When analyzing malware, I come across packers that inject the actual malware code into a newly spawned process and execute it that way. For that, they create a process in suspended state, inject the code and resume it using
ntdll.NtResumeThread on Windows.
I would like to attach to the suspended process after the injection is done, to dump the memory and get the unpacked binary. For that, I break at
ntdll.NtResumeThread. Using Olly 2, I can attach to the suspended process.
My problem is now that this seems to resume the process. That would be okay if it would break at the entry point. But it doesn't. Olly does not break until the process I attached to has terminated. Yes, I can dump the memory then. But only if it was not modified by the malware. Also, I don't want the malware code to run at all during unpacking.
So, is there a way to make Olly break (reliably) at the entry point of the new process?
Thanks in advance!