[SOLVED] Can I set a breakpoint in ntdll.dll!

Can I set a breakpoint in ntdll.dll!_LdrpInitializeProcess?

When debugging a Windows process, it would sometimes be convenient to break as early as possible.

Inital Callstack looks like this: (you get this e.g. when you set a breakpoint in a DllMain function on DLL_PROCESS_ATTACH)

    ...
    ntdll.dll!_LdrpCallInitRoutine@16()  + 0x14 bytes   
    ntdll.dll!_LdrpRunInitializeRoutines@4()  + 0x205 bytes 
>   ntdll.dll!_LdrpInitializeProcess@20()  - 0x96d bytes    
    ntdll.dll!__LdrpInitialize@12()  + 0x6269 bytes 
    ntdll.dll!_KiUserApcDispatcher@20()  + 0x7 bytes

so setting a breakpoint in one of these ntdll routines should really break the process very early.

However, I can't figure out how to set a breakpoint there prior to starting the process in the debugger. Is it possible in Visual Studio (2005)? How? Can it be done in WinDbg?

Solution

I have found out how to do it in Visual Studio.

The problem here is, that setting a breakpoint in any assembly function will be remembered as a "Data Breakpoint". These breakpoints are disabled as soon as the process stops, so even if I set one in this function (I can do this because I have the function on the stack if I set a breakpoint in any DllMain function) this breakpoint will be disabled for a new process run.

However for ntdll.dll (and kernel32.dll) the load addresses are pretty much fixed and won't change (and least not until reboot).

So, before starting the process, I just have to re-enable the Data Breakpoint for the address that corresponds to this NtDll function and the debugger will then stop there.