When I attach OllyDbg or ImmunityDebugger to a process, it automatically breaks execution. I'm attaching to a user-mode service running as SYSTEM and only need to catch exceptions, so this is not ideal. Is there a way to disable the break-on-attach behaviour?
How can I prevent Immunity Debugger / OllyDbg from breaking on attach?
tools;debuggers;ollydbg;immunity debugger
ExplanationThe break on attach is due to the ntdll DbgUiRemoteBreakin and DbgBreakPoint functions being called. If you check the kernel32 DebugActiveProcess function called by the debugger, OllyDbg or ImmunityDebugger, you will see a call to the CreateRemoteThread, CreateRemoteThreadEx, or ZwCreateThreadEx function depending on your OS.So, i guess one way to bypass breaking is:debug the debugger itselfgo to the DbgUiIssueRemoteBreakin function and spot the call to the function creating the remote thread.change the lpStartAddress parameter in case of CreateRemoteThread/CreateRemoteThreadEx to DbgBreakPoint+1 RETN 0xC3PluginI created an OllyDbg v1.10 plugin which NOPs the INT3 in DbgBreakPoint in the process with the PID you choose. It has only been tested on Windows 7.UsagePlace SilentAttach.dll in OllyDbg directory, fire OllyDbg, Press Alt+F12, and then enter process Id of the process you want to silently attach to.N.B.Since no break occurs, OllyDbg does not extract many piece of info. e.g. list of loaded module. So, you have to activate the context by something like Alt+E then Alt+C