We have talked about process injection before, in Chapter 4, Inspecting Process Injection and API Hooking. Process injection is a very well-known technique, not only for man-in-the-browser attacks, but also for escaping the debugged process into a process that is not currently debugged. By injecting code into another process, malware can get out of the debugger's control and execute code before the debugger can attach to it.
A commonly used solution to bypass this trick is to inject an infinite loop into the entry point of the injected code before it gets executed, usually in the injector code either before the WriteProcessMemory call when the code hasn't been injected yet or before CreateRemoteThread, this time in another process's memory.
An infinite loop can be created by writing two bytes (0xEB 0xFE) that represent a jmp instruction to itself, as you can see in the following screenshot:
