Windbg Introduction (2) - Debug Type

The common used Debugger switches:
-Q: Suppresses prompt for saving workspace
-y: Path to symbols, symbol server
-srcpath: Source files directory path
-server: Creates a debugging server that remote debuggers can connect to
-remote: Creates a debugging client that attaches to a debugging sever
-g: Ignores initial breakpoint in target application
-z: Path to crash dump used for post-mortem debugging.
-p: Specifies the decimal process ID to be debugged. This is used to debug a process that is already running

Normally, as have posted in previous blog, there are 2 common types of debugging: live debugging and post-mortem debugging.

Live debugging usually needs SeDebugPrivilege user right , refer to http://support.microsoft.com/kb/131065/. Generally, there are 3 common used debugging scenarios:
1. User mode debugging – attach to a running process
2. User mode debugging – start an executable under debugger
3. User mode remote debugging – by TCP/IP or named pipe, which requires target process running under debugger or process server, AND remote debugger connect to the local debugger or process server through network.
Besides, debugger can attach and debug multiple processes simultaneously.

While post-mortem debugging is simple, just load the crash dump file and do debug (the crash dump either manually created when application hang or automatically created when application crash).

Also, if categorized by debugging mode, there are Invasive and Non-Invasive debugging.

Invasive debugging means debugger will attach to the target process and start a thread inside it. Debugger will interact with target process. OS send events like module loads and exceptions to debugger. Using ‘qd’ command to detach debugger from process and quit.

Non-Invasive debugging (opens a process), Debugger can access the Virtual Address of the target process, BUT cannot perform any execution control on target process, like bp, bu, g, p, t. Useful on WinNT4 and Win2000 where ‘qd’ is NOT supported.
You can use ‘.detach’ AND ‘.attach –v PID’ to switch from Invasive debugging to Non-Invasive debugging.