Last week I wrote about the INT 3 trick for bringing a service up under a debugger, at initialization, without using gflags or editing the registry. Recall that without source code, Windows services are a pain to debug, wanting to run from the Service Controller instead of the command line. The INT 3 trick is a single-byte binary patch to trap to the debugger. This is great if all you need is to get the service initialization code up under Olly or windbag[*]. But Im reversing some silly (and convoluted) crypto code. I want PaiMei.
