-1

I have a PE executable which uses threads to handle most of its functionality. It uses CreateThread API to spawn local threads to handle functions.

enter image description here

The call to the CreateThread returns a valid handle value.

enter image description here

The problem is sometimes I don't see the thread getting created.

Or other times the thread gets created but none of the code that's specified at that thread's start address gets executed.(even though the thread is created with the dwCreationFlags parameter being set to 0)

What would the problem be?

P.S. I can't share the executable but I can provide more screenshots.

  • 3
    You are going to have to be far more specific. Ollydbg handles threads, so have you tried? What exactly is your question? – bravosierra99 Feb 18 '19 at 23:29
  • 1
    I edited the question to be as specific as I can – rustam Shirinov Feb 19 '19 at 16:16
3

you mean the thread doesn't run when you have single stepped out of the CreateThread() call ??

if yes then the Windows Scheduler hasn't yet found time to Schedule your Threads Code

you can confirm when the code is run by Setting breakpoint on the LP_THREAD_ROUTINE

Argument passed to CreateThread() probably be in R8D in your screenshot i think

the Threads Code Will run only when your existing thread (main ) has ceded control by Calling Any Of the Wait Functions

you can verify that with some code like this

here you create 5 threads but since you waste time in the loop and do not cede control to Windows Scheduler none of your Thread Routine is Executed until the WaitForMsg Function is called and your main thread goes idle waiting

#include <windows.h>
#include <stdio.h>
#define MAXT 5
DWORD WINAPI ThFunc( LPVOID parm ) {
    printf("Thread No %p\n" , parm);
    return 0;
}

int main (void) {
    DWORD   Tid[MAXT]   = {0};
    HANDLE  Thand[MAXT] = {0};
    int     Data[MAXT+1]  = {0};
    for(int i =0; i < MAXT; i++) {
        Data[i] = i;
    }
    for(int i=0;i<MAXT;i++) {
        Thand[i] = CreateThread(NULL,0,ThFunc,(LPVOID)Data[i],0,&Tid[i]);        
        if(Thand[i] == NULL) { ExitProcess(0); } else {
            printf ("wasting time not ceding control to ThreadRoutine\n");
            for(int j =0; j < 10; j++) {
                printf("%p\n" , Thand[i]);
            }        
        }
    }
    WaitForMultipleObjects(MAXT, Thand, TRUE, INFINITE);
    for (int i = 0; i< MAXT;i++) {
        CloseHandle(Thand[i]);
    }   
}

and the results are below you can see the Thread Routines are executed only after coming out of loop and waiting by the main thread

cthread.exe
wasting time not ceding control to ThreadRoutine
0000001C,0000001C,0000001C,0000001C,0000001C,0000001C
0000001C,0000001C,0000001C,0000001C
wasting time not ceding control to ThreadRoutine
00000020,00000020,00000020,00000020,00000020,00000020
00000020,00000020.00000020,00000020
wasting time not ceding control to ThreadRoutine
00000024,00000024,00000024,00000024,00000024,00000024
00000024,00000024,00000024,00000024
wasting time not ceding control to ThreadRoutine
00000028,00000028,00000028,00000028,00000028,00000028
00000028,00000028,,00000028,00000028
wasting time not ceding control to ThreadRoutine
0000002C,0000002C,0000002C,0000002C,0000002C,0000002C
0000002C,0000002C,0000002C,0000002C,Thread No 00000000
Thread No 00000001
Thread No 00000002
Thread No 00000003
Thread No 00000004
  • It seems like the problem was the WaitForSingleObject not being called :) – rustam Shirinov Feb 20 '19 at 11:04
0

I cannot tell specifically what your problem is (as is often the case with RE). Something I would recommend though is trying kernel debugging with Windbg. It's excellent because it has far more capability than ollydbg, albeit with a steeper learning curve.

Specifically you can have Windbg break on thread creation. No thread can begin without going through the operating system, and windbg catches that.

Note: you are going to need to set up kernel debugging with Windbg which means you will need a VM. You should probably be doing your dynamic analysis in a VM anyways...

SXE ct

https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/controlling-exceptions-and-events

Not the answer you're looking for? Browse other questions tagged or ask your own question.