4

I am trying to debug a windows service, so I set IDA as the debugger of that service.

But since services are running in session 0, I can't interact with IDA. Also in the latest windows version (e.g. 22h2), it looks like they removed tools that make this job easier like UI0detect and it looks like they made this task impossible.

Is there any way to work around this problem?

For example, maybe a command line argument that runs IDA in a different session?

I suppose one solution could be to set IDA to run a remote debugging, not sure if that would work but I would consider it if nothing else works, since it looks like it's going to be a pain to set up.

Improve this question

1 Answer 1

Reset to default
4

If you want to debug a service from the startup, a low tech option could be the following:

  • Increase service timeout in the registry.
  • Patch the service executable with an infinite loop (EB FE) to give you extra time
  • Run debugger as System (e.g. using PSExec) in a normal user/console session
  • Attach debugger, remove infinite loop (write back original bytes) and resume
Improve this answer
1
  • 1
    doesnt seem too bad, might be a step above setting up a remote debugger. might use this at the end if there are no other better solutions (and hoping there is no integrity check on the binary)
    – tturbox
    Feb 8 at 13:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.