I am trying to debug two different exe files,in windows.

The first exe launches the second, and the second exe doesn't work well unless the first starts it.

I want to be able to debug the second exe.

I want to debug the begging of the exe, so attaching isn't an option.

Does IDA have a way to debug a process that's launched by another?

  • The references to "exe" makes me think that this is about windows, and therefore not a dup – Avery3R Jul 23 '18 at 20:49
  • @Avery3R Although linked question seems to revolve around ELF files specifically, I believe the answer applies just the same regardless of OS. – NirIzr Jul 24 '18 at 1:28
  • @Megabeets that not help, event I breakpoint in fork orexecve I can't debug the new process in the beginning – Jonert6544 Jul 24 '18 at 9:19

In a similar way, windows services must also be started by a special process. Microsoft has documentation on how to debug these kinds of processes.

The applicable section is "Configure a service to start with the WinDbg debugger attached"

  1. Locate the following registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  2. Create a new subkey with the name of the executable
  3. Within that subkey create a new string value named Debugger
  4. Set that value to the path to your debugger. See IDA's documentation for the needed command line flags.

Not the answer you're looking for? Browse other questions tagged or ask your own question.