debuggingwindbg

How to switch from non-invasive attach to invasive?


With WinDbg, I can attach to a process in non-invasive mode.

WARNING: Process 8196 is not attached as a debuggee
         The process can be examined but debug events will not be received
........
(2004.7558): Wake debugger - code 80000007 (first chance)

I sometimes use this, when I want Visual Studio as my primary debugger. Now, say I attached WinDbg in parallel to VS in non-invasive mode, but I want to remove Visual Studio as the primary debugger, so I do Debug / Detach all in Visual Studio.

How would I make WinDbg the "invasive" debugger?

I want to preserve the state of the application. I.e., I don't want to run the application and reattach at a later point. Imagine that the application immediately terminates if I let it run further, e.g. with the following code:

#include <iostream>

int main()
{
    std::cout << "Hello World!\n";
} // VS breakpoint here

I have tried:

  1. Attaching via F6 (GUI attach)

  2. Attaching via .attach

    0:000> |
    .  0    id: 2004    examine name: C:\[...].exe
    
    0:000> .attach 2004
    Attach will occur on next execution
    
    0:000> g
    *** wait with pending attach
    
  3. Freezing all threads (~*f) before .attach

However in all cases, the process terminated with exit code -1073740972 (0xc0000354), which is STATUS_DEBUGGER_INACTIVE. This happens if the debugger (Visual Studio) has started the process with the DEBUG_OBJECT_KILL_ON_CLOSE flag or has called the DebugSetProcessKillOnExit(). However, my understanding of "detach" would mean that the process is kept alive.


Solution

  • I couldn't make the current WinDbg the invasive debugger, but it's possible to make a new WinDbg instance the invasive debugger:

    1. Start with VS as the debugger
    2. Start WinDbg, attach non-invasive
    3. Detach VS
    4. Start a new WinDbg instance, attach invasive
    5. Detach the noninvasive debugger (qd or .detach)