How to use dnSpyEx or some other .NET debugger to attach to a .NET process started with a process-hollowing technique?

Question

I have a .NET executable that is started using the process-hollowing technique. Here's how it looks from the Detect-It-Easy tool:

I can open the image file for that process (from disk) with dnSpyEx, but when I try to attach to it with a debugger while it's running (after it was process-hollowed), my breakpoints don't hit:

Any idea how to attach to such process with a debugger - dnSpy or some other one?

Answer 1

You can insert an infinite loop in the code that you can find once you attach to the process.

1. Right click the method you want to put a breakpoint on and select Edit Method.
2. Add an infinite loop inside an if before the code where you wanted to put the breakpoint: bool a = true;if(a){while(true){}}. Click Compile.
3. Save module.
4. Run the sample as desired.
5. Attach to the process with DnSpy (you may need to run it as admin) and pause (Break all) the debugger, which will stop at the infinite loop.
6. The instruction where you wanted to put the breakpoint is the first after the else. Right click this instruction and select Set Next Statement.

---

This is similar to the EBFE technique.

Note that the definition of bool a = true; and the if surrounding the while(true) is needed to trick the debugger to avoid that compilation remove the rest of the code. If the compiler is still able to remove it, you can try a bit more difficult condition to trick the debugger such as int a = 3; int b = 2; if(a*2-b+1==5){while(true){}};