Ollydbg 2: Breaking after attaching to a suspended process

Question

When analyzing malware, I come across packers that inject the actual malware code into a newly spawned process and execute it that way. For that, they create a process in suspended state, inject the code and resume it using ntdll.NtResumeThread on Windows.

I would like to attach to the suspended process after the injection is done, to dump the memory and get the unpacked binary. For that, I break at ntdll.NtResumeThread. Using Olly 2, I can attach to the suspended process.

My problem is now that this seems to resume the process. That would be okay if it would break at the entry point. But it doesn't. Olly does not break until the process I attached to has terminated. Yes, I can dump the memory then. But only if it was not modified by the malware. Also, I don't want the malware code to run at all during unpacking.

So, is there a way to make Olly break (reliably) at the entry point of the new process?

Thanks in advance!

Answer 1

FYI, the injection method to which you're referring is called dynamic forking or process hollowing.

When you attach to the child process with OllyDbg, OllyDbg will create a new thread for itself, but the main thread (the one that would have been resumed with NtResumeThread() from the parent) will still be suspended. Once you've attached with OllyDbg, you can set a breakpoint on the OEP and resume the suspended thread; this will cause OllyDbg to then break at the OEP.