Debug a windows service entry without windbg

Question

An answer to a similar question here mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to setting a breakpoint in the source.

I'd like to know how exactly this is done when only a binary is available.

I'm trying to port a windows service to Linux. I'm not very familiar with the windows OS. While I can step through normal routines, the service probes the hardware and sets up a few global values. For this reason I need to know exactly what is being sent/received during its initialization.

I did try windbg but found it to be very difficult to use when no source code is present.

Answer 1

I'll post my own answer here so I can find this again in the future.

1. Using CFF Explorer open the service binary.
2. Find the AddressOfEntryPoint in the Optional Header.
3. Find the .text entry in Section Headers.
4. Calculate raw_offset = raw_address - virtual_address + AddressOfEntryPoint.
5. Within the built-in hex editor, navigate to raw_address.
6. Change the two bytes there to EB FE.
7. Save and exit.
8. Modify HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServicesPipeTimeout to 0xFFFFFFFF (requires reboot).
9. Replace service with patched version and start (its status should become 'starting').
10. In x64dbg check Enable Debug Privilege, restart x64dbg.
11. Attach to the service.
12. Replace the EB FE bytes with their original values.
13. The entry point can now be debugged.

Other notes - x64dbg will not stop at the entry point of a running service. Use the command :EntryPoint to display its address and scroll into view.