Attach to a running process

Attaching to an already running process

Attaching to an already running process is crucial for debugging. HyperDbg implemented attaching in VMI Mode. If you want to use this mechanism in Debugger Mode, you can use the '.process' and the '.thread' commands.

Please make sure to read the user debugger's principles before using the '.attach' command.

After connecting to the debuggee in VMI Mode (local debugging), you can run the following command to start the "Thread Interception" phase.

HyperDbg> .attach pid 1ac0

The process Id should be in hex format. We chose "mspaint" for debugging.

Attaching to the target process

After intercepting the user mode running threads, we can now step through the instructions.

Note that all the intercepted threads are halted when running a single-step command.

Stepping through the instructions

Next, if you run the 'g' command, HyperDbg will normally continue the target debuggee process.

Continuing the target process

If you want to pause the debuggee and intercept the user running threads again, you can either use the 'pause' command or press CTRL+C.

Note that you should keep interacting with the process to force the process to run its codes in user-mode so HyperDbg will intercept more threads.

Pausing the target process

Finally, we can detach from the target process by using the '.detach' command.

Detaching from the target process

In this article, we've learned how to use the user debugger to attach to the target process. Please read the article here if you want to start a process and debug it from the entrypoint.

Last updated