I want to attach OllyDbg or IDA to a process as soon as it is loaded in memory before a single instruction of it being executed. How do I do This??? I cant use File->Open for some reason. I can only attach to it.

  • "I cant use File->Open for some reason." -- What error message do you get when you try to use File->Open? Nov 22, 2014 at 18:14

1 Answer 1


One way to do is create a new process using CreateProcess with dwCreationFlags as CREATE_SUSPENDED. Next attach to the suspended process using your debugger, and resume all threads.

Some other way would be to edit the PE file and change the bytes at the entrypoint to EB FE. This is an instruction that jumps to itself, i.e. it is an infinite loop. Next start the application normally. Now use a debugger to attach to it. Restore the original bytes at the entrypoint and resume the process.

  • 2
    You can also do CC at the entry point which is int 3 and will ask if you want to debug. Nov 24, 2014 at 17:33
  • The second solution was great!!! It worked :)
    Nov 28, 2014 at 14:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.