Windbg introduction (3) - Remote Debug

How to setup remote debug session using process server (DbgSrv.exe):

DbgSrv.exe is small application running on the same system as the target process. We can use it to attach to a target process or starts up a new process under control of debugger; can enable the process to be debugged remotely; does not require symbols or source code on target system.
Syntax:
DbgSrv –t tcp:port=<PortNumber>

For example, following command starts an dbgsrv process listening at TCP port 8000:
c:\Debugger\dbgsrv.exe -t tcp:port=8000

Detail usage:
Usage: dbgsrv -t [-sifeo ] [-x] [-c[s] ] [-pc ]
...transport: tcp npipe ssl spipe 1394 com
......for tcp use: port= <socket port #>
......for npipe use: pipe= <name of pipe>
......for 1394 use: channel= <channel #>
......for com use: port=<COM port>,baud=<baud rate>, channel=<channel #>
for ssl and spipe see the documentation

Example: dbgsrv -t npipe:pipe=foobar

Then run following command on host system to start an smart windbg client process:
Windbg –Q –premote tcp:server=<targetsystem>,port= <portnumber>

For example, following command will start windbg client, which starts a notepad.exe process under the control of dbgsrv process:
c:\debugger\Windbg -Q -premote tcp:server=localhost,port=8000 notepad.exe We can verify this by following command to list all of the current processes running on the system:
c:\debugger\tlist –t
-----------------------------
....
dbgsrv.exe (3308)
...notepad.exe (2220)
windbg.exe (1060) [tcp:server=localhost,port=8000] notepad.exe - WinDbg:6.8.0004.0 tlist.exe (2796)
--------------------------------
Apparently, notepad.exe (2220) is the child process of dbgsrv.exe (3308).

Now you can execute any commands on windbg client, which will be forwarded to dbgsrv.exe process and executed against the target process. For example: ‘g’ will run the target notepad.exe and you can type some text “ABCD” into the window.
Finally, at the end of your debugging, type ‘.endpsrv ’ will terminate DbgSrv.exe on the target system. Then, any command will fail since target process has been terminated.
For example:
0:002> .endpsrv
Server told to exit
Try to list all processes on the target system will fail:
0:002> .tlist
Unable to get process list, HRESULT 0x8001000A