[WinAppDbg-users] single stepping at RtlUserThreadStart

[Justin K. <jus...@gm...>]

Hi WinAppDbg, I am trying to single-step every instruction of all threads
from process creation to process termination. My code is as following, and
my problem is that it stops receiving single step events when it reaches
ntdll!RtlUserThreadStart. Is this expected? Should I be missing some
configuration perhaps? Cheers -- Justin

Code:
import sys
from winappdbg import *

class Taint(EventHandler):
    def create_process(self, event):
        module = event.get_process().get_main_module()
        print "[+] Process created: %s" % module.fileName
        print "[+] Thread #%d tracing enabled." % event.get_tid()
        event.debug.start_tracing( event.get_tid() )

    def exit_process(self, event):
        print "[+] Process terminated."

    def create_thread( self, event ):
        print "[+] Thread #%d tracing enabled." % event.get_tid()
        event.debug.start_tracing( event.get_tid() )

    def single_step(self, event):
        thread = event.get_thread()
        pc = thread.get_pc()
        tid = thread.get_tid()
        instruction = thread.disassemble(pc, 0x10)[0]
        address = instruction[0]
        mnemonic = " ".join(instruction[2].split())
        print "[T%d] 0x%08X: %s" % (tid, address, mnemonic)

# main
with Debug(Taint(), True) as debug:
    debug.execv(sys.argv[1:], bFollow=True)
    debug.loop()


Output:
...
[T120] 0x774DBA7B: mov dword [ss:esp+00000084h], 00000040h
[ntdll!RtlTimeFieldsToTime+0x3ce]
[T120] 0x774DBA86: mov dword [ss:esp+00000088h], 00000000h
[ntdll!RtlTimeFieldsToTime+0x3d9]
[T120] 0x774DBA91: mov dword [ss:esp+0000008Ch], 00000000h
[ntdll!RtlTimeFieldsToTime+0x3e4]
[T120] 0x774DBA9C: call 774BBFC0h [ntdll!ZwQueryAttributesFile]
[T120] 0x774BBFC0: mov eax, 0000003Ch [ntdll!ZwQueryAttributesFile]
[T120] 0x774BBFC5: call dword [fs:000000C0h]
[ntdll!ZwQueryAttributesFile+0x5]
[T120] 0x774711D8: jmp far 0033h : 774721A4h [0x774711d8]
[T120] 0x774BDE3C: mov dword [ss:esp+04h], eax [ntdll!RtlUserThreadStart]
[+] Process terminated.