Debugging the Win32 Subsystem

ID: Q105677

The information in this article applies to:

Microsoft Win32 Software Development Kit (SDK), on platform(s):
- Microsoft Windows NT, versions 3.1, 3.5

The instructions on page 1-18 of Part II of the Win32 "Programmer's Guide" included with the Win32 Device Driver Kit (DDK) says to use NTSD -d -p -1 to attach to the Win32 subsystem process and enable debugging of its user- mode drivers. This results in the error:

NTSD: cannot debug PID -1
error = 5

To enable this procedure to work properly, change the GlobalFlag value under:


   HKEY_LOCAL_MACHINE\ 
               SYSTEM\ 
    CurrentControlSet\ 
              Control\ 
      Session Manager

Remove the flag 0x00080000 from 0x211a0000 to make it 0x21120000. The 0x00080000 flag disables the ability to debug CSRSS.EXE (the client server run time subsystem), which is specified by the "-p -1" parameter.

It is also possible to debug CSRSS using "WinDbgRm -c -p-1" instead of NTSD. Make sure that WinDbgRm defaults to debugging using TLPIPE.DLL as its transport layer, then run "windbgrm -c -p-1" on the debuggee.

On the debugger machine, make sure that CSRSS.EXE and any dynamic-link libraries (DLLs) that you are debugging in association with it are in the same directory, and run WinDbg. To set the transport DLL, choose Debug from the Options menu, choose Transport DLLs, and set the transport DLL to TLPIPE. Set the host name entries to be the machine name of the debuggee.

Additional query words: 3.10 3.50


Keywords          : 
Version           : WINDOWS:
Platform          : WINDOWS 
Issue type        :