1

I'm, using OllyDbg 1.1 to debug some malware and it's been quite a while since I've dealt with wininet calls. When I set a software or hardware breakpoint directly after the call to wininet.HttpSendRequestW the breakpoint never hits and it seems like the malware hangs.

I've also verified that I can reach the internet and the resource that is involved in the HttpSendRequestW call. What's the trick to allowing a step-over on these wininet functions?

1
  • Can you share this malware ? I want analyze why happens this. Apr 15 '20 at 22:30
0

Check if the program calls InternetSetStatusCallback which allows setting a callback to be called during different stages of the connection.

Possibly the callback performs the actual work, or it detects the debugger and hangs without returning to the caller.

1
  • Unfortunately it doesn't. I worked around the issue by providing the data directly and skipping the call to HttpSendRequest but that's not really a good solution and doesn't help me understand why it's happening
    – vane
    Sep 24 '18 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.