2

I was analyzing a sample and the function CreateRemoteThread is called with dwCreationFlag = 0, so the created thread starts immediately after creation. OllyDbg jumps to beginning of the new thread. I analyze the new thread and at the end of that, it calls RtlExitUserThread and the thread is terminated.

To visualize, you can consider the following:

  PUSH EAX                              ; dwCreationFlag = 0
     .
     .
     .
  CALL DWORD PTR SS:[EBP-28]           ; CreateRemoteThread
     .
  (lines which I would also like to analyze)

As I described, the new thread starts and it ends with a call to RtlExitUserThread but I would like to analyze the lines after the call to RtlExitUserThread.

How can I go back to the main thread, because there was a lot of lines to analyze (after the call to CreateRemoteThread)?

2

Right Click within the Disassembler window -> Select thread -> Click Main thread

Here is an image for reference. enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.