Learning Malware Analysis

2.8.2 Debugging a DLL in a Specific Process

Sometimes, you may want to debug a DLL that only runs in a specific process (such as explorer.exe). The procedure is similar to the one covered in the previous section. First, launch the process or attach to the desired host process using x64dbg; this will pause the debugger. Allow the process to run by selecting Debug | Run (F9). Next, select the Breakpoints tab, right-click inside the Breakpoints window, and select the Add DLL breakpoint option, which will bring up a dialog window prompting you to enter the module name. Enter the DLL name (as covered in the previous section); this will tell the debugger to break when the DLL is loaded. Now, you need to inject the DLL into the host process. This ...