Microsoft KB Archive/98890

{|
 * width="100%"|

HOWTO: Debug a Service Under Windows NT

 * }

Q98890

-

The information in this article applies to:


 * Microsoft Win32 Application Programming Interface (API), used with:
 * the operating system: Microsoft Windows NT, versions 3.51, 4.0
 * the operating system: Microsoft Windows 2000

-

SUMMARY
The steps in this article illustrate how to debug a service under Windows NT using WinDbg and the interactive debugger included with Microsoft Visual 32-bit edition. WinDbg ships with the Win32 Software Development Kit (SDK). For illustration purposes, these procedures use the SERVICE sample, which is built with debugging information by default. This sample is located in:

"Mstools\Samples\Win32Base\WinNT\Service" There are two techniques for debugging a service. The first technique involves adding a DebugBreak statement to the service's code and letting the Just-in-time(JIT) debugging feature of Windows NT spawn the debugger when the service executes the DebugBreak. The second technique involves attaching the debugger to the service while it is running.

Preparation
 Build the sample.  Install the Simple service with the following command: "simple -install" You receive a message indicating whether you were successful.   Use the Control Panel's Services application to start the Simple service or you can also use: "sc start simpleservice" Sc.exe is located in the Platform SDK bin directory.  This step is needed for Technique 2: Use PView to get the process ID (PID) for the Simple service. For example, if PView shows the process as simple(0xD5), the PID is 0xD5. If you're using Microsoft Visual C++ 32-bit edition, convert the PID from hexadecimal to decimal. For example, 0xD5 is 213 in decimal.

Technique 1
To specify Microsoft Visual C++ 4.X as your Just-in-time debugger:


 * 1) On the tools menu, click options.
 * 2) Click the debug tag, and select the Just-in-time debugging option.

If the service is running in any account other than the LocalSystem, the DebugBreak technique will not work correctly. If the service account belongs to the administrator's group, the following error message appears when you are running Microsoft Visual C++ 32-bit edition on Windows NT 4.0:

Runtime error!

Program: \MSDEV.exe

abnormal program termination

This error does not occur on Windows NT 3.51.

If the spawned debugger is Windbg, the debugger will appear to have correctly attached to the service but you will notice a painting problem with the application.

If the service account does not belong to the administrator's group, the following error message appears on both Microsoft Visual C++ 32-bit edition and Windbg:

Initialization of the dynamic link library \system32\USER32.dll failed. The process is terminating abnormally.

These errors occur because the service account does not have the proper security access to the interactive windowstation and desktop. The easiest solution to the problems is to apply a NULL dacl to the interactive windowstation and desktop, &quot;winsta0\\default&quot; such that you can debug a service that is running in an account other than the LocalSystem.

Sample Code
The following sample code applies a NULL dacl to the interactive windowstation and desktop objects. This application should be executed before debugging the service. Once the debugging session has been completed, the DACLs for the interactive windowstation and desktop objects can be reset by logging off and then logging on again.

  #include    #include 

void main(void) {       HDESK                hdesk   = NULL; HWINSTA             hwinsta = NULL; SECURITY_DESCRIPTOR sd; SECURITY_INFORMATION si     = DACL_SECURITY_INFORMATION;

__try {            //              // Obtain a handle to the interactive windowstation. //             hwinsta = OpenWindowStation(&quot;winsta0&quot;, FALSE, WRITE_DAC); if (hwinsta == NULL) __leave;

//             // Obtain a handle to the interactive desktop. //             hdesk = OpenDesktop(&quot;default&quot;, 0, FALSE,                   WRITE_DAC | DESKTOP_WRITEOBJECTS | DESKTOP_READOBJECTS); if (hdesk == NULL) __leave;

//             // Create a null dacl. //             if (!InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION)) __leave;

if (!SetSecurityDescriptorDacl(&sd, TRUE, (PACL) NULL, FALSE)) __leave;

//             // Apply NULL dacl to the windowstation and desktop objects. //             if (!SetUserObjectSecurity(hwinsta, &si, &sd)) __leave;

if (!SetUserObjectSecurity(hdesk, &si, &sd)) __leave; }       __finally {            if (hdesk != NULL) CloseDesktop(hdesk);

if (hwinsta != NULL) CloseWindowStation(hwinsta); }  } If you are using Windbg as your Just-in-time debugger, you need to either include the path of the service's debug symbols in the system's environment variables or make a call to SetCurrentDirectory in the service so that the debugger is able to find the debug symbols for the service.


 * 1) Follow steps 1-5 in the &quot;Preparation&quot; section of this article. Include a DebugBreak statement in the service's code that is before line 223 in Simple.c.
 * 2) Once the service has been started, a system dialog box appears. Choose the cancel button to debug the service. The system does now spawn the debugger.
 * 3) Press the F5 key (a go command) to debug the service.
 * 4) Follow steps 4-8 in the &quot;Debugging a Service with WinDbg&quot; or steps 3-6 in the &quot;Debugging a Service with MSVC++&quot;.

NOTE: If you are using WinDbg step 4 will break on line 245 instead of line 256.

Technique 2
Debugging a Service with WinDbg:

 Follow steps 1-5 in the &quot;Preparation&quot; section of this article.</li>  At a command prompt, go to the directory containing the sample executable and type: "start WinDbg" to start WinDbg in its own command shell. </li>  Open a command window in WinDbg and type: ".attach <PID>"</li> In WinDbg, on the File menu, click Open, and open the source file (Simple.c).</li> Set breakpoints at lines 223, 245, 256, and 271.</li> Type g in the WinDbg command window or press the F5 key to restart after the thread that WinDbg uses to do the .attach terminates.</li>  At the command prompt, start the client by typing: "client [-pipe ] [-string ]" For example: "client -pipe \\.\pipe\simple -string &quot;franki&quot;"</li> Press the F5 key (a go command) to debug the service. The breakpoint hit will be on line 256. Press the F5 key again to go to the next breakpoint. Keep pressing F5 until line 223 waits again for a client to connect. Try connecting another client and repeat the same steps.</li></ol>

Debugging a Service with MSVC++:

 Follow steps 1-5 in the &quot;Preparation&quot; section of this article.</li>  At a command prompt, go to the directory containing the sample and type: "MSDEV /P <PID>" where <PID> is the Process ID value you retrieved in step 4. </li> In MSVC++, on the File menu, click Open, and open the source file (Simple.c).</li> Set breakpoints at lines 223, 245, 256, and 271. The lines will change color at this point.</li>  At the command prompt, start the client by typing: "client [-pipe ] [-string ]" For example: client -pipe \\.\pipe\simple -string &quot;franki&quot; </li> Press the F5 key (a go command) to debug the service. The breakpoint hit will be on line 256. Press the F5 key again to go to the next breakpoint. Keep pressing F5 until line 223 waits again for a client to connect. Try connecting another client and repeat the same steps.</li></ol>

Exiting Windbg or MSVC++ will kill the service, which must be restarted manually either with the Control Panel or SC.EXE.

NOTE: The &quot;System Account&quot; and the &quot;LocalSystem Account&quot; are the same account.

Additional query words:

Keywords : kbAPI kbKernBase kbOSWinNT400 kbOSWin2000 kbService kbThread kbDSupport kbGrpDSKernBase

Issue type : kbhowto

Technology : kbAudDeveloper kbWin32sSearch kbWin32API