This answer ignores the case of shared services, since that is more elaborate and OP did not mention that specifically.
Services are usually normal processes like any other process, however they are executed by the operating system and not the creating/starting process, which may be a cause for some confusion.
How to debug services?
Like any other process, you can either attach to it after its running most (read: all decent) debuggers support attaching (and putting protected process services aside) can be attached to.
If you fear you'd miss some crucial part of the execution before you get to attach you could use tools that let you debug spawned processes. Ollydbg supports that as well as x64. And Rohitab's API Monitor has decent capabilities when it comes to detecting and attaching to new processes.
but why execution stopped after calling StartServiceCtrlDispatcher
?
However, when dealing with most malware samples it'll be good enough to just create the process yourself and skip any service related functions.
It seems that your specific issue is with the execution of the StartServiceCtrlDispatcher
function, which is the function called by the service entry point in order to register connect back to the service manager. That connection to the service manager is how the service reports it has be successfully load and functional, how it gets commands to shutdown, restart etc.
StartServiceCtrlDispatcher
has a single parameter which is the SERVICE_TABLE_ENTRY
structure. It has two members, the second of which is of type LPSERVICE_MAIN_FUNCTION
and called lpServiceProc
. That parameter is actually a function pointer to the ServiceMain
function. Pick it up, parse the structure and you'll get to where execution will be given back to the service in order to continue execution!
VM, why you no run?!
Well, unfortunately you did not provide enough details to diagnose that one.