1.1 Launching And Attaching To Process

Debugging normally begins by selecting the program to debug. There are two ways to debug a program: (a) attach the debugger to a running process, and (b) launch a new process. When you attach the debugger to a running process, you will not be able to control or monitor the process's initial actions, because by the time you have a chance to attach to the process, all of its startup and initialization code will have already been executed. When you attach the debugger to a process, the debugger suspends the process, giving you a chance to inspect the process's resources or set a breakpoint before resuming the process.

On the other hand, launching a new process allows you to monitor or debug every action the process takes, and you will also be able to monitor the process's initial actions. When you start the debugger, the original binary will be executed with the privileges of the user running the debugger. When the process is launched under a debugger, the execution will pause at the program's entry point. A program's entry point is the address of the first instruction that will be executed. In later sections, you will learn how to launch and attach to a process using IDA Pro, x64dbg, and dnSpy.

A program's entry point is not necessarily the main or WinMain function; before transferring control to main or WinMain, the initialization routine (startup routine) is executed. The purpose of the startup routine is to initialize the program's environment before passing control to the main function. This initialization is designated, by the debuggers, as the entry point of the program.