While loading individual executables and DLLs for debugging is generally a pretty straightforward task, things get a little bit more complicated when we talk about debugging Windows services.
Debugging malicious services
What is service?
Services are tasks that are generally supposed to execute certain logic in the background, similar to daemons on Linux. So, there is no surprise that malware authors commonly use them to achieve reliable persistence.
Services are controlled by the Service Control Manager (SCM) implemented in %SystemRoot%\System32\services.exe. All services have the corresponding HKLM\SYSTEM\CurrentControlSet\services\<service_name> registry key. It contains multiple values describing the service, including&...
