Switch to New Process Layout
Methods to switch to the target process's memory layout (CR3)
Last updated
Methods to switch to the target process's memory layout (CR3)
Last updated
HyperDbg has a design caveat of not relying on GUEST_CR3 after the meltdown patch so we'll ignore modifying cr3 on the debugger vmx-root side.
A patch to solve this problem is available but as it's an essential functionality in HyperDbg, we leave it for future versions with more tests.
When you want to switch to a new process using the '' command, sometimes Windows will not load the target process in the running stage of Windows. Thus, it won't break again, and you won't end up in the target process.
This is since Windows might halt or suspend the process or threads of the target process are in a waiting state. So, Windows won't assign a CPU time slice to these processes.
In these cases, we can attach to the memory layout of these processes without switching to them.
For this purpose, we use the .process list command to find the Directory Base or Kernel Cr3 of these processes.
We find our target process. As you can see in the above example, our target process is svchost.exe, and the process Id is 3e8.
Done! Now we're in the memory layout of the target process, and whatever script or command you use is applied to the target process memory.
Note that we didn't switch to the target process, and if you query for $pid you'll see the $pid of the wrong process, but in reality, we're in the target process memory.
Now, we can switch to the target process using the '' command. We'll change the current CR3 register to the target processes' DirBase (Kernel Cr3), which is 20e98e002 in this case.