well ill give you some more code (slightly obfuscated but simplified version of the code pasted above )
and a bat file in response
fibmodtest.cpp so that exe will be name fibmodtest.exe
Code:
#include <windows.h>
PVOID fibers[2];
ULONG ret = 0x29a;
#pragma comment(lib,"kernel32.lib"

VOID CALLBACK FibFunc( _In_ PVOID lpParameter) {
if(!IsDebuggerPresent())
ret += (ret+5);
SwitchToFiber(fibers[1]);
}
void main (void) {
fibers[0] = CreateFiber(0,FibFunc,0);
fibers[1] = ConvertThreadToFiber(0);
SwitchToFiber(fibers[0]);
ExitProcess(ret);
}
i prefer small

but you may projectize with bloat and build
compiled and linked with
Code:
@call "C:\Program Files\Microsoft Visual Studio 10.0\VC\vcvarsall.bat" x86
cl /Zi /EHsc /nologo /W4 /analyze *.cpp /link /RELEASE /ENTRY:main /FIXED /MERGE:.data=.text /MERGE:.rdata=.text /ALIGN:16
once you have the exe run this batfile

you must have
procmon / windbg &| cdb / powershell / and gnuwin32 grep
Code:
set procmonpath=<path to procmon.exe here>
set PM=%procmonpath%\procmon.exe
start %PM% /quiet /minimized /backingfile .\modfib.pml
%PM% /waitforidle
fibmodtest.exe
cdb -c "g;q" fibmodtest.exe
%PM% /terminate
start %PM% /openlog .\modfib.pml /SaveAs2 foo.xml
%PM% /waitforidle
%PM% /terminate
powershell ([xml] ( Get-Content .\foo.xml)).procmon.eventlist.event | grep Detail
pause
@k
no need to uncheck the traceover it can be painful in a very large binary when nobrainonlybrawn approach is used you need to find the function that is called and set atlest one breakpoint somewhere in the function for ollydbg to get control of the new (pseudo thread function a fiber function is a pseudo thread function fibers simulate multithreaded operation in a single thread)
if you might have missed the CreateFiber and you are stuck on SwitchFiber the callback can be obtained from the Fiber Address
or alt+f1 bp [DWORD [esp] + 0xc + 0xb8]
fiber address typedef is as below in xpsp3
typedef _PSEUDOFIBBY {
DWORD whatever[3];
CONTEXT fibcontext;
}PseudoFibby,*PPseudoFibby;
here is a run trace for the code pasted above
Code:
New session
Address Thread Command ; Registers and comments
004002A1 Main MOV EBP, ESP ; EBP=0013FFC0
004002A3 Main PUSH 0 ; Arg3 = 00000000
004002A5 Main PUSH fibmodte.FibFunc ; Arg2 = 00400260
004002AA Main PUSH 0 ; Arg1 = 00000000
004002AC Main CALL NEAR DWORD PTR DS:[<&KERNEL32.CreateFiber>]; EAX=001529C8, ECX=0150FFFC
004002B2 Main MOV DWORD PTR DS:[fibers], EAX
004002B7 Main PUSH 0 ; Arg1 = 00000000
004002B9 Main CALL NEAR DWORD PTR DS:[<&KERNEL32.ConvertThreadToFiber>]; EAX=00152CC8, ECX=00152CC8, EDX=0013FFE0
004002BF Main MOV DWORD PTR DS:[400304], EAX
004002C4 Main MOV EAX, DWORD PTR DS:[fibers] ; EAX=001529C8
004002C9 Main PUSH EAX
004002CA Main CALL NEAR DWORD PTR DS:[<&KERNEL32.SwitchToFiber>]; EAX=00152CC8, ECX=004002D0, EDX=7FFDF000
004002D0 Main MOV ECX, DWORD PTR DS:[ret] ; ECX=0000029A
004002D6 Main PUSH ECX ; ExitCode = 29A
004002D7 Main CALL NEAR DWORD PTR DS:[<&KERNEL32.ExitProcess>]; EBX=00000000, EBP=0013FFA0, ESI=7C90DE6E, EDI=0000029A
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXX
004002A1 Main MOV EBP, ESP ; EBP=0013FFC0
004002A3 Main PUSH 0 ; Arg3 = 00000000
004002A5 Main PUSH fibmodte.FibFunc ; Arg2 = 00400260
004002AA Main PUSH 0 ; Arg1 = 00000000
004002AC Main CALL NEAR DWORD PTR DS:[<&KERNEL32.CreateFiber>]; EAX=001529C8, ECX=0150FFFC
004002B2 Main MOV DWORD PTR DS:[fibers], EAX
004002B7 Main PUSH 0 ; Arg1 = 00000000
004002B9 Main CALL NEAR DWORD PTR DS:[<&KERNEL32.ConvertThreadToFiber>]; EAX=00152CC8, ECX=00152CC8, EDX=0013FFE0
004002BF Main MOV DWORD PTR DS:[400304], EAX
004002C4 Main MOV EAX, DWORD PTR DS:[fibers] ; EAX=001529C8
004002C9 Main PUSH EAX
004002CA Main CALL NEAR DWORD PTR DS:[<&KERNEL32.SwitchToFiber>]; EAX=00000001, ECX=7C82FF9A, EDX=7FFDF000, EBX=00000000, EBP=0150FFB4, ESI=BAADF00D, EDI=BAADF00D
Breakpoint at fibmodte.00400269
00400269 Main TEST EAX, EAX ; EAX=00000000
0040026B Main JNZ SHORT fibmodte.00400282
0040026D Main MOV EAX, DWORD PTR DS:[ret] ; EAX=0000029A
00400272 Main MOV ECX, DWORD PTR DS:[ret] ; ECX=0000029A
00400278 Main LEA EDX, DWORD PTR DS:[ECX+EAX+5] ; EDX=00000539
0040027C Main MOV DWORD PTR DS:[ret], EDX
00400282 Main MOV EAX, DWORD PTR DS:[400304] ; EAX=00152CC8
00400287 Main PUSH EAX
00400288 Main CALL NEAR DWORD PTR DS:[<&KERNEL32.SwitchToFiber>]; ECX=004002D0, EDX=7FFDF000, EBX=7FFD8000, EBP=0013FFC0, ESI=7C9115F9, EDI=00560000
004002D0 Main MOV ECX, DWORD PTR DS:[ret] ; ECX=00000539
004002D6 Main PUSH ECX ; ExitCode = 539
004002D7 Main CALL NEAR DWORD PTR DS:[<&KERNEL32.ExitProcess>]; EBX=00000000, EBP=0013FFA0, ESI=7C90DE6E, EDI=00000539
Run trace closed