Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [thread]

Smallest sequence of instructions that can be managed independently by an operating system scheduler. Threads share all the same memory-space layout within the same process.

-1
votes
2answers
53 views

CreateThread returns true but thread doesn't run

I have a PE executable which uses threads to handle most of its functionality. It uses CreateThread API to spawn local threads to handle functions. The call to the CreateThread returns a valid handle ...
3
votes
1answer
315 views

Thread EntryPoint in TLS callback as AntiDebug technique

I came across a document called The Ultimate Anti-Reversing Reference, which describes various Anti-Debugging techniques. in point 4.Thread Local Storage There is a mention Thread Local Storage ...
3
votes
1answer
133 views

Unable to use CreateRemoteThread in target process

I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide). Even if I suspend all threads, it does ...
1
vote
0answers
42 views

Threads blocking in kernel when I attach, can't control them

I'm attaching to a simple program and the new thread breaks at DbgBreakPoint as expected. I'm using x64dbg (32-bit). The problem is, when I go to the Threads window it shows all the threads' EIPs as ...
3
votes
1answer
755 views

How to fix anti-debugger with DbgUiRemoteBreakin

I have windows application that I want to debug. When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint when I press Play I see ...
1
vote
1answer
323 views

DLL Injection does not work twice

I created a program that performs DLL injection. It does that by opening the process with OpenProcess, writes the DLL path to the process and creates a remote thread with CreateRemoteThread with the ...
-1
votes
0answers
194 views

RemoteThread Debugging on explorer.exe

When I try to debug RemetoThread on explorer.exe, because of breakpoint explorer.exe paused and I cannot switch to other program. How can I switch to ollydbg[server.exe] to ollydbg[explorer.exe]?
-1
votes
1answer
111 views

How do people typically RE large binaries with lots of threads and imports? [closed]

If you have a 40MB PE that has a lot of dynamic third-party imports and threads how do you typically see what it's doing without manually documenting every routine and then tracking thread creation? ...
2
votes
0answers
624 views

OllyDbg how to see the main thread (all memory in the cpu)

I can't figure out how to see more than the [CPU - main thread, module ] in the CPU window. Sometimes when I jump to an address the title changes just to [CPU - main thread] and now I can see all of ...
3
votes
1answer
559 views

Thread local storage access on Windows XP

Recently the Microsoft Visual Studio 2015 compiler finally complied with the C++ standards mandate to generate thread-safe code for function local statics. For the most part this works just fine but I ...
2
votes
1answer
179 views

Changes on threads and threading system, in new Windows OS

I looked up the source code of the functions like CreateProcess and CreateThreade from kernel32. For example, CreateThread@kernel32 leads into kernelbase.dll and ends with a call to NtCreateThreadEx. ...
3
votes
0answers
237 views

When I start up a remote thread in an application, why does it always crash when it tries to access data in the thread structure?

I'm on OS X 10.10 64 bit (x86_64) and created a chunk of memory called code with vm_allocate. I allocate a chunk of memory for a stack. I load a library to memory and determine an entry point to ...
5
votes
2answers
519 views

CreateProcess - First thread routine - where is the memory allocated for the thread?

When calling CreateProcess internally it will call (obviously ZwCreateProcessEx and then) ZwCreateThread with a CreateSuspended set to True, then i assume final initialization is taking place. ...
3
votes
2answers
1k views

Extracting threads' stack from Windows memory dump

I have a memory dump of a VM running Windows server 2012 R2. The dump is of the entire RAM (4 GB). I want to extract as many features as possible from this dump. Mainly I want to extract all stacks ...
3
votes
1answer
143 views

Win32 x86 Prolog disassembly

I have the following disassembly of a function prolog with comments. I'm unclear on what the author means in this line of disassembly "lea edi,[ebp-0xcc] ; getting the lowest address of stack frame"...
3
votes
1answer
142 views

Avoid program detecting a thread being used [closed]

I'm writing a DLL for a program that needs to run in an infinite loop (with delays, of course). For example: while (true) { std::cout << "I am running.\n"; Sleep(1000); } I'm not sure ...
0
votes
1answer
696 views

IDA pro doesn't stop on breakpoints with GUI based applications

A couple of days ago I ran into an executable called "carckme" which was a GUI application. So I decided to figure out the serial number it generates. Properly I found out the function but when it ...
1
vote
1answer
330 views

Pydbg setting registers without breakpoint?

In pydbg, is it possible to set a register without having it hit a break point first? Consider the following example break point handler: def handler_breakpoint(mdbg): print "[+]Hit breakpoint" ...
2
votes
1answer
265 views

Can I get different thread registers with PyDBG?

I am writing a python debugger and disassembler using the PyDBG library I have the disassembler part working, but not all of the debugger. Is it possible to use it to return something similar to: [*] ...
2
votes
1answer
1k views

How to go back to main thread?

I was analyzing a sample and the function CreateRemoteThread is called with dwCreationFlag = 0, so the created thread starts immediately after creation. OllyDbg jumps to beginning of the new thread. I ...
0
votes
1answer
1k views

Working with multi-threaded program but can not find created thread

i am analyzing a piece of code in which the main thread does the following steps: First, it calls CreateProcess() to create a a process in suspended state. Then it changes the starting address of the ...
2
votes
3answers
3k views

How to go into thread function knowing only the thread handle

How do I go into the thread function (so I can do step by step tracing), knowing only the handle to the thread. I am using OllyDbg for tracing and the thread is created through the API ZwCreateProcess(...
2
votes
1answer
1k views

Changing start address of thread using combination of Get- and SetThreadContext?

I have the following assembly lines: PUSH 0 PUSH 4 ; CreationFlags = CREATE_SUSPENDED PUSH 0 PUSH program.0040163B ; start address of thread ...
10
votes
4answers
2k views

How can I get a running thread's start address on linux?

Problem Statement I'm trying to get the address of a running thread's start_routine as passed in the pthread_create() call. Research so far It is apparently not in /proc/[tid]/stat or /proc/[tid]/...
1
vote
1answer
348 views

How to get the PID of the a thread's creator (not owner, not host)

The THREADENTRY32 structure contains a member called th32OwnerProcessID, which is described as: The identifier of the process that created the thread. I'm not sure if I understand how the ...
2
votes
1answer
2k views

Three threads in Windows

I wrote a little program which just shows a dialog. Basically an ASM Hello World. When the dialog is displayed and I break in WinDBG, I can see three threads even though the application doesn't use ...
6
votes
1answer
1k views

How can I find the Thread Local Storage (TLS) of a Windows Process Thread?

The Thread Local Storage (TLS) contains static or global values for a thread. Those values can be very important to find reliable references to memory structures when the memory locations are not ...
10
votes
1answer
326 views

Thread-Switching with PyDbg

I'm having trouble switching from debugging one thread to another in pydbg. I don't have much experience with multithreading, so I'm hoping that I'm just missing something obvious. Basically, I want ...
9
votes
1answer
792 views

What does this memory pattern pointing from the thread-local storage mean?

An application I am currently looking add is using Threads and accessing something via the thread-local storage. It is compiled with Visual C++ (probably 6.0). First question would be, where can I ...