Re: State of process at CREATE_PROCESS_DEBUG_EVENT


Are only .exe and ntdll.dll are mapped when "create process" event is
set or there are other dlls mapped also?


Only .exe and ntdll.dll. Others will be mapped by the loader
after "create process" event.

where will the EIP will point when "create process" event will occur?
Will it point to the first instruction of the main thread or somewhere
else?


Yes, it points to kernel32!BaseProcessStartThunk, where the main thread
will start executing. Though at the moment of "create process" event,
kernel32.dll is not yet mapped into memory.

Also, when the process continues after "create process", it will get
an APC first, and loader will run in the context of that APC.
At the end, it will do NtContinue to the original thread context,
resulting in transferring the control to kernel32!BaseProcessStartThunk.

Oleg




.