Learning Malware Analysis

1.1 Launching And Attaching To Processes

Debugging normally begins by selecting the program to debug. There are two ways to debug a program: (a) attach the debugger to a running process, and (b) launch a new process. When you attach the debugger to a running process, you will not be able to control or monitor the process's initial actions, because by the time you have a chance to attach to the process, all of its startup and initialization code will have already been executed. When you attach the debugger to a process, the debugger suspends the process, giving you a chance to inspect the process's resources or set a breakpoint before resuming the process.

On the other hand, launching a new process allows you to monitor or debug every action ...