0

I am trying to put a breakpoint each time a new thread is opened by an application for which I do not have the source code

I was able to put kernel32!CreateThread in the breakpoint conditions, it gives me a breakpoint when certain threads are created, but I noticed that under IDA it manages to detect more threads than Visual Studio

Is there another way to do this than setting the kernel32!CreateThread condition to capture all threads?

Doesn't seem to be a problem in language selection as I have already selected "all languages" to test

visual studio

vnkx3
  • 21
  • 4

1 Answers1

1

RtlUserThreadStart seems to work

vnkx3
  • 21
  • 4
  • Hi, thanks for your sharing! Since you have found the solution of this issue, you can [mark yourself answer](https://meta.stackexchange.com/questions/5234/how-does-accepting-an-answer-work/5235#5235) to end this question. This will help others who meet the similar issue and searching for the solution. :) – Bowman Zhu-MSFT Jul 05 '23 at 06:48