In IDA pro, there is an option to attach to a process using the WinDbg backend.
When I want is to see the process' control flow when the IDA attaches to it.
The only way (that I know) to see the process' flow is to put a breakpoint in a place that I think the process will hit and single-step from there (F8).
If I don't know a place in the process where I can put a breakpoint, then I can't single-step.
How to see the process flow in assembly? hot to breakPoint and debug process that ida attached it?
If I click on suspend(there is not an option named pause) I see that process breaks inside of ntdll rtUserThreadStart
. From there, I can't see where the process was before I clicked suspend.
ntdll rtUserThreadStart
, and I looking for the last place in assembly before the assembly jump tontdll rtUserThreadStart
– pointers Jul 30 '18 at 13:32