Identifying/debugging code parts responsible for features in Windows

Question

New to the area, i am trying to identify the code responsible for example for the search functionality in Windows when you start typing in the start menu. What are some generic ways of identifying the file/code where that functionality is implemented?

Some ideas i had are:

1. Check out procmon to identify whether your action is causing any events and identify the process, then one can go from there using potentially the corresponding symbols to find the appropriate functions.

2. Once we have the appropriate functions, see if possible to set a hardware breakpoint in kernel debugging in the address where the associate code is mapped. (easy when the code resides in kernel space, for userspace functionalities we may be lucky in case of system libraries mapped in the same virtual address for all processes)

Not sure whether the above is the most optimal/effective methodology, any other ideas are welcome

Answer 1

procmon can help in locating an entry point or a point of ingress

start procmon

remove all filters

enable capturing

try typing something like "turbox the t" in the start menu

stop capturing

go to tools->file summary->extension tab and expand the wildcard (*) entry

you may notice this file has been searched on the PATH paths

click one entry and you may see the relevant searches over the
whole time period between capture enable and capture disable

as you can see in the image above the 6 captures that pertain to search in
c:\windows\system32 folder

double clicking the entry will yield the searches that span 2 seconds of interval as below

you can then click anyone of these capture to look at the call stack

as below