反調試 zwsetinformationthread

zwsetinformationthread 調用後會修改_Ethread結構中的HideFromDebuggers

結構：

typedef enum _THREADINFOCLASS {

ThreadBasicInformation, // 0 Y N
ThreadTimes, // 1 Y N
ThreadPriority, // 2 N Y
ThreadBasePriority, // 3 N Y
ThreadAffinityMask, // 4 N Y
ThreadImpersonationToken, // 5 N Y
ThreadDescriptorTableEntry, // 6 Y N
ThreadEnableAlignmentFaultFixup, // 7 N Y
ThreadEventPair, // 8 N Y
ThreadQuerySetWin32StartAddress, // 9 Y Y
ThreadZeroTlsCell, // 10 N Y
ThreadPerformanceCount, // 11 Y N
ThreadAmILastThread, // 12 Y N
ThreadIdealProcessor, // 13 N Y
ThreadPriorityBoost, // 14 Y Y
ThreadSetTlsArrayAddress, // 15 N Y
ThreadIsIoPending, // 16 Y N
ThreadHideFromDebugger // 17 N Y
} THREAD_INFO_CLASS;


typedef NTSTATUS (NTAPI *ZwSetInformationThread)(
IN HANDLE ThreadHandle,
IN THREAD_INFO_CLASS ThreadInformaitonClass,
IN PVOID ThreadInformation,
IN ULONG ThreadInformationLength

);

應用層調用：

HANDLE hwnd;
HMODULE hModule;
hwnd=GetCurrentThread();
hModule=LoadLibrary("ntdll.dll");
ZwSetInformationThread myFunc;
myFunc=(ZwSetInformationThread)GetProcAddress(hModule,"ZwSetInformationThread");
myFunc(hwnd,ThreadHideFromDebugger,NULL,NULL);

用IDA的字符串查看，可以看到ZwSetInformationThread來初步判斷是否採用這個技術。