5

When analyzing malware, I come across packers that inject the actual malware code into a newly spawned process and execute it that way. For that, they create a process in suspended state, inject the code and resume it using ntdll.NtResumeThread on Windows.

I would like to attach to the suspended process after the injection is done, to dump the memory and get the unpacked binary. For that, I break at ntdll.NtResumeThread. Using Olly 2, I can attach to the suspended process.

My problem is now that this seems to resume the process. That would be okay if it would break at the entry point. But it doesn't. Olly does not break until the process I attached to has terminated. Yes, I can dump the memory then. But only if it was not modified by the malware. Also, I don't want the malware code to run at all during unpacking.

So, is there a way to make Olly break (reliably) at the entry point of the new process?

Thanks in advance!

  • 1
    Use a kernel debugger. I think what you're encountering is a limitation of the official debug API as well, though I cannot say whether OllyDbg uses that or its own homebrew method. – 0xC0000022L Jun 13 '14 at 17:28
  • I will try this as soon as I get around to test WinDbg :) – j0ker Jun 13 '14 at 17:45
  • 1
    @j0ker Here is a link I wrote a while back for breaking on the entry point of the hollowed/child process in Ollydbg. It should help. hooked-on-mnemonics.blogspot.com/2013/01/… – alexanderh Jun 13 '14 at 20:23
6

FYI, the injection method to which you're referring is called dynamic forking or process hollowing.

When you attach to the child process with OllyDbg, OllyDbg will create a new thread for itself, but the main thread (the one that would have been resumed with NtResumeThread() from the parent) will still be suspended. Once you've attached with OllyDbg, you can set a breakpoint on the OEP and resume the suspended thread; this will cause OllyDbg to then break at the OEP.

  • You are right. It didn't even occur to me to look for other threads. Thank you! – j0ker Jun 13 '14 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.