Friday, December 02, 2011

Using Image File Execution Options (IEFO) to invoke a debugger automatically

A handy tip for invoking a debugger (or anything else) in place of a normal executable at image load time is to set the following registry key:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<image name>\Debugger = <other image name> (REG_SZ)

For example, to invoke WinDBG when the OS loads notepad.exe:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\Program Files\Debugging Tools for Windows (x86)\windbg.exe"

Very handy for short lived processes that are causing trouble, but you have no other means of attaching to them / etc!

3 comments:

Meta Nipa said...

The image file execution option has the best asset of keeping the usage in the determined way of keeping the eye on the acts. The automatic structure has the religion of essay writing service by the month of December that has the mean value in the certain world of grand.

Anonymous said...

As far as I know, in Visual Studio you can debug a solution that has multiple processes. You can start multiple processes, switch between them, interrupt and resume their execution, step through the source code, stop debugging, terminate individual processes or disconnect from them. I also want to remind you that you can buy research papers in Wr1ter at an affordable price and excellent quality.

pay to do hw buyassignmentservice.com said...

Let’s discuss the best features of our service that makes us stand out from our competitors.