3.2 Attaching to an Existing Process Using IDA

The way you attach to a process depends on whether the program has already loaded or not. When a program has not loaded, select Debugger | Attach | Local Windows debugger. This will list all of the running processes. Simply select the process to attach to. After attaching, the process will be paused immediately, giving you the chance to inspect the process's resources and set breakpoints, prior to resuming execution of the process. In this method, IDA will not be able to perform its initial auto-analysis of the binary, because IDA's loader will not get a chance to load the executable image:

An alternate method of attaching to a process is loading the executable associated with a process into IDA before attaching to that process. To achieve this, load the associated executable using IDA; this allows IDA to perform its initial analysis. Then, select Debugger | Select debugger and check the Local Win32 debugger (or Local Windows debugger) option, and click OK. Then, select Debugger | Attach to process again, and choose the process to attach the debugger.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.17.184.90