New to the area, i am trying to identify the code responsible for example for the search functionality in Windows when you start typing in the start menu. What are some generic ways of identifying the file/code where that functionality is implemented?
Some ideas i had are:
Check out procmon to identify whether your action is causing any events and identify the process, then one can go from there using potentially the corresponding symbols to find the appropriate functions.
Once we have the appropriate functions, see if possible to set a hardware breakpoint in kernel debugging in the address where the associate code is mapped. (easy when the code resides in kernel space, for userspace functionalities we may be lucky in case of system libraries mapped in the same virtual address for all processes)
Not sure whether the above is the most optimal/effective methodology, any other ideas are welcome