reverse engineering - How to Debug a Process Launched by Another Application with IDA - Stack Overflow

admin管理员组

文章数量:1291603

I'm learning reverse engineering with IDA Pro and debugging a launcher application (start.exe) that launches another executable (main.exe).

start.exe takes two inputs (call them X and Y), processes them, and then creates the main.exe process and stops/kills start.exe.

I'm having trouble debugging main.exe because it launches too quickly for me to attach to it in IDA.

Is there a way to intercept the CreateProcess call (or similar) within start.exe so I can attach to main.exe before it starts executing, or automatically debug the new process?

I'm learning reverse engineering with IDA Pro and debugging a launcher application (start.exe) that launches another executable (main.exe).

start.exe takes two inputs (call them X and Y), processes them, and then creates the main.exe process and stops/kills start.exe.

I'm having trouble debugging main.exe because it launches too quickly for me to attach to it in IDA.

Is there a way to intercept the CreateProcess call (or similar) within start.exe so I can attach to main.exe before it starts executing, or automatically debug the new process?

• reverse-engineering
• disassembly
• ida

Share Improve this question Follow asked Feb 13 at 14:19 BadProgrammerBadProgrammer 11599 bronze badges 1

• Have you tried directly executing main.exw from withing IDA? The start.exe part can often be omitted. – Robert Commented Feb 15 at 23:24

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 0

You can start the process from within IDA, first load the binary ( exe ) into IDA ( File -> Open, or select on the IDA's start menu ), then select a debugger, "Local Windows Debugger" will work fine. After which you can click the green Play Icon.

Selecting a Debugger

Starting the debugger

After which, IDA automatically breaks at the first function call. You can set the breakpoints even before starting the debugger.

本文标签： reverse engineeringHow to Debug a Process Launched by Another Application with IDAStack Overflow