mrexodia/TitanHide

Bug in NtGetContextThread hook

ax2541 opened this issue · 1 comments

ax2541 commented

NtGetContextThread hook has some problems, TitanHide.log contains these lines:

[TITANHIDE] NtGetContextThread by 4920
[TITANHIDE] NtGetContextThread by 4920
[TITANHIDE] NtGetContextThread by 4920
[TITANHIDE] NtGetContextThread by 4920
[TITANHIDE] NtGetContextThread by 4920
[TITANHIDE] NtGetContextThread by 4920
[TITANHIDE] NtGetContextThread by 4920
[TITANHIDE] NtGetContextThread by 4920
[TITANHIDE] NtGetContextThread by 4920

5 lines writing to log file per second and Hardware breakpoints don't work on any program (protected or unprotected).

Mattiwatti commented

Thanks. I didn't catch this because I only tested a program calling GetThreadContext on itself with no debugger attached. But most debuggers (definitely any that support hardware BPs) will also call Get/SetThreadContext with the target thread being one in the hidden process, hence the spam.

Should be fixed now.