HyperDbg Documentation
HyperDbgDownloadSource codeBlog
Search…
HyperDbg
Getting Started
Quick Start
FAQ
Build & Install
Attach to HyperDbg
Attach to a remote machine
Attach to local machine
Start a new process
Attach to a running process
Using HyperDbg
Prerequisites
User-mode Debugging
Kernel-mode Debugging
Commands
Debugging Commands
Meta Commands
Extension Commands
Scripting Language
Tips & Tricks
Considerations
Nested-Virtualization Environments
Misc
Contribution
Style Guide
Logo & Artworks
Design
Features
Debugger Internals
Script Engine
Links
Twitter
YouTube
Doxygen
Contribution
Powered By GitBook
Attach to a running process
Attaching to an already running process
Attaching to an already running process is crucial for debugging. HyperDbg implemented attaching in VMI Mode. If you want to use this mechanism in Debugger Mode, you can use the '.process' and the '.thread' commands.
The user-mode debugger is still in the beta version and not stable. We decided to exclude it from this release and release it in future versions. If you want to test the user-mode debugger in VMI Mode, you should build HyperDbg with special instructions. Please follow the instruction here.
In contrast with the kernel debugger, the user debugger is still very basic and needs a lot of tests and improvements. We highly recommend not to run the user debugger in your bare metal system. Instead, run it on a supported virtual machine to won't end up with a Blue Screen of Death (BSOD) in your primary device. Please keep reporting the issues to improve the user debugger.
Please make sure to read the user debugger's principles before using the '.attach' command.
After connecting to the debuggee in VMI Mode (local debugging), you can run the following command to start the "Thread Interception" phase.
1
HyperDbg> .attach pid 1ac0
Copied!
The process Id should be in hex format. We chose "mspaint" for debugging.
Attaching to the target process
After intercepting the user mode running threads, we can now step through the instructions.
Note that all the intercepted threads are halted when running a single-step command.
Stepping through the instructions
Next, if you run the 'g' command, HyperDbg will normally continue the target debuggee process.
Continuing the target process
If you want to pause the debuggee and intercept the user running threads again, you can either use the 'pause' command or press CTRL+C.
Note that you should keep interacting with the process to force the process to run its codes in user-mode so HyperDbg will intercept more threads.
Pausing the target process
Finally, we can detach from the target process by using the '.detach' command.
Detaching from the target process
In this article, we've learned how to use the user debugger to attach to the target process. Please read the article here if you want to start a process and debug it from the entrypoint.
Previous
Start a new process
Next - Using HyperDbg
Prerequisites
Last modified 2mo ago
Copy link
Edit on GitHub