.thread.thread [list] [process Eprocess (hex)].thread [tid ThreadId (hex)].thread [thread Ethread (hex)].thread2 [tid ThreadId (hex)].thread2 [thread Ethread (hex)]
_ETHREADof the thread that you want to switch to it.
nt!_ETHREAD), use the following command.
Threadto your target thread (if you want to change the current thread), set the
DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PERFORM_SWITCHand leave the
_ETHREAD, then set the
DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_DETAILSand leave the
DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_LISTand also fill the below structure with offsets derived from the PDB file in addition to the target process that you want to see its threads.
NULL, it shows the current process's threads.
TRUE, the semantics for the '.thread' is used and if you set it to
FALSEthen the '.thread2''s semantic is used for the thread switch request.
Resultis filled by the kernel.
DEBUGEER_OPERATION_WAS_SUCCESSFULL, the operation was successful, and you should use the 'g' command to move to the new thread. Otherwise, the returned result is an error, and the current thread is not changed. If you want the current thread, then if the
DEBUGEER_OPERATION_WAS_SUCCESSFULL, then the current thread id is stored at
ThreadIdand the thread object address is stored at
_ETHREADor an invalid thread id, HyperDbg keeps checking for the target address or TID, and whenever the debugger is paused again, it won't check for the thread anymore.
ETHREADis valid. It is because in these cases, Windows halts or suspends those processes (and, of course, its threads) and never switches to them. In these cases, you can switch to the memory layout of the target process by changing cr3 to your target cr3. For more details, please visit here.