Breaking when a module loads

  • Article

We occasionally get requests for the ability to break when a module loads. WinDbg (the other debugger that Microsoft produces) exposes this as an exception (see the 'sx' command), although it isn't really an exception. Ideally, I think this should be a special kind of breakpoint.

VS doesn't support this as a first class feature, but as long as you know what module you want to break on, this is very easy to do. I will give you two possible ways to do this:

Using a function breakpoint

Just set a function breakpoint on the DllMain function of the module in question (or _DllMainCRTStartup if you prefer). To do this:

  1. Open the 'Debug->New Breakpoint' Dialog (Ctrl-B)
  2. Set function to be '{,,<module >.dll}DllMain'

If you don't have symbols for the dll in question, this is more difficult. Do this:

  1. Start a command prompt that has 'dumpbin.exe' on the path

  2. Goto the module you want

  3. Run 'dumpbin /headers <module> | findstr entry' you should get something like
    1AE60 entry point (77E7AE60)

  4. Set an address breakpoint on the second number (77E7AE60 in the example)

  5. If the dll is also reloacted, then instead you will need to add the first number (1AE60 in the example) to the address where the module will load

This won't work with '/noentry' dlls. This also may not work if you have dlls with circular references. In either case, use the registry.

Using the registry

  1. Open up regedit, and goto HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<dll>
  2. In that key, create a new string value called "BreakOnDllLoad" and set it to "1".