My goal is to see what's going on "under the hood" in the Windows command prompt when a user pastes text into it. So I loaded
cmd.exe into IDA Pro that is set up in conjunction with the WinDbg debugger.
My initial guess was to put a breakpoint on OpenClipboard API which must be used to access clipboard, but it seems like cmd.exe doesn't even have a dependency on
User32.dll (where OpenClipboard comes from):
So am I reading it correctly?
PS. I'm doing this on Windows 10.
EDIT: You know, there's something other than deferred loading. I let the
cmd.exe initialize and begin running, after which I suspended it. The loaded modules list still didn't have
and my deferred breakpoint didn't trigger upon clipboard operation either:
Could there be some other process that does all the "command line" logic?
EDIT 2: Just tried to attach to a running
while IDA Pro was running as administrator and got this error:
EDIT 3: Just tried to attach to
conhost.exe via just WinDbg itself and got this error. I'm not sure how
NTSTATUS 0xC00000BB applies here: