I am using ollydbg and whenever i attach ollydbg to running process (in this case it's game and it has xtrap) this game terminates all threads and nothing is shown in olly . And when i use OllyAdvanced and when i attach olly into this proces then olly is stopping execution at ntdll.dll.DbgUiRemoteBreakin. Is there any plugin/way to fix that ?

  • "Is there any plugin/way to fix that ?" -- To fix what? Stopping execution at ntdll.dll!DbgUiRemoteBreakin is likely by-design. Apr 8 '15 at 17:26
  • I mean to stop in EP not in DbgUiRemoteBreakin.Btw this game has Themida also.
    – JMII89
    Apr 8 '15 at 17:28
  • There's nothing to fix. It's by-design. Apr 8 '15 at 18:26
  • What do you mean?....
    – JMII89
    Apr 8 '15 at 18:41

See http://index-of.es/Windows/dbgk-2.pdf

TL;DR -- When a debugger (OllyDbg in this scenario) calls DebugActiveProcess(), this results in a call to DbgUiDebugActiveProcess(), which calls DbgUiIssueRemoteBreakin(), which creates a new thread in the debuggee with entrypoint DbgUiRemoteBreakin().

So there's nothing that needs fixing. What you're seeing is the result of how Windows works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.