HOWTO: Debugging a service
ID: Q98890
|
The information in this article applies to:
-
Microsoft Win32 Application Programming Interface (API), used with:
-
Microsoft Windows NT versions 3.51, 4.0
-
Microsoft Windows 2000
SUMMARY
The steps in this article illustrate how to debug a service under Windows
NT using WinDbg and the interactive debugger included with Microsoft Visual
32-bit edition. WinDbg ships with the Win32 Software Development Kit (SDK). For
illustration purposes, these procedures use the SERVICE sample, which is
built with debugging information by default. This sample is located in:
Mstools\Samples\Win32Base\WinNT\Service
There are two techniques for debugging a service. The first technique
involves adding a DebugBreak() statement to the service's code and letting
the Just-in-time(JIT) debugging feature of Windows NT spawn the debugger
when the service executes the DebugBreak(). The second technique involves
attaching the debugger to the service while it is running.
MORE INFORMATIONPreparation
- Build the sample.
- Install the Simple service with the following command:
simple -install
You receive a message indicating whether you were successful.
- Use the Control Panel's Services application to start the Simple
service or you can also use:
sc start simpleservice
Sc.exe is located in the Platform SDK bin directory.
- This step is needed for Technique 2: Use PView to get the process ID
(PID) for the Simple service. For example, if PView shows the process as
simple(0xD5), the PID is 0xD5. If you're using Microsoft Visual C++ 32-bit edition,
convert the PID from hexadecimal to decimal. For example, 0xD5 is 213 in
decimal.
Technique 1
To specify Microsoft Visual C++ 4.X as your Just-in-time debugger:
- On the tools menu, click options.
- Click the debug tag, and select the Just-in-time debugging option.
To specify Windbg as your Just-in-time debugger, please refer to the
following article in the Microsoft Knowledge Base:
Q103861 Choosing the Debugger That the System Will Spawn
If the service is running in any account other than the LocalSystem, the
DebugBreak() technique will not work correctly. If the service account
belongs to the administrator's group, the following error message appears
when you are running Microsoft Visual C++ 32-bit edition on Windows NT 4.0:
Runtime error!
Program: <MSDevDir\bin>\MSDEV.exe
abnormal program termination
This error does not occur on Windows NT 3.51.
If the spawned debugger is Windbg, the debugger will appear to have
correctly attached to the service but you will notice a painting problem
with the application.
If the service account does not belong to the administrator's group, the
following error message appears on both Microsoft Visual C++ 32-bit edition and
Windbg:
Initialization of the dynamic link library
<system>\system32\USER32.dll failed. The process is
terminating abnormally.
These errors occur because the service account does not have the proper
security access to the interactive windowstation and desktop. The easiest
solution to the problems is to apply a NULL dacl to the interactive
windowstation and desktop, "winsta0\\default" such that you can debug a
service that is running in an account other than the LocalSystem.
Sample Code
The following sample code applies a NULL dacl to the interactive
windowstation and desktop objects. This application should be executed
before debugging the service. Once the debugging session has been
completed, the DACLs for the interactive windowstation and desktop objects
can be reset by logging off and then logging on again.
#include <windows.h>
#include <stdio.h>
void main(void)
{
HDESK hdesk = NULL;
HWINSTA hwinsta = NULL;
SECURITY_DESCRIPTOR sd;
SECURITY_INFORMATION si = DACL_SECURITY_INFORMATION;
__try
{
//
// Obtain a handle to the interactive windowstation.
//
hwinsta = OpenWindowStation("winsta0", FALSE, WRITE_DAC);
if (hwinsta == NULL)
__leave;
//
// Obtain a handle to the interactive desktop.
//
hdesk = OpenDesktop("default", 0, FALSE,
WRITE_DAC | DESKTOP_WRITEOBJECTS | DESKTOP_READOBJECTS);
if (hdesk == NULL)
__leave;
//
// Create a null dacl.
//
if (!InitializeSecurityDescriptor(&sd,
SECURITY_DESCRIPTOR_REVISION))
__leave;
if (!SetSecurityDescriptorDacl(&sd, TRUE, (PACL) NULL, FALSE))
__leave;
//
// Apply NULL dacl to the windowstation and desktop objects.
//
if (!SetUserObjectSecurity(hwinsta, &si, &sd))
__leave;
if (!SetUserObjectSecurity(hdesk, &si, &sd))
__leave;
}
__finally
{
if (hdesk != NULL)
CloseDesktop(hdesk);
if (hwinsta != NULL)
CloseWindowStation(hwinsta);
}
}
If you are using Windbg as your Just-in-time debugger, you need to either
include the path of the service's debug symbols in the system's environment
variables or make a call to SetCurrentDirectory() in the service so that
the debugger is able to find the debug symbols for the service.
- Follow steps 1-5 in the "Preparation" section of this article. Include
a DebugBreak() statement in the service's code that is before line 223
in Simple.c.
- Once the service has been started, a system dialog box appears.
Choose the cancel button to debug the service. The system does now
spawn the debugger.
- Press the F5 key (a go command) to debug the service.
- Follow steps 4-8 in the "Debugging a Service with WinDbg" or steps 3-6
in the "Debugging a Service with MSVC++".
NOTE: If you are using
WinDbg step 4 will break on line 245 instead of line 256.
Technique 2
Debugging a Service with WinDbg:
- Follow steps 1-5 in the "Preparation" section of this article.
- At a command prompt, go to the directory containing the sample
executable and type:
start WinDbg
to start WinDbg in its own command shell.
- Open a command window in WinDbg and type:
.attach <PID>
- In WinDbg, on the File menu, click Open, and open the source file
(Simple.c).
- Set breakpoints at lines 223, 245, 256, and 271.
- Type g
in the WinDbg command window or press the F5 key
to restart after the thread that WinDbg uses to do the .attach
terminates.
- At the command prompt, start the client by typing:
client [-pipe <pipename>] [-string <string>]
For example:
client -pipe \\.\pipe\simple -string "franki"
- Press the F5 key (a go command) to debug the service. The breakpoint hit
will be on line 256. Press the F5 key again to go to the next
breakpoint. Keep pressing F5 until line 223 waits again for a client to
connect. Try connecting another client and repeat the same steps.
Debugging a Service with MSVC++:
- Follow steps 1-5 in the "Preparation" section of this article.
- At a command prompt, go to the directory containing the sample and type:
MSDEV /P <PID>
where <PID> is the Process ID value you retrieved in step 4.
- In MSVC++, on the File menu, click Open, and open the source file
(Simple.c).
- Set breakpoints at lines 223, 245, 256, and 271. The lines will change
color at this point.
- At the command prompt, start the client by typing:
client [-pipe <pipename>] [-string <string>]
For example: client -pipe \\.\pipe\simple -string "franki"
- Press the F5 key (a go command) to debug the service. The breakpoint hit
will be on line 256. Press the F5 key again to go to the next
breakpoint. Keep pressing F5 until line 223 waits again for a client to
connect. Try connecting another client and repeat the same steps.
Exiting Windbg or MSVC++ will kill the service, which must be restarted
manually either with the Control Panel or SC.EXE.
NOTE: The "System Account" and the "LocalSystem Account" are the same
account.
Additional query words:
Keywords : kbAPI kbKernBase kbNTOS400 kbWinOS2000 kbService kbThread kbDSupport kbGrpKernBase
Version : winnt:3.51,4.0
Platform : winnt
Issue type : kbhowto
|