Giters

mrexodia / TitanHide

Hiding kernel-driver for x86/x64.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Bug in NtGetContextThread hook

ax2541 opened this issue · comments

commented

NtGetContextThread hook has some problems, TitanHide.log contains these lines:

[TITANHIDE] NtGetContextThread by 4920
[TITANHIDE] NtGetContextThread by 4920
[TITANHIDE] NtGetContextThread by 4920
[TITANHIDE] NtGetContextThread by 4920
[TITANHIDE] NtGetContextThread by 4920
[TITANHIDE] NtGetContextThread by 4920
[TITANHIDE] NtGetContextThread by 4920
[TITANHIDE] NtGetContextThread by 4920
[TITANHIDE] NtGetContextThread by 4920

5 lines writing to log file per second and Hardware breakpoints don't work on any program (protected or unprotected).

commented

Thanks. I didn't catch this because I only tested a program calling GetThreadContext on itself with no debugger attached. But most debuggers (definitely any that support hardware BPs) will also call Get/SetThreadContext with the target thread being one in the hidden process, hence the spam.

Should be fixed now.