Is it possible to attach ProcessMonitor to an already running target process on Windows? #674
-
|
Hi all, is it possible to attach ProcessMonitor to an already running target process on Windows or do I need to start the process with the ProcessMonitor to be able to attach to it? Best regards |
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 4 replies
-
|
No, the "DebuggerThreadSimple" class does not support that behaviour - if you provide it with a process name as well as a start command, it will always attempt to first start a new target instance as opposed to looking for an existing process to attach to. As another shameless plug, I've developed my own debugger thread here, which allows you to do that however. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you very much for your fast reply! I will definitely try it. |
Beta Was this translation helpful? Give feedback.
-
|
I've personally been pretty busy lately and just haven't yet had the chance to do the pull request. It would be an impactful change to boofuzz as well, though, since it would be pulling in a new dependency to vivisect. |
Beta Was this translation helpful? Give feedback.
-
|
I see! Thank you for implementing this feature that fast. |
Beta Was this translation helpful? Give feedback.
-
|
Another problem I am stumbling upon is that the process I am monitoring is part of a software framework running multiple processes. Somewhere in this framework there seems to be a watchdog, always restarting the target service as soon as it is stopped. Do you have an idea how to continuously look out for that process being spawned by the framework instead of spawning it with the ProcessMonitor after a crash? |
Beta Was this translation helpful? Give feedback.
-
|
If you're using my vtrace thread, you can use the "auto_restart_timeout" option to specify how many seconds the thread should wait after a crash before it starts to look for the new instance started by your framework. You also wouldn't need to supply a "start_command" in this case. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you very much, I will try it and I really appreciate your help! |
Beta Was this translation helpful? Give feedback.
No, the "DebuggerThreadSimple" class does not support that behaviour - if you provide it with a process name as well as a start command, it will always attempt to first start a new target instance as opposed to looking for an existing process to attach to.
As another shameless plug, I've developed my own debugger thread here, which allows you to do that however.