Home/ Questions/Q 7609969
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-31T01:18:21+00:00

I need to debug the code injected by a malware into internet explorer. By

  • 0

I need to debug the code injected by a malware into internet explorer. By itself it wouldn’t be problem if I could debug the main process, problem is I cannot run the malware from inside the debugger due to a lot of anti debugging measures (moreover the injection is not performed via CreateRemoteThread, nor via NtQueueApcThread, that by itself is already interesting and that’s what I’d also like to figure out).

Is there a way to attach a debugger to the injected process? I can detect the thread I’m interested in using OllyDbg, but there’s no way I can attach to the code to step it and understand what’s going on.

Any suggestion from you?
Thanx in advance!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Some of the anti-attach tricks are listed here. Some of them mention countermeasures too. FWIW, I was able to attach to the program mentioned in the first post (DbgUiRemoteBreakin overwrite trick) using IDA by enabling “Stop on debugging start” option.

    If that doesn’t help, I’d suggest posting to the RE reddit with more details.

    • 0