I was analyzing a sample and the function CreateRemoteThread
is called with dwCreationFlag = 0
, so the created thread starts immediately after creation.
OllyDbg jumps to beginning of the new thread. I analyze the new thread and at the end of that, it calls RtlExitUserThread
and the thread is terminated.
To visualize, you can consider the following:
PUSH EAX ; dwCreationFlag = 0
.
.
.
CALL DWORD PTR SS:[EBP-28] ; CreateRemoteThread
.
(lines which I would also like to analyze)
As I described, the new thread starts and it ends with a call to RtlExitUserThread
but I would like to analyze the lines after the call to RtlExitUserThread
.
How can I go back to the main thread, because there was a lot of lines to analyze (after the call to CreateRemoteThread
)?