Is it possible to switch between debuggers and preserve where you are paused? Often times I find myself wanting to use a feature from a different debugger while paused in a specific context as each of them have their strengths (IDA has source level stepping, x32dbg has excellent patching, call stacks and easy to use hardware breakpoints, Visual Studio can cast memory to C++ structs in the Watch window). Some are more useful in getting to a destination than others. Is there any kind of software available that enables this feature?
Yes, this is possible with some cooperation from the debugger. The OllyMigrate plugin supports migration between following debuggers:
- Immunity Debugger
- IDA Pro/Freeware
It seems Visual Studio is not supported but you can always do it the manual way:
- Patch an infinite loop (
EB FE) at the current EIP/RIP;
- Detach the current debugger. The program will be stuck in the infinite loop;
- Attach with the new debugger;
- Restore the patched bytes and continue debugging.
Note: I'm not sure this is the approach used by OllyMigrate. Possibly it uses some kind of handle passing from one debugger to another. Unfortunately the source code is not available.