Mr. eXoDia was very quick in fixing the bug I described few days ago.. That's a great work! 🙂
This is part of his new code:
... if (IsHidden) { Log("[TITANHIDE] NtSetContextThread by %d\n", pid); __try { ProbeForWrite(&Context->ContextFlags, sizeof(ULONG), 1); OriginalContextFlags = Context->ContextFlags; Context->ContextFlags &= ~CONTEXT_DEBUG_REGISTERS; } __except (EXCEPTION_EXECUTE_HANDLER) { return Undocumented::NtSetContextThread(ThreadHandle, Context); } } NTSTATUS ret = Undocumented::NtSetContextThread(ThreadHandle, Context); ...
There are 2 bugs hiding in this short snippet, can you spot them?
Hints
Bug #1 is old and breaks the functionality of SetContextThread. It's much easier to spot it in disassembly than in source code.
Bug #2 makes it easy to bypass TitanHide. It was introduced in this commit.
Let the analysis begin! I'm waiting for your comments.. 🙂
Being really curious what the second bug is to bypass TitanHide... The first probably has something to do with CONTEXT_DEBUG_REGISTERS, which also removes the CONTEXT_AMD64 flag, which should break things (but somehow doesn't in the real world)...