2

I am trying to debug two different exe files,in windows.

The first exe launches the second, and the second exe doesn't work well unless the first starts it.

I want to be able to debug the second exe.

I want to debug the begging of the exe, so attaching isn't an option.

Does IDA have a way to debug a process that's launched by another?

3
  • The references to "exe" makes me think that this is about windows, and therefore not a dup
    – Avery3R
    Jul 23 '18 at 20:49
  • @Avery3R Although linked question seems to revolve around ELF files specifically, I believe the answer applies just the same regardless of OS.
    – NirIzr
    Jul 24 '18 at 1:28
  • @Megabeets that not help, event I breakpoint in fork orexecve I can't debug the new process in the beginning
    – Jonert6544
    Jul 24 '18 at 9:19
3

In a similar way, windows services must also be started by a special process. Microsoft has documentation on how to debug these kinds of processes.

The applicable section is "Configure a service to start with the WinDbg debugger attached"

  1. Locate the following registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  2. Create a new subkey with the name of the executable
  3. Within that subkey create a new string value named Debugger
  4. Set that value to the path to your debugger. See IDA's documentation for the needed command line flags.

Not the answer you're looking for? Browse other questions tagged or ask your own question.