How to set breakpoint at the very beginning of program execution

后端 未结 7 1183
眼角桃花
眼角桃花 2020-11-29 08:37

How can I stop the program before loading any of the linked DLLs?

I\'ve tried to set LoadLibraryExW function in the Break At Function debug

7条回答
  •  南方客
    南方客 (楼主)
    2020-11-29 09:14

    ntdll.dll is loaded by the kernel, during process creation. I don't know about the other dlls specifically, but they're most likely also loaded by the kernel.

    As far as I'm aware, what you're trying to do can't be done, unless you were to write a rootkit to overwrite part of the process creation code. Even then, I'm not sure if the process being created is really considered a process before these libraries are loaded.

提交回复
热议问题