📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Single Stepping Over Thread Creation

Topic created on: October 15, 2007 19:16 CDT by bodzcount .

When I single step over the following code, i get stuck at WaitForSingleObject. Why does that happen?

.code
start:
    INVOKE  CreateThread, NULL, NULL, OFFSET Thread, ESP, NULL, ESP
    push eax
   invoke WaitForSingleObject ,eax,INFINITE
    POP     EAX
   INVOKE  CloseHandle, EAX


  
      invoke MessageBox, NULL,addr MsgBoxText, addr MsgCaption, MB_OK
invoke ExitProcess,NULL
  


Thread    PROC
   RET
Thread    ENDP

  nezumi     October 15, 2007 19:50.13 CDT
while you're tracing primary thread all other threads are suspended, so you got infinite loop. this is well-know trick. ok. see another example:

int g_flag =1;

secondary_thread()
{
...
g_flag = 0;
...
}

primary_thread()
{
...
while(g_flag);
...
}


try to trace primary_thread and see what happens :)

  Aram     October 16, 2007 02:49.54 CDT
For solution this you need put a breakpoint under the WaitForSingleObject (POP EAX) and RESUME the execution.

  bodzcount     October 16, 2007 06:23.18 CDT
ok thanks :)

but why doesnt it work, when i single step until WaitForSingleObject and then press run? It works when i press run 1 op before...

  anonymouse     October 16, 2007 12:33.13 CDT
that is because the thread is suspended , exited , waiting for something to happen which never happens

whan you hit run the windows gives chance for other threads to run also

after createthread the thread needs to be resumed eitehr explicitly by yourself or implicitly by os ThreadScheduler

when you are single stepping windows didnt give chance for other thread to run

there are various other place you may encounter this especially when you are single stepping through r0,r3 transitions you will see ollydbg will show running in its status box but nothing will actually be happening
play aroung NtContinue() to experiance stuck up scenes :)

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit