Skip to main content
7 votes
Accepted

Thread EntryPoint in TLS callback as AntiDebug technique

When a debugger wants to attach to a process it will do the following things (see the DebugActiveProcess implementation on ReactOS): Connect to the debuggee with DbgUiConnectToDbg Tell the kernel to ...
mrexodia's user avatar
  • 1,652
4 votes
Accepted

Extracting threads' stack from Windows memory dump

I am Not Sure what you are looking for let me try i have a dump file of a vm too MEMORY.dmp from a vm that ran xp sp3 created using .crash from a kernel debugger attached to it i loaded it ...
blabb's user avatar
  • 16.4k
4 votes
Accepted

CreateProcess - First thread routine - where is the memory allocated for the thread?

Disclaimer: The implementation of these APIs is likely to change between versions of Windows. I will be referencing 32-bit Windows XP SP3 in my answer. Your results may vary. How thread creation ...
user1354557's user avatar
  • 1,234
3 votes
Accepted

CreateThread returns true but thread doesn't run

you mean the thread doesn't run when you have single stepped out of the CreateThread() call ?? if yes then the Windows Scheduler hasn't yet found time to Schedule your Threads Code you can ...
blabb's user avatar
  • 16.4k
3 votes
Accepted

Thread local storage access on Windows XP

If your module is a DLL that is loaded dynamically by your executable, then Thread Local Storage won't be initialized on Windows XP for the DLL. Quoting from my "Ultimate" Anti-Debugging Reference, ...
peter ferrie's user avatar
  • 4,709
3 votes

How to fix anti-debugger with DbgUiRemoteBreakin

This is not anti-debug but the standard way the Win32 debugging API implements process attaching. The thread with DbgBreakPoint call is injected by the OS to ensure that the process gets stopped, ...
Igor Skochinsky's user avatar
  • 36.7k
2 votes

CreateProcess - First thread routine - where is the memory allocated for the thread?

Ok so ZwCreateThread has it in the context structure (PCONTEXT + 0xB0) The api calls to receive the address are like this: CreateSection(..SectionInformation..) - Probably to create to initial ...
0xAK's user avatar
  • 668
2 votes

Avoid program detecting a thread being used

Have you considered using the DLL only for providing "stub" methods, that you could call using CreateRemoteThread, and have the DLL methods transform the arguments into what the method you ultimately ...
Jes Klinke's user avatar
1 vote

How to get thread start address in Windows?

Like I Commented this function is documented in winternl.h and you can use ntdll.lib to link with also start address being a pointer will need 8 bytes in x64 #include <windows.h> #include <...
blabb's user avatar
  • 16.4k
1 vote

How to force a program to run as monothread for dynamic analysis?

There is no generic solution for this problem. You probably need to find the code which decides how many threads to create and see if you can reduce their number or force the processing to occur in ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote
Accepted

Unable to use CreateRemoteThread in target process

The act of injecting a thread will trigger a call to any Thread Local Storage callbacks which the PE file might carry, even when all other threads are suspended. Such a callback might be responsible ...
peter ferrie's user avatar
  • 4,709
1 vote
Accepted

DLL Injection does not work twice

Calling LoadLibrary twice with the same DLL name only increases the load counter but does not cause DLL entrypoint to be called again. From the doc (emphasis mine): If the specified module is a DLL ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote

How do people typically RE large binaries with lots of threads and imports?

One method I tend to use (with IDA): Run the binary (without a debugger). Attach to it. Take a memory snapshot. Kill the process (from the debugger). Re-analyse the whole database (i.e.: AnalyzeArea(...
joxeankoret's user avatar
  • 4,488
1 vote
Accepted

Changes on threads and threading system, in new Windows OS

No. It is not necessary to create a connection with the CSRSS service in order for a process to function. The CSRSS server provides a few functionalities that are not needed for most processes, and ...
NirIzr's user avatar
  • 11.8k
1 vote
Accepted

Win32 x86 prologue disassembly

this doesnt have anything to do with stack size in pe header assume esp = 1200cc so ebp will also be 1200cc sub esp,0xcc will make esp 120000 the three pushes will alter esp but not ebp ...
blabb's user avatar
  • 16.4k

Only top scored, non community-wiki answers of a minimum length are eligible