Skip to main content
2 of 2
Added punctuation
asheeshr
  • 2.5k
  • 8
  • 28
  • 41

You can attach to the process non invasive and use !chkimg !chkallimg !chksym commands.

Look for non invasive check box in the attach to process dialog in windbg or use .attach -v "pid"

Attaching in a non invasive way minimizes debugger interference and in most cases will not trigger the anti-debugging routines.

blabb
  • 1.3k
  • 9
  • 11