Learning Malware Analysis

3.2 Attaching to an Existing Process Using IDA

The way you attach to a process depends on whether the program has already loaded or not. When a program has not loaded, select Debugger | Attach | Local Windows debugger. This will list all of the running processes. Simply select the process to attach to. After attaching, the process will be paused immediately, giving you the chance to inspect the process's resources and set breakpoints, prior to resuming execution of the process. In this method, IDA will not be able to perform its initial auto-analysis of the binary, because IDA's loader will not get a chance to load the executable image: