0

i am analyzing a piece of code in which the main thread does the following steps:

First, it calls CreateProcess() to create a a process in suspended state. Then it changes the starting address of the thread by using a combination of GetThreadContext & SetThreadContext. The new start address of the thread is now 00401E1D. And at the end, it calls ResumeThread() start the thread.

So, what I did was: I set a BP at ResumeThread(), let it run, after hitting the BP I step over the ResumeThread()-function and open the window where all threads are listed by clicking on the big "T"-button in Ollydbg.

But there is only the main thread, not the newly started thread. And now I have a couple of questions:

 1st question: Why it is not in the list ?

 2nd question: How can I find it?

 3th question: 
 In the main thread, I can not step to 00401E1D 
 (starting address of the new thread) because ollydbg somehow 
  terminates itself. Maybe there is some anti-debugging tricks or 
  things like that. I do not know, because I did not analyze it yet
  in detail. So, the question is: Is there a way to analyze the 
  new thread starting at 00401E1D in a separate ollydbg-session ?
  Is it possible ?

best regards,

Improve this question
2
  • The newly created thread is in another process - do you debug that one too? Also that technique is at least very similar to RunPE, so the usual techniques should apply.
    – user45891
    Mar 31, 2015 at 15:34
  • No, I have not debugged the other process. How can I do that?
    – user3097712
    Mar 31, 2015 at 15:38

1 Answer 1

Reset to default
2

In addition to creating the child process, CreateProcess() also causes the creation of the child process's primary thread. Your post makes it sound like the calls to GetThreadContext(), SetThreadContext(), and ResumeThread() all act on that primary thread.

1st question: Why it is not in the list ?

As you said in your post, you are seeing the process's main (primary) thread, on which the *Thread*() API functions above acted. No additional threads are created so you shouldn't expect to see additional threads in OllyDbg's view.

2nd question: How can I find it?

N/A

Is there a way to analyze the new thread starting at 00401E1D in a separate ollydbg-session ?

Yes -- check the "Debug child processes" checkbox in OllyDbg's options:

OllyDbg

Improve this answer
6
  • wow, what an answer. But which version of ollydbg do you use? I go to Options -> Debugging Options -> Events, but I have only the following options (see picture before your answer)
    – user3097712
    Mar 31, 2015 at 15:52
  • ollydbg.de/odbg201.zip
    – Jason Geffner
    Mar 31, 2015 at 15:53
  • ollydbg 1,10 does not have debug child process option if you want that options you can try using modified command line plugin (openrce downloads)
    – blabb
    Mar 31, 2015 at 19:36
  • ok, thank you. But first, i will try to work with ollydbg v2.01. Now, I have the following problem: when i open the sample with ollydbg v2.01, then I get the following message: "Debugged application has modified the debugging registers. Maybe it called ZwContinue() or SetDebugContext(). The modifications are saved to the log." . What does that mean? how can I solve this problem ?
    – user3097712
    Mar 31, 2015 at 22:20
  • That's a separate question for a separate post. One question per post, please.
    – Jason Geffner
    Apr 1, 2015 at 1:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.