.switch (show the list and switch between active debugging processes)
Description of the '.switch' command in HyperDbg.

Command

.switch

Syntax

.switch
.switch [pid ProcessId (hex)]
.switch [tid ThreadId (hex)]

Description

Shows a list of active debugging processes and threads or switches between different active debugging threads and processes. This command displays the list of intercepted threads that you can switch to these processes or threads. It won't show all of the threads of the target process.
If you don't specify any parameters to this command, it shows the list of threads and processes.
This command won't use any Windows API for intercepting and pausing threads, and everything is done at the hypervisor level.

Parameters

[pid ProcessId (hex)]
The target Process Id to switch.
[tid ThreadId (hex)]
The target Thread Id to switch.

Examples

The following command shows the list of active debugging threads/processes.
1
1b08:2050 u64HyperDbg> .switch
2
1a78 (process)
3
2020 (thread)
4
*1b08 (process)
5
1380 (thread)
6
1ed4 (thread)
7
-> 2050 (thread)
Copied!
We'll use the following command to switch to thread id 0x2020.
1
1b08:2050 u64HyperDbg> .switch tid 2020
2
switched to thread id: 2020
Copied!
As you can see, the arrow in the list of active debugging threads is changed.
1
1a78:2020 u86HyperDbg> .switch
2
*1a78 (process)
3
-> 2020 (thread)
4
1b08 (process)
5
1380 (thread)
6
1ed4 (thread)
7
2050 (thread)
Copied!
It is also possible to switch by using process id.
1
1a78:428 u86HyperDbg> .switch pid 1b08
2
switched to process id: 1b08
Copied!
Again, the active debugging process (thread) is changed.
1
1b08:1380 u64HyperDbg> .switch
2
1a78 (process)
3
2020 (thread)
4
0428 (thread)
5
0940 (thread)
6
13e4 (thread)
7
*1b08 (process)
8
-> 1380 (thread)
9
1ed4 (thread)
10
2050 (thread)
Copied!

IOCTL

This function works by calling DeviceIoControl with IOCTL = IOCTL_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS. You have to send it in the following structure.
1
typedef struct _DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS
2
{
3
BOOLEAN IsStartingNewProcess;
4
UINT32 ProcessId;
5
UINT32 ThreadId;
6
BOOLEAN Is32Bit;
7
BOOLEAN IsPaused; // used in switching to threads
8
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE Action;
9
UINT32 CountOfActiveDebuggingThreadsAndProcesses; // used in showing the list of active threads/processes
10
UINT64 Token;
11
UINT64 Result;
12
13
} DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS, *PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS;
Copied!
First, you should set the Action to DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_QUERY_COUNT_OF_ACTIVE_DEBUGGING_THREADS in the above structure, when the IOCTL returns from the kernel, CountOfActiveDebuggingThreadsAndProcesses is filled with appropriate data from the process.
After getting the results from the kernel and if the Result is equal to DEBUGGER_OPERATION_WAS_SUCCESSFULL you should pass a new IOCTL to the kernel again.
The new IOCTL is equal to IOCTL_GET_DETAIL_OF_ACTIVE_THREADS_AND_PROCESSES. There is no need for the input buffer, but for the output buffer, you should allocate a memory with the size of the following structure multiplied by the count of threads/processes returned from the previous IOCTL.
1
typedef struct _USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS
2
{
3
UINT32 ProcessId;
4
UINT32 ThreadId;
5
BOOLEAN IsProcess;
6
7
} USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS, *PUSERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS;
Copied!
The Action can be from the following enum:
1
typedef enum _DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE
2
{
3
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_ATTACH,
4
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_DETACH,
5
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_REMOVE_HOOKS,
6
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_KILL_PROCESS,
7
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_PAUSE_PROCESS,
8
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_SWITCH_BY_PROCESS_OR_THREAD,
9
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_QUERY_COUNT_OF_ACTIVE_DEBUGGING_THREADS,
10
11
} DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE;
Copied!

Remarks

This command is logically designed to be used in VMI Mode. You can use the '.process' and the '.thread' commands in Debugger Mode.

Requirements

None