5

I have a .NET executable that is started using the process-hollowing technique. Here's how it looks from the Detect-It-Easy tool:

enter image description here

I can open the image file for that process (from disk) with dnSpyEx, but when I try to attach to it with a debugger while it's running (after it was process-hollowed), my breakpoints don't hit:

enter image description here

Any idea how to attach to such process with a debugger - dnSpy or some other one?

1 Answer 1

3

You can insert an infinite loop in the code that you can find once you attach to the process.

  1. Right click the method you want to put a breakpoint on and select Edit Method. enter image description here
  2. Add an infinite loop inside an if before the code where you wanted to put the breakpoint: bool a = true;if(a){while(true){}}. Click Compile.
  3. Save module.
  4. Run the sample as desired.
  5. Attach to the process with DnSpy (you may need to run it as admin) and pause (Break all) the debugger, which will stop at the infinite loop.
  6. The instruction where you wanted to put the breakpoint is the first after the else. Right click this instruction and select Set Next Statement. enter image description here

This is similar to the EBFE technique.

Note that the definition of bool a = true; and the if surrounding the while(true) is needed to trick the debugger to avoid that compilation remove the rest of the code. If the compiler is still able to remove it, you can try a bit more difficult condition to trick the debugger such as int a = 3; int b = 2; if(a*2-b+1==5){while(true){}};

3
  • Hmm, that's an interesting idea. But how would I insert my code into it if my breakpoints don't hit? See that second screenshot.
    – c00000fd
    Jan 25, 2023 at 12:29
  • You need to insert the code before the sample is run. Note running the sample is step 4. Jan 25, 2023 at 12:36
  • Thanks. That's an interesting technique. I tried it, but step 5 doesn't produce the result that you described. The dnSpy breaks but then it doesn't switch to the source code line. And even if I click "Show next statement", nothing happens. My guess is that it can't find symbols.
    – c00000fd
    Jan 25, 2023 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.