2.8.2 Debugging a DLL in a Specific Process

Sometimes, you may want to debug a DLL that only runs in a specific process (such as explorer.exe). The procedure is similar to the one covered in the previous section. First, launch the process or attach to the desired host process using x64dbg; this will pause the debugger. Allow the process to run by selecting Debug | Run (F9). Next, select the Breakpoints tab, right-click inside the Breakpoints window, and select the Add DLL breakpoint option, which will bring up a dialog window prompting you to enter the module name. Enter the DLL name (as covered in the previous section); this will tell the debugger to break when the DLL is loaded. Now, you need to inject the DLL into the host process. This can be done using a tool like RemoteDLL (https://securityxploded.com/remotedll.php). When the DLL is loaded, the debugger will pause somewhere in ntdll.dll; just hit Run (F9) till you reach the entry point of the injected DLL (you might have to run multiple times before you reach the entry point). You can keep track of where the execution has paused every time you hit Run (F9) by looking at the comment next to the breakpoint address or next to the eip register, as mentioned in the previous section.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.133.156.156