How to breakpoint atached process with ida when move on

Question

In IDA pro, there is an option to attach to a process using the WinDbg backend.

When I want is to see the process' control flow when the IDA attaches to it.

The only way (that I know) to see the process' flow is to put a breakpoint in a place that I think the process will hit and single-step from there (F8).

If I don't know a place in the process where I can put a breakpoint, then I can't single-step.

How to see the process flow in assembly? hot to breakPoint and debug process that ida attached it?

If I click on suspend(there is not an option named pause) I see that process breaks inside of ntdll rtUserThreadStart. From there, I can't see where the process was before I clicked suspend.

Answer 1

This happens due to way the Win32 debugging API implements process attaching. A new thread with DbgBreakPoint call is injected by the OS to ensure that the process gets stopped, since it could be in unknown state otherwise, and this thread is what you see.

What you can do is inspect the thread list, switch to the main one (usually first in the list), set some breakpoints up in the call stack and resume the process - the debugbreak thread will exit and your process should stop on the breakpoint so you can debug it.

You can also try this approach by blabb.