Minggu, 25 Juli 2010

Debugging services startup in Svchost from a kernel mode debug session

Windows shared services allow us to run system services together in a single service by having multiple DLLs run in a single process called Svchost. This allows Windows to have many services to run with the overhead of a single process.   You can find more information about shared services here and here. I like to do a lot of my user mode debugging from a kernel mode debugger. I can just attach

Tidak ada komentar:

Posting Komentar