with
还有一种选择：
当WinDbg自动启动时，你确实看不到它。但是，您可以将 ntsd 配置为 jit 调试器，并启用远程调试。然后，您可以将 WinDbg 连接到 ntsd 并远程调试该进程。有关详细信息，请参阅： 在 Windows Vista 上调试服务。
One more option:
When WinDbg is automatically launched, you indeed can't see it. You can, however, configure ntsd as your jit debugger, and enable remote debugging. Then, you can connect your WinDbg to ntsd and remote debug the process. See for details: Debugging a Service on Windows Vista.
为什么不从故障转储开始呢？ http://www.codeproject.com/KB/debug/automemorydump.aspx
Why not start from crash dumps? http://www.codeproject.com/KB/debug/automemorydump.aspx
将
Sleep(30000)添加到您的子进程入口点。这将为您提供足够的时间来连接调试器。Add
Sleep(30000)to your child process entry point. That will give you enough time to connect with the debugger.