I was analyzing a sample and the function
CreateRemoteThread is called with
dwCreationFlag = 0, so the created thread starts immediately after creation.
OllyDbg jumps to beginning of the new thread. I analyze the new thread and at the end of that, it calls
RtlExitUserThread and the thread is terminated.
To visualize, you can consider the following:
PUSH EAX ; dwCreationFlag = 0 . . . CALL DWORD PTR SS:[EBP-28] ; CreateRemoteThread . (lines which I would also like to analyze)
As I described, the new thread starts and it ends with a call to
RtlExitUserThread but I would like to analyze the lines after the call to
How can I go back to the main thread, because there was a lot of lines to analyze (after the call to