Switching to a Specific Process or Thread
Using the '.process', and the '.thread' commands
Switching to new processes/threads is useful when debugging a particular process or a user-mode application. These switchings are possible through the '.process' and '.thread' commands.
In HyperDbg, there are different implementations of these switchings. You can read more about these differences here.
In this example, we walk through a C code to show how to use these commands.
Imagine we compiled the following program. It's an infinite loop that prints a counter every 1000000000 times.
1
#include <Windows.h>
2
#include <conio.h>
3
#include <iostream>
4
5
int main() {
6
7
bool Test = true;
8
UINT64 Counter = 0;
9
10
while (Test) {
11
12
if (Counter % 1000000000 == 0) {
13
printf("Thread is running (%lld)...\n", Counter);
14
}
15
Counter++;
16
}
17
18
printf("Thread is closed!\n");
19
_getch();
20
}
Copied!
After compiling and running the above code, we use the command shown in the picture to view the list of processes and other information about the processes running in the system.
1
3: kHyperDbg> .process list
Copied!
View process list
We find our target program which its name is "Test.exe". Then, we see a list of running threads based on this process. For this purpose, we used the process object address (nt!_EPROCESS).
1
3: kHyperDbg> .thread list process ffff948cc16c3080
Copied!
View list of threads of a process
Now, we can switch to the target thread and continue the debuggee. Whenever the system reaches the target thread, it will be halted again and run new commands.
Note that it's a 32-bit program, so we use the 'u2', which is the 32-bit version of the disassembler in this case.
1
3: kHyperDbg> .thread tid b10
Copied!
Switch to a new thread
After analyzing the program, we find the jumps in the assembly code. You can also see the calls that are probably a link to the printf function.
1
2: kHyperDbg> u2 00e249f6
Copied!
Disassemble the target thread
Then, we step through the instructions to better understand how this program works.
Step through the instructions
After some investigation, we can conclude that the guilty jump is located at 0xe24a31, so we'll modify the memory and patch it by using nop instructions(0x90).
1
2: kHyperDbg> eb 00e24a31 90 90
Copied!
Patch the program's execution flow
If we continue the debuggee again, you can see that the patched program jumps out of the infinite loop and show the 'thread is closed!' message.
The result of patched program
It was a simple example of how to use thread and process switching commands in HyperDbg. You can think about different approaches that you can use to change the program's execution flow (like changing the RFLAGS, etc.) or analyze any other programs.
Copy link
Edit on GitHub