An answer to a similar question here mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to setting a breakpoint in the source.

I'd like to know how exactly this is done when only a binary is available.

I'm trying to port a windows service to Linux. I'm not very familiar with the windows OS. While I can step through normal routines, the service probes the hardware and sets up a few global values. For this reason I need to know exactly what is being sent/received during its initialization.

I did try windbg but found it to be very difficult to use when no source code is present.

I'll post my own answer here so I can find this again in the future.

  1. Using CFF Explorer open the service binary.
  2. Find the AddressOfEntryPoint in the Optional Header.
  3. Find the .text entry in Section Headers.
  4. Calculate raw_offset = raw_address - virtual_address + AddressOfEntryPoint.
  5. Within the built-in hex editor, navigate to raw_address.
  6. Change the two bytes there to EB FE.
  7. Save and exit.
  8. Modify HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServicesPipeTimeout to 0xFFFFFFFF (requires reboot).
  9. Replace service with patched version and start (its status should become 'starting').
  10. In x64dbg check Enable Debug Privilege, restart x64dbg.
  11. Attach to the service.
  12. Replace the EB FE bytes with their original values.
  13. The entry point can now be debugged.

Other notes - x64dbg will not stop at the entry point of a running service. Use the command :EntryPoint to display its address and scroll into view.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.