Attach to a running process
Attaching to an already running process
Last updated
Attaching to an already running process
Last updated
Attaching to an already running process is crucial for debugging. HyperDbg implemented attaching in . If you want to use this mechanism in , you can use the '' and the '' commands.
The user-mode debugger is still in the beta version and not stable. We decided to exclude it from this release and release it in future versions. If you want to test the user-mode debugger in VMI Mode, you should build HyperDbg with special instructions. Please follow the instruction .
In contrast with the kernel debugger, the user debugger is still very basic and needs a lot of tests and improvements. We highly recommend not to run the user debugger in your bare metal system. Instead, run it on a to won't end up with a Blue Screen of Death (BSOD) in your primary device. Please keep reporting the issues to improve the user debugger.
Please make sure to read the user debugger's before using the '' command.
After , you can run the following command to start the "" phase.
The process Id should be in hex format. We chose "mspaint" for debugging.
After intercepting the user mode running threads, we can now step through the instructions.
Note that all the intercepted threads are halted when running a single-step command.
Note that you should keep interacting with the process to force the process to run its codes in user-mode so HyperDbg will intercept more threads.
Next, if you run the '' command, HyperDbg will normally continue the target debuggee process.
If you want to pause the debuggee and intercept the user running threads again, you can either use the '' command or press CTRL+C.
Finally, we can detach from the target process by using the '' command.
In this article, we've learned how to use the user debugger to attach to the target process. Please read the article if you want to start a process and debug it from the entrypoint.
