how to attach to a process as soon as it is loaded in memory

Question

I want to attach OllyDbg or IDA to a process as soon as it is loaded in memory before a single instruction of it being executed. How do I do This??? I cant use File->Open for some reason. I can only attach to it.

Answer 1

One way to do is create a new process using CreateProcess with dwCreationFlags as CREATE_SUSPENDED. Next attach to the suspended process using your debugger, and resume all threads.

Some other way would be to edit the PE file and change the bytes at the entrypoint to EB FE. This is an instruction that jumps to itself, i.e. it is an infinite loop. Next start the application normally. Now use a debugger to attach to it. Restore the original bytes at the entrypoint and resume the process.