当我们用Windbg打开一个exe时，调试器第一次中断：
输入kb查看当前栈如下：
0:000> kb # ChildEBP RetAddr Args to Child 00 00fff8bc 77d498e0 5e7dcb19 0105b000 00000000 ntdll!LdrpDoDebuggerBreak+0x2b 01 00fffb18 77d05257 5e7dcb71 00000000 00000000 ntdll!LdrpInitializeProcess+0x1b20 02 00fffb70 77d05151 00000000 00000000 00000000 ntdll!_LdrpInitialize+0xb0 03 00fffb7c 00000000 00fffb90 77ca0000 00000000 ntdll!LdrInitializeThunk+0x11
LdrpInitialize函数是一个新进程的初始线程开始在用户态执行最早代码，LdrpInitializeProcess函数的一个主要任务是加载EXE文件所依赖的动态链接库，在加载每个DLL后，LdrpInitializeProcess都会检查当前进程是否被调试，如果是，则调用用DbgBreakPoint 通知调试器，注意此时并没有调用每个DLL的Dllmain函数。
我们称这个第一次中断叫初始断点，初始断点不是调试器可以得到的最早控制机会，如进程创建事件和EXE模块加载事件都会比它早。我们可以在进程创建事件时中断下来：
通过
或执行如下指令
sxe cpr
然后.restart就可以先断到进程创建的时候,然后强制把PEB的BeingDebugged字段改为0:
0:000> db @$peb
0118d000 00 00 01 04 ff ff ff ff-00 00 e4 00 00 00 00 00 ................
0118d010 00 00 e1 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0118d020 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0118d030 00 00 00 00 00 00 00 00-00 00 e2 00 00 00 00 00 ................
0118d040 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0118d050 00 00 00 00 00 00 00 00-00 00 36 7f 00 00 36 7f ..........6...6.
0118d060 28 00 39 7f 08 00 00 00-00 04 00 00 00 00 00 00 (.9.............
0118d070 00 80 9b 07 6d e8 ff ff-00 00 10 00 00 20 00 00 ....m........ ..
0:000> eb @$peb+2
0118d002 01 0
0
0118d003 04 08
08
0118d004 ff
0:000> db@$peb
0118d000 00 00 00 08 ff ff ff ff-00 00 e4 00 00 00 00 00 ................
0118d010 00 00 e1 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0118d020 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0118d030 00 00 00 00 00 00 00 00-00 00 e2 00 00 00 00 00 ................
0118d040 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0118d050 00 00 00 00 00 00 00 00-00 00 36 7f 00 00 36 7f ..........6...6.
0118d060 28 00 39 7f 08 00 00 00-00 04 00 00 00 00 00 00 (.9.............
0118d070 00 80 9b 07 6d e8 ff ff-00 00 10 00 00 20 00 00 ....m........ ..
0:000> g
ModLoad: 77ca0000 77e3c000 ntdll.dll
ModLoad: 74de0000 74e33000 C:\windows\SysWOW64\MSCOREE.DLL
ModLoad: 76450000 76530000 C:\windows\SysWOW64\KERNEL32.dll
这样，windbg就不会中断到初始断点了！