Comment on page
.detach (detach from the process)
Description of the '.detach' command in HyperDbg.
Detaches from the currently active process.
1b08:1290 u64HyperDbg> .detach
The IOCTL description is the same as the '.start' command, but instead of Action, you should send
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_DETACH, only set the ProcessId to the target Process ID.
If you want to detach from a process, the process must not be in a paused state. Thus, you should remove all the break events or continue the process before detaching from them. HyperDbg will automatically continue the target process before detaching.