title: How to break into WinDBG when ntdll.dll is mapped into the new process
body: <p>I want to use the following command to break into WinDBG when ntdll.dll is mapped into the new process, and before any of ntdll's process initialization runs.</p>
  
  <p><strong>sxe ld ntdll.dll ;g</strong></p>
  
  <p>However, the trick doesn't work at all,</p>
  
  <pre><code>ModLoad: 7c900000 7c9b0000   ntdll.dll
  eax=010043af ebx=7ffde000 ecx=020f18f5 edx=00000034 esi=00c2f720 edi=00c2f6f2
  eip=7c810867 esp=0006fffc ebp=00000720 iopl=0         nv up ei pl nz na po nc
  cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000200
  7c810867  ??              ???
  Processing initial command 'sxe ld ntdll.dll ;g'
  0:000&gt; sxe ld ntdll.dll ;g
  (ae8.6f4): Break instruction exception - code 80000003 (first chance)
  eax=00181eb4 ebx=7ffde000 ecx=00000001 edx=00000002 esi=00181f48 edi=00181eb4
  eip=7c901230 esp=0006fb20 ebp=0006fc94 iopl=0         nv up ei pl nz na po nc
  cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
  ntdll!DbgBreakPoint:
  7c901230 cc              int     3
  </code></pre>
  
  <p>So, How to break into WinDBG when ntdll.dll is mapped into the new process?
  thanks</p>
  
  <p><strong>[UPDATE]</strong></p>
  
  <p>I exactly followed the steps as mentioned by jcopenha, but I don't know why Windbg gives a strange error(<strong>Memory access error</strong>) where Notepad.exe is running  .</p>
  
  <p>Please give me a hand!Thanks a lot!</p>
  
  <pre><code>0:000&gt; .restart /f
  CommandLine: C:\WINDOWS\NOTEPAD.EXE
  Symbol search path is: D:\Symbols\Symbols;SRV*D:\Symbols\MySymbols*http://msdl.microsoft.com/download/symbols
  Executable search path is: 
  ModLoad: 01000000 01014000   notepad.exe
  eax=0100739d ebx=7ffd9000 ecx=020f18f5 edx=0000004e esi=00f7f73a edi=00f7f6f2
  eip=7c810867 esp=0007fffc ebp=0000024c iopl=0         nv up ei pl nz na po nc
  cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000200
  7c810867 ??              ???
  0:000&gt; u 7c810867
  7c810867 ??              ???
              ^ Memory access error in 'u 7c810867'
  </code></pre>
  
  <p><strong>[UPDATE2]</strong>
  I found an odd instruction displayed at 7c810867, but p command still can work.</p>
  
  <p>Is it a bug in WinDBG?</p>
  
  <p><img src="https://i.stack.imgur.com/9piEe.png" alt="enter image description here"></p>