.process.process2
.process.process [list].process [pid ProcessId (hex)].process [process Eprocess (hex)].process2 [pid ProcessId (hex)].process2 [process Eprocess (hex)]
_EPROCESS
of the process to switch on its memory layout.0x1ddc
._EPROCESS
equals to ffff948cc2349280
.ProcessId
or Process
to your target process (if you want to change the current process), set the ActionType
to DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PERFORM_SWITCH
and leave the Result
._EPROCESS
, then set the ActionType
to DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_GET_PROCESS_DETAILS
and leave the ProcessId
and Process
.ActionType
to DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_GET_PROCESS_LIST
and also fill the below structure with offsets derived from the PDB file in addition to the address of nt!PsActiveProcessHead
.IsSwitchByClkIntr
to TRUE
, the semantics for the '.process' is used and if you set it to FALSE
then the '.process2''s semantic is used for the process switch request.DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CHANGE_PROCESS
as RequestedAction
and DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_VMX_ROOT
as PacketType
.Result
is filled by the kernel.Result
is DEBUGEER_OPERATION_WAS_SUCCESSFULL
, the operation was successful, and you should use the 'g' command to move to the new process. Otherwise, the returned result is an error, and the current process is not changed. If you want the current process, then if the Result
is DEBUGEER_OPERATION_WAS_SUCCESSFULL
, then the current process id is stored at ProcessId
and the process object address is stored at Process
._EPROCESS
or an invalid process id, HyperDbg keeps checking for the target address or PID, and whenever the debugger is paused again, it won't check for the process anymore.EPROCESS
is valid. It is because in these cases, Windows halts or suspends those processes and never switches to them. In these cases, you can switch to the memory layout of the target process by changing cr3 to your target cr3. For more details, please visit here.