I have a PE executable which uses threads to handle most of its functionality. It uses CreateThread API to spawn local threads to handle functions.

enter image description here

The call to the CreateThread returns a valid handle value.

enter image description here

The problem is sometimes I don't see the thread getting created.

Or other times the thread gets created but none of the code that's specified at that thread's start address gets executed.(even though the thread is created with the dwCreationFlags parameter being set to 0)

What would the problem be?

P.S. I can't share the executable but I can provide more screenshots.

  • 3
    You are going to have to be far more specific. Ollydbg handles threads, so have you tried? What exactly is your question? Feb 18, 2019 at 23:29
  • 1
    I edited the question to be as specific as I can Feb 19, 2019 at 16:16

2 Answers 2


you mean the thread doesn't run when you have single stepped out of the CreateThread() call ??

if yes then the Windows Scheduler hasn't yet found time to Schedule your Threads Code

you can confirm when the code is run by Setting breakpoint on the LP_THREAD_ROUTINE

Argument passed to CreateThread() probably be in R8D in your screenshot i think

the Threads Code Will run only when your existing thread (main ) has ceded control by Calling Any Of the Wait Functions

you can verify that with some code like this

here you create 5 threads but since you waste time in the loop and do not cede control to Windows Scheduler none of your Thread Routine is Executed until the WaitForMsg Function is called and your main thread goes idle waiting

#include <windows.h>
#include <stdio.h>
#define MAXT 5
    printf("Thread No %p\n" , parm);
    return 0;

int main (void) {
    DWORD   Tid[MAXT]   = {0};
    HANDLE  Thand[MAXT] = {0};
    int     Data[MAXT+1]  = {0};
    for(int i =0; i < MAXT; i++) {
        Data[i] = i;
    for(int i=0;i<MAXT;i++) {
        Thand[i] = CreateThread(NULL,0,ThFunc,(LPVOID)Data[i],0,&Tid[i]);        
        if(Thand[i] == NULL) { ExitProcess(0); } else {
            printf ("wasting time not ceding control to ThreadRoutine\n");
            for(int j =0; j < 10; j++) {
                printf("%p\n" , Thand[i]);
    WaitForMultipleObjects(MAXT, Thand, TRUE, INFINITE);
    for (int i = 0; i< MAXT;i++) {

and the results are below you can see the Thread Routines are executed only after coming out of loop and waiting by the main thread

wasting time not ceding control to ThreadRoutine
wasting time not ceding control to ThreadRoutine
wasting time not ceding control to ThreadRoutine
wasting time not ceding control to ThreadRoutine
wasting time not ceding control to ThreadRoutine
0000002C,0000002C,0000002C,0000002C,Thread No 00000000
Thread No 00000001
Thread No 00000002
Thread No 00000003
Thread No 00000004
  • It seems like the problem was the WaitForSingleObject not being called :) Feb 20, 2019 at 11:04

I cannot tell specifically what your problem is (as is often the case with RE). Something I would recommend though is trying kernel debugging with Windbg. It's excellent because it has far more capability than ollydbg, albeit with a steeper learning curve.

Specifically you can have Windbg break on thread creation. No thread can begin without going through the operating system, and windbg catches that.

Note: you are going to need to set up kernel debugging with Windbg which means you will need a VM. You should probably be doing your dynamic analysis in a VM anyways...

SXE ct


Not the answer you're looking for? Browse other questions tagged or ask your own question.