How to fix anti-debugger with DbgUiRemoteBreakin

Question

I have windows application that I want to debug.

When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint

when I press Play I see

thread ... terminated , exit code 0.

I looking for anti -debug function , so I looking for DbgUiRemoteBreakin ,and I found it.

I see that this function is

push 8 
...
...
..
call ntdll.DbgBreakPoint
.....

I tried to find what this function do so I mark the first line of function (push 8) and I press play, I saw that ollydbg stop on line cmp Byte ptr....

What can I do to fix this anti-debug?

Answer 1

This is not anti-debug but the standard way the Win32 debugging API implements process attaching. The thread with DbgBreakPoint call is injected by the OS to ensure that the process gets stopped, since it could be in unknown state otherwise. Most debuggers should handle it transparently, but if yours does not, just set breakpoints on some APIs you’re interested in and resume the process. The breakpoint thread will exit but the other threads will continue to run and will hopefully hit your breakpoints. Alternatively you can just switch to main or another thread once paused, and inspect the call stack to see what the program is doing.