Switch to New Process Layout
Methods to switch to the target process's memory layout (CR3)
When you want to switch to a new process using the '.process' command, sometimes Windows will not load the target process in the running stage of Windows. Thus, it won't break again, and you won't end up in the target process.
This is since Windows might halt or suspend the process or threads of the target process are in a waiting state. So, Windows won't assign a CPU time slice to these processes.
In these cases, we can attach to the memory layout of these processes without switching to them.
For this purpose, we use the
.process listcommand to find the Directory Base or Kernel Cr3 of these processes.
2: kHyperDbg> .process list
Process Id: 0004 DirBase (Kernel Cr3): 00000000001aa002 Image: System
Process Id: 006c DirBase (Kernel Cr3): 0000000000263002 Image: Registry
Process Id: 03e8 DirBase (Kernel Cr3): 000000020e98e002 Image: svchost.exe
We find our target process. As you can see in the above example, our target process is svchost.exe, and the process Id is 3e8.
2: kHyperDbg> r cr3=20e98e002
Done! Now we're in the memory layout of the target process, and whatever script or command you use is applied to the target process memory.
Note that we didn't switch to the target process, and if you query for
$pidyou'll see the
$pidof the wrong process, but in reality, we're in the target process memory.