.I was debugging a virus which injects into svchost.exe,
I found the pid of the process and attached to it but ollydbg is breaking at ntdll.breakpoint.
Does anyone know how to stop at the right point ?
or any other clever way to do this.
The main objective is to see the code of the thread injected in to the process.
Thanks in advance
charlie
![[+] expand](/imagery/files/soysauce_blueprint.gif){kind=link}