Most of the time when a malware has injected itself into another process,it will call "SetThreadContext" to set the CONTEXT structure.You can easily get the "oep" of the target process through the "eax" member in the CONTEXT structure.The "oep" stands for the original address when target process resumes,you can make a loop at the "oep" so that the target process will always run in the loop.But how to make a loop in the"oep"?
A malware often call "WriteProcessMemory" to write codes into target process.The second parameter of "WriteProcessMemory" is "lpBaseAddress",it means where this codes begin in the target process.And the third parameter is "lpBuffer",it stands for the buffer contains this codes.
You can easily calculate the offset between "oep" and "lpBaseAddress",then, if the offset>0 as well as the offset< parameter "nSize",add the offset to "lpBuffer",you will get the address contains "oep" codes in the buffer.
For example, the "oep" of target process is 0x401000, the parameter "lpBaseAddress" is 0x400000,the parameter "lpBuffer" is 0x120000,so the address contains "oep" codes in the buffer is 0x401000-0x400000+0x120000=0x121000.
Then,you can change the instructions in the address contains "oep" to "jmp itself"(that is patching the first 2 bytes to EB FE).In the above example it's "jmp 0x121000".After calling "WriteProcessMemory" and "SetThreadContext",you will see codes run in a loop at the "oep" of target process because the instructions are changed to "jmp oep",in the above example it's "jmp 0x401000".the target process "stops".
Now you can attach it with OllyDbg and begin your work!
In some cases malware injects itself into target process using other ways such as Shared Sections, Atombombing.Now you may not find "WriteProcessMemory" in these cases,but you will find malware uses other ways to inject codes.So you can change the entry of codes injected into target process by patching the first 2 bytes to EB FE,the target process will run in a loop the same as what it does in first case.