In the previous video, we have seen how to detect if the product is attached to debugger or not.
In this video we'll be seeing the debugger is present, will be detaching from the process.
We can use the function currently remote process and it is in that A.L..
And the first parameter is the process handle and the pyramid is the big object.
So we already get in the process and so we need to get this debug of your tenders.
So you're going to get these.
By passing the process, people can do the process, decode information process.
So in the previous video we have posted is priceless basic information.
And you should know that we will be passing this direct one that is that people tend to.
And there is some slight difference in the signature of the function we need to pass by the reference.
So you need to copy this and paste this and change this one by reference.
So this is like function already.
Same function and different parameters.
So no, I it is a normal previous program that's going to run this one and we can see that this president
now we are going to get the debugger object handler so this will be stored in debug candidate is equal
to inferior dot zero.
Now we need to get the candidate using the antiquated information process.
So the first one is the proper candidate will be passing the current process.
And you can also open the handle for the process using the body.
You can pass that as well.
And second parameter is the direct money.
That is the representation of that enum positive object, kind of constant and third parameter use.
Debugger and reference debugger handle.
And the fourth parameter is the length.
So that will be the eight depending upon architectural file type or the process.
I am comparing this first 60.
We saw the.
Addresses will be a.
And the last one is the.
Equals to zero.
And with passing reference out.
And we are going to print this debug handle.
And we can see we are the people.
And now we are calling this function and be more brothers.
I have already written the signature is just simple blue handles.
Now pass this process and it and second one is our debug handle and it's a result.
So this would return to zero if the success.
So that's 33 questions equals zero.
That means.
Successfully.
That should be good.
And now we can query.
This is the present.
So let's go and rent this one.
And here you can see we get the files.
At first we got the debugger is present because we are running in the debugger and that were running
this process.
And after getting the handle we called this and debug and after the functional decoded the process became
independent and.
We can see the forest value is deeper in forests.
Now we can also see here we can put into some lines.
It's being one.
And down rent testing boot.
So what I'm going to do is.
I'm going to.
Sample one.
I'm going to put the breakpoint at this one.
So I am putting the breakpoint at this one.
So let's go on this one.
And here we can see we did not put into this report.
So let's go and step into this and we can see that we will handle.
Now we are going to remove this detached from this process.
That means whenever this function was executed, the process continues execution.
Because it is it became independent, original.
Now, if I go and step in boot, now I can see the print segments and sample one and success.
And remaining pretty statements.
So that's going to win, too.
And now we can see the the print statements have been executed, even though we have stopped only once
because the brothers became independent.
So we successfully debated the democracy and the process.
So whenever you go and click on Stop, this will go in Internet routing.
So you need to close this process.
So the zip code will be zero.
And then our research area becomes normal.
So this is how you that were go to fund the process using the entire remote process debug function.