Questions tagged [thread]

Smallest sequence of instructions that can be managed independently by an operating system scheduler. Threads share all the same memory-space layout within the same process.

Filter by
Sorted by
Tagged with
3 votes
0 answers
42 views

Can I get thread counts remotely with Immunity Debugger

I am debugging a program on a Windows server with Immunity debugger. Immunity debugger offers a remote command line client. I can do basic tasks through this command line. But is there a way to get ...
Bob5421's user avatar
  • 797
2 votes
0 answers
28 views

Multi Thread communication disassembly

is there any article or guide when it comes to reverse engineering Multi-Threaded processe?
asdfs99's user avatar
  • 41
1 vote
1 answer
508 views

Make Ghidra recognize thread-local variables

I am trying to reverse an ELF binary that makes use of thread-local variables. I can't figure out how to make Ghidra display them in a friendlier way (something like declaring a struct or similar). ...
Marco's user avatar
  • 89
2 votes
1 answer
1k views

How to get thread start address in Windows?

I'm writing thread finder in module. My goal is find all threads in process and find threads currently working address locations. Like image on below. I do this goal with NtQueryInformationThread API. ...
Crazy Programmer's user avatar
0 votes
1 answer
59 views

How to force a program to run as monothread for dynamic analysis?

I'm reversing a program with x64dbg and ida (I switched from ghidra), hence disassembled and decompiled, I need to understand what is happening with dynamic analysis, but I have a tricky part where ...
Soleil's user avatar
  • 123
2 votes
0 answers
108 views

Ways of creating a new thread on Windows

I'd like to know about every possible way how a thread can be created in a process at the lowest possible level. There are loads of WinAPI-s to create a thread, but as far as I know all of them ends ...
original.roland's user avatar
0 votes
0 answers
296 views

Watching a TLS Slot value in x64dbg

I am new to reverse engineering and I was trying to debug why a 3rd party application was crashing when I m injecting my DLL in it. (There are some cases where it didn't crash) So I was able to figure ...
Ashutosh Raina's user avatar
0 votes
1 answer
204 views

Debugging Encrypted Malware with Multiple Threads

What is the best approach when debugging a multithreaded program that is yet to be encrypted? Where is the best place to put Breakpoints using Ollydbg?
erabe's user avatar
  • 3
1 vote
0 answers
133 views

Debug only one thread with ida-gdb server

If I want to debug process in embedded that running linux , I can run gdb-server in embedded and attach to process with Ida. The problem is if this process has 1 thread that can't stop over than x ...
Meryy's user avatar
  • 21
1 vote
0 answers
266 views

How does Ida suspend threads?

I know that Ida uses ptrace function to attach and debug process. How Ida can suspend thread? how is that possible?
pointers's user avatar
-1 votes
2 answers
1k views

CreateThread returns true but thread doesn't run [closed]

I have a PE executable which uses threads to handle most of its functionality. It uses CreateThread API to spawn local threads to handle functions. The call to the CreateThread returns a valid handle ...
rustam Shirinov's user avatar
4 votes
1 answer
5k views

Thread EntryPoint in TLS callback as AntiDebug technique

I came across a document called The Ultimate Anti-Reversing Reference, which describes various Anti-Debugging techniques. in point 4.Thread Local Storage There is a mention Thread Local Storage ...
Marcin K.'s user avatar
  • 153
3 votes
1 answer
480 views

Unable to use CreateRemoteThread in target process

I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide). Even if I suspend all threads, it does ...
David's user avatar
  • 33
1 vote
0 answers
64 views

Threads blocking in kernel when I attach, can't control them

I'm attaching to a simple program and the new thread breaks at DbgBreakPoint as expected. I'm using x64dbg (32-bit). The problem is, when I go to the Threads window it shows all the threads' EIPs as ...
Mikubyte's user avatar
  • 153
4 votes
1 answer
5k views

How to fix anti-debugger with DbgUiRemoteBreakin

I have windows application that I want to debug. When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint when I press Play I see ...
CHOOSING123's user avatar
2 votes
1 answer
1k views

DLL Injection does not work twice

I created a program that performs DLL injection. It does that by opening the process with OpenProcess, writes the DLL path to the process and creates a remote thread with CreateRemoteThread with the ...
rustam Shirinov's user avatar
-1 votes
1 answer
543 views

How do people typically RE large binaries with lots of threads and imports? [closed]

If you have a 40MB PE that has a lot of dynamic third-party imports and threads how do you typically see what it's doing without manually documenting every routine and then tracking thread creation? ...
user1276423's user avatar
2 votes
0 answers
1k views

OllyDbg how to see the main thread (all memory in the cpu)

I can't figure out how to see more than the [CPU - main thread, module ] in the CPU window. Sometimes when I jump to an address the title changes just to [CPU - main thread] and now I can see all of ...
Zer0Mem0ry's user avatar
3 votes
1 answer
1k views

Thread local storage access on Windows XP

Recently the Microsoft Visual Studio 2015 compiler finally complied with the C++ standards mandate to generate thread-safe code for function local statics. For the most part this works just fine but I ...
ForeverLearning's user avatar
2 votes
1 answer
329 views

Changes on threads and threading system, in new Windows OS

I looked up the source code of the functions like CreateProcess and CreateThreade from kernel32. For example, CreateThread@kernel32 leads into kernelbase.dll and ends with a call to NtCreateThreadEx. ...
Vlad's user avatar
  • 153
3 votes
0 answers
440 views

When I start up a remote thread in an application, why does it always crash when it tries to access data in the thread structure?

I'm on OS X 10.10 64 bit (x86_64) and created a chunk of memory called code with vm_allocate. I allocate a chunk of memory for a stack. I load a library to memory and determine an entry point to ...
Div's user avatar
  • 93
4 votes
2 answers
1k views

CreateProcess - First thread routine - where is the memory allocated for the thread?

When calling CreateProcess internally it will call (obviously ZwCreateProcessEx and then) ZwCreateThread with a CreateSuspended set to True, then i assume final initialization is taking place. ...
0xAK's user avatar
  • 668
3 votes
2 answers
3k views

Extracting threads' stack from Windows memory dump

I have a memory dump of a VM running Windows server 2012 R2. The dump is of the entire RAM (4 GB). I want to extract as many features as possible from this dump. Mainly I want to extract all stacks ...
Yuval's user avatar
  • 133
3 votes
1 answer
281 views

Win32 x86 prologue disassembly

I have the following disassembly of a function prologue with comments. I'm unclear on what the author means in this line of disassembly "lea edi,[ebp-0xcc] ; getting the lowest address of stack ...
dcrearer's user avatar
  • 155
2 votes
1 answer
175 views

Avoid program detecting a thread being used [closed]

I'm writing a DLL for a program that needs to run in an infinite loop (with delays, of course). For example: while (true) { std::cout << "I am running.\n"; Sleep(1000); } I'm not sure ...
Lupe's user avatar
  • 185
1 vote
1 answer
2k views

IDA pro doesn't stop on breakpoints with GUI based applications

A couple of days ago I ran into an executable called "carckme" which was a GUI application. So I decided to figure out the serial number it generates. Properly I found out the function but when it ...
Devin Hudson's user avatar
1 vote
1 answer
461 views

Pydbg setting registers without breakpoint?

In pydbg, is it possible to set a register without having it hit a break point first? Consider the following example break point handler: def handler_breakpoint(mdbg): print "[+]Hit breakpoint" ...
Starwarsfan2099's user avatar
1 vote
1 answer
379 views

Can I get different thread registers with PyDBG?

I am writing a python debugger and disassembler using the PyDBG library I have the disassembler part working, but not all of the debugger. Is it possible to use it to return something similar to: [*] ...
Starwarsfan2099's user avatar
2 votes
1 answer
2k views

How to go back to main thread?

I was analyzing a sample and the function CreateRemoteThread is called with dwCreationFlag = 0, so the created thread starts immediately after creation. OllyDbg jumps to beginning of the new thread. I ...
user3097712's user avatar
  • 1,541
0 votes
1 answer
2k views

Working with multi-threaded program but can not find created thread

i am analyzing a piece of code in which the main thread does the following steps: First, it calls CreateProcess() to create a a process in suspended state. Then it changes the starting address of the ...
user3097712's user avatar
  • 1,541
2 votes
3 answers
4k views

How to go into thread function knowing only the thread handle

How do I go into the thread function (so I can do step by step tracing), knowing only the handle to the thread. I am using OllyDbg for tracing and the thread is created through the API ZwCreateProcess(...
jowabels's user avatar
  • 117
2 votes
1 answer
3k views

Changing start address of thread using combination of Get- and SetThreadContext?

I have the following assembly lines: PUSH 0 PUSH 4 ; CreationFlags = CREATE_SUSPENDED PUSH 0 PUSH program.0040163B ; start address of thread ...
user3097712's user avatar
  • 1,541
10 votes
4 answers
4k views

How can I get a running thread's start address on linux?

Problem Statement I'm trying to get the address of a running thread's start_routine as passed in the pthread_create() call. Research so far It is apparently not in /proc/[tid]/stat or /proc/[tid]/...
user2804197's user avatar
2 votes
1 answer
528 views

How to get the PID of the a thread's creator (not owner, not host)

The THREADENTRY32 structure contains a member called th32OwnerProcessID, which is described as: The identifier of the process that created the thread. I'm not sure if I understand how the ...
Benny's user avatar
  • 828
3 votes
1 answer
3k views

Three threads in Windows

I wrote a little program which just shows a dialog. Basically an ASM Hello World. When the dialog is displayed and I break in WinDBG, I can see three threads even though the application doesn't use ...
Devolus's user avatar
  • 963
9 votes
1 answer
2k views

How can I find the Thread Local Storage (TLS) of a Windows Process Thread?

The Thread Local Storage (TLS) contains static or global values for a thread. Those values can be very important to find reliable references to memory structures when the memory locations are not ...
samuirai's user avatar
  • 3,079
11 votes
1 answer
359 views

Thread-Switching with PyDbg

I'm having trouble switching from debugging one thread to another in pydbg. I don't have much experience with multithreading, so I'm hoping that I'm just missing something obvious. Basically, I want ...
Unix-dude's user avatar
  • 111
10 votes
1 answer
1k views

What does this memory pattern pointing from the thread-local storage mean?

An application I am currently looking add is using Threads and accessing something via the thread-local storage. It is compiled with Visual C++ (probably 6.0). First question would be, where can I ...
samuirai's user avatar
  • 3,079