In an effort to learn vtrace I've been trying to attach to a process and hook the import address table and then resume the main thread of a process. When I don't attach to the process the ResumeThread() call works fine. But when I do it spins up a thread then the call to ResumeThread() doesn't work and the main thread never runs. Below is the code...
from ctypes import * from ctypes import wintypes from defines import * import vdb import vtrace import sys from iathook import * class PROCESS_INFORMATION(ctypes.Structure): _fields_ = [ ("hProcess", HANDLE), ("hThread", HANDLE), ("dwProcessId", DWORD), ("dwThreadId", DWORD), ] process_info = PROCESS_INFORMATION() kernel32 = ctypes.WinDLL('kernel32.dll') bCreateProcessW = kernel32.CreateProcessA( path_to_binary, None, None, None, True, creation_flags, None, None, byref(startupinfo), byref(process_info)) #launched the process in a suspended state and patch it using DLL injection #but this code doesn't effect the following code apptrace = vtrace.getTrace() apptrace.attach(process_info.dwProcessId) #1 hookSomeStuff = hookIat(apptrace, 'MSVCR110') #2 #apptrace.resumeThread(process_info.hThread) #3 dwPrevSuspendCount = kernel32.ResumeThread(process_info.hThread)
As I mentioned above when I remove the
vtrace attach and and
hookIat stuff (line #1 & #2). The ResumeThread() call works fine and the main thread runs. I also tried resuming the thread using the vtrace method (line #3) but it tells me that the thread is not suspended. The main thread doesn't actually run so I wonder how it could not be suspended or what happened to it. I also check the events of the binary using procmon and when it attaches it spins up another thread and that seems to throw things off. This may seem awkward and I understand there are many other ways to do this but I'm using it as a learning exercise and now I'm interested why it's not working. Any help is appreciated and thanks in advance for any help.