i am analyzing a piece of code in which the main thread does the following steps:
First, it calls CreateProcess() to create a a process in suspended state. Then it changes the starting address of the thread by using a combination of GetThreadContext & SetThreadContext. The new start address of the thread is now 00401E1D. And at the end, it calls ResumeThread() start the thread.
So, what I did was: I set a BP at ResumeThread(), let it run, after hitting the BP I step over the ResumeThread()-function and open the window where all threads are listed by clicking on the big "T"-button in Ollydbg.
But there is only the main thread, not the newly started thread. And now I have a couple of questions:
1st question: Why it is not in the list ?
2nd question: How can I find it?
3th question:
In the main thread, I can not step to 00401E1D
(starting address of the new thread) because ollydbg somehow
terminates itself. Maybe there is some anti-debugging tricks or
things like that. I do not know, because I did not analyze it yet
in detail. So, the question is: Is there a way to analyze the
new thread starting at 00401E1D in a separate ollydbg-session ?
Is it possible ?
best regards,