title: Is it possible to set breakpoint on module load before ntdll!LdrpDoDebuggerBreak in Windbg?
body: <p>Starting an executable with WinDbg several modules are loaded before breaking into the debugger.</p>
  
  <pre><code>ModLoad: 00400000 0045c000   image00400000
  ModLoad: 77da0000 77f3a000   ntdll.dll
  ModLoad: 77460000 77540000   C:\Windows\SysWOW64\KERNEL32.DLL
  ModLoad: 76b50000 76d4c000   C:\Windows\SysWOW64\KERNELBASE.dll
  ModLoad: 754c0000 7555f000   C:\Windows\SysWOW64\apphelp.dll
  ModLoad: 796c0000 79944000   C:\Windows\SysWOW64\AcLayers.DLL
  ModLoad: 77320000 773df000   C:\Windows\SysWOW64\msvcrt.dll
  ModLoad: 77650000 777e7000   C:\Windows\SysWOW64\USER32.dll
  ModLoad: 77d70000 77d87000   C:\Windows\SysWOW64\win32u.dll
  ModLoad: 75800000 75821000   C:\Windows\SysWOW64\GDI32.dll
  ModLoad: 76970000 76aca000   C:\Windows\SysWOW64\gdi32full.dll
  ModLoad: 76ad0000 76b4c000   C:\Windows\SysWOW64\msvcp_win.dll
  ModLoad: 76850000 7696f000   C:\Windows\SysWOW64\ucrtbase.dll
  ModLoad: 75900000 75e7a000   C:\Windows\SysWOW64\SHELL32.dll
  ModLoad: 777f0000 7782b000   C:\Windows\SysWOW64\cfgmgr32.dll
  ModLoad: 77540000 775c4000   C:\Windows\SysWOW64\shcore.dll
  ModLoad: 77bb0000 77c6b000   C:\Windows\SysWOW64\RPCRT4.dll
  ModLoad: 75570000 75590000   C:\Windows\SysWOW64\SspiCli.dll
  ModLoad: 75560000 7556a000   C:\Windows\SysWOW64\CRYPTBASE.dll
  ModLoad: 75700000 7575f000   C:\Windows\SysWOW64\bcryptPrimitives.dll
  ModLoad: 76660000 766d6000   C:\Windows\SysWOW64\sechost.dll
  ModLoad: 77930000 77ba6000   C:\Windows\SysWOW64\combase.dll
  ModLoad: 76d50000 77315000   C:\Windows\SysWOW64\windows.storage.dll
  ModLoad: 773e0000 77459000   C:\Windows\SysWOW64\advapi32.dll
  ModLoad: 757c0000 757d7000   C:\Windows\SysWOW64\profapi.dll
  ModLoad: 75760000 757a3000   C:\Windows\SysWOW64\powrprof.dll
  ModLoad: 76540000 7654d000   C:\Windows\SysWOW64\UMPDC.dll
  ModLoad: 75f00000 75f44000   C:\Windows\SysWOW64\shlwapi.dll
  ModLoad: 758d0000 758df000   C:\Windows\SysWOW64\kernel.appcore.dll
  ModLoad: 75e80000 75e93000   C:\Windows\SysWOW64\cryptsp.dll
  ModLoad: 75830000 758c2000   C:\Windows\SysWOW64\OLEAUT32.dll
  ModLoad: 76070000 764b9000   C:\Windows\SysWOW64\SETUPAPI.dll
  ModLoad: 76520000 76539000   C:\Windows\SysWOW64\bcrypt.dll
  ModLoad: 73970000 73988000   C:\Windows\SysWOW64\MPR.dll
  ModLoad: 66680000 66683000   C:\Windows\SysWOW64\sfc.dll
  ModLoad: 74e80000 74eeb000   C:\Windows\SysWOW64\WINSPOOL.DRV
  ModLoad: 747f0000 748b5000   C:\Windows\SysWOW64\PROPSYS.dll
  ModLoad: 74dd0000 74e02000   C:\Windows\SysWOW64\IPHLPAPI.DLL
  ModLoad: 79950000 7995f000   C:\Windows\SysWOW64\sfc_os.DLL
  ModLoad: 796b0000 796bf000   C:\Windows\SysWOW64\SortWindows61.dll
  ModLoad: 77620000 77645000   C:\Windows\SysWOW64\IMM32.DLL
  ModLoad: 77c70000 77d67000   C:\Windows\SysWOW64\ole32.dll
  ModLoad: 64740000 647cd000   C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.18362.476_none_71d739795ae3e03a\comctl32.dll
  (118c.4450): Break instruction exception - code 80000003 (first chance)
  eax=00000000 ebx=00305000 ecx=51fe0000 edx=00000000 esi=004e24d0 edi=77da688c
  eip=77e4e9d2 esp=0019fa20 ebp=0019fa4c iopl=0         nv up ei pl zr na pe nc
  cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
  ntdll!LdrpDoDebuggerBreak+0x2b:
  77e4e9d2 cc              int     3
  </code></pre>
  
  <p>Setting a breakpoint on module load i.e sxe ld shell32.dll for example and using .restart to relaunch process doesn't trigger a break. Is this possible with WinDbg in user mode, as I want to analyse some code running during one of these modules loading.</p>