.detach (detach from the process)
Description of the '.detach' command in HyperDbg.
Detaches from the currently active process.
1b08:1290 u64HyperDbg> .detach
The IOCTL description is the same as the '.start' command, but instead of Action, you should send
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_DETACH, only set the ProcessId to the target Process ID.
If you want to detach from a process, the process must not be in a paused state. Thus, you should remove all the break events or continue the process before detaching from them. HyperDbg will automatically continue the target process before detaching.
This command is logically designed to be used in VMI Mode. You can use the '.process' and the '.thread' commands in Debugger Mode.