.thread, .thread2 (show the current thread and switch to another thread)
Description of '.thread, .thread2' commands in HyperDbg.
Command
.thread
.thread2
Syntax
.thread
.thread [list] [process Eprocess (hex)]
.thread [tid ThreadId (hex)]
.thread [thread Ethread (hex)]
.thread2 [tid ThreadId (hex)]
.thread2 [thread Ethread (hex)]
Description
Shows or changes the current thread. These commands are logically designed to be used in Debugger Mode. You can use the '.attach' and the '.detach' commands in VMI Mode. However, you can use it to view the list of the threads in both VMI Mode and Debugger Mode.
Important: the implementation of these commands is different. Please visit this article to be aware of the differences and to know when you should use the '.thread' command and when you should use the alternative '.thread2' command.
If you want to change the thread to a new thread, after using the '.thread' or the '.thread2' commands, you should use the 'g' command.
Parameters
[list]
It shows the list of threads.
[process Eprocess (hex)] (optional)
If you specify the list as the first argument, you can optionally specify the target process that you want to see its threads, otherwise, the threads for the current process are shown.
[tid ThreadId (hex)]
The thread id of the thread that you want to switch to it.
[thread Ethread (hex)]
The _ETHREAD of the thread that you want to switch to it.
If you don't specify any parameters to the '.thread' or the '.thread2' commands, it shows the threads of the current process.
Examples
Use the following command to see the currently executing thread (and other information like thread and process object addresses and the image name).
If you want to switch to a thread with a thread id equal to 23f8, use the below command. After that, use the 'g' command, and when the debuggee breaks again, you can see that the thread is changed to your requested thread.
If you want to switch to a thread by using its thread object address (nt!_ETHREAD), use the following command.
If you want to see a list of threads in the current process.
If you want to view a list of threads of a special process, use its process object (nt!_EPROCESS) address. You can get a list of process objects list using the '.process' command.
IOCTL
This commands works over serial by sending the serial packets to the remote computer.
First of all, you should fill the DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET structure.
Set the ThreadId or Thread to your target thread (if you want to change the current thread), set the ActionType to DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PERFORM_SWITCH and leave the Result.
This is the enum for action type.
If you want to get the current thread id and _ETHREAD, then set the ActionType to DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_DETAILS and leave the ThreadId and Thread.
If you want to see the list of threads, you should set the ActionType to DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_LIST and also fill the below structure with offsets derived from the PDB file in addition to the target process that you want to see its threads.
If you set Process to NULL, it shows the current process's threads.
When you set CheckByClockInterrupt to TRUE, the semantics for the '.thread' is used and if you set it to FALSE then the '.thread2''s semantic is used for the thread switch request.
After that, send the above structure to the debuggee when debuggee is paused and waiting for new command on vmx-root mode.
You should send the above structure with DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CHANGE_THREAD as RequestedAction and DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_VMX_ROOT as PacketType.
In return, the debuggee sends the above structure with the following type.
In the returned structure, the Result is filled by the kernel.
If the Result is DEBUGEER_OPERATION_WAS_SUCCESSFULL, the operation was successful, and you should use the 'g' command to move to the new thread. Otherwise, the returned result is an error, and the current thread is not changed. If you want the current thread, then if the Result is DEBUGEER_OPERATION_WAS_SUCCESSFULL, then the current thread id is stored at ThreadId and the thread object address is stored at Thread.
The following function is responsible for changing the core in the debugger.
Remarks
If you want to see a list of threads, you need to load the public symbol file (PDB) for the ntoskrnl.exe using the '.sym' command.
The difference between these commands (.thread and .thread2) is explained here.
If you've entered an invalid address as _ETHREAD or an invalid thread id, HyperDbg keeps checking for the target address or TID, and whenever the debugger is paused again, it won't check for the thread anymore.
It also means that if you press the 'g' command and an event or a breakpoint is triggered before switching to the new thread, switching will be ignored, and you need to re-switch to the target thread and use the '.thread' or '.thread2' commands again.
Some threads might never trigger even if their thread id or ETHREAD is valid. It is because in these cases, Windows halts or suspends those processes (and, of course, its threads) and never switches to them. In these cases, you can switch to the memory layout of the target process by changing cr3 to your target cr3. For more details, please visit here.
Requirements
None
Related
.process, .process2 (show the current process and switch to another process)
Last updated