ZwSetInformationThread 可以用来将线程隐藏，从而使调试器接收不到信息

其原型如下：

NTSTATUS
NTAPI
ZwSetInformationThread (
   __in HANDLE ThreadHandle,
   __in THREADINFOCLASS ThreadInformationClass,
   __in_bcount(ThreadInformationLength) PVOID ThreadInformation,
   __in ULONG ThreadInformationLength
   );

//
// Thread Information Classes定义如下
//ntpsapi.h

typedef enum _THREADINFOCLASS {
   ThreadBasicInformation,
   ThreadTimes,
   ThreadPriority,
   ThreadBasePriority,
   ThreadAffinityMask,
   ThreadImpersonationToken,
   ThreadDescriptorTableEntry,
   ThreadEnableAlignmentFaultFixup,
   ThreadEventPair_Reusable,
   ThreadQuerySetWin32StartAddress,
   ThreadZeroTlsCell,
   ThreadPerformanceCount,
   ThreadAmILastThread,
   ThreadIdealProcessor,
   ThreadPriorityBoost,
   ThreadSetTlsArrayAddress,
   ThreadIsIoPending,
   ThreadHideFromDebugger,//这个就是用来将线程对调试器隐藏
   ThreadBreakOnTermination,
   ThreadSwitchLegacyState,
   ThreadIsTerminated,
   MaxThreadInfoClass
   } THREADINFOCLASS;
// end_ntddk end_ntifs

 

如下：ZwSetInformationThread(GetCurrentThread( ), ThreadHideFromDebugger, NULL, 0); 这样就可以将当前线程对调试器隐藏了！

补充：zwsetinformationthread 调用后会修改_Ethread结构中的HideFromDebuggers

结构：

typedef enum _THREADINFOCLASS {

ThreadBasicInformation, // 0 Y N
ThreadTimes, // 1 Y N
ThreadPriority, // 2 N Y
ThreadBasePriority, // 3 N Y
ThreadAffinityMask, // 4 N Y
ThreadImpersonationToken, // 5 N Y
ThreadDescriptorTableEntry, // 6 Y N
ThreadEnableAlignmentFaultFixup, // 7 N Y
ThreadEventPair, // 8 N Y
ThreadQuerySetWin32StartAddress, // 9 Y Y
ThreadZeroTlsCell, // 10 N Y
ThreadPerformanceCount, // 11 Y N
ThreadAmILastThread, // 12 Y N
ThreadIdealProcessor, // 13 N Y
ThreadPriorityBoost, // 14 Y Y
ThreadSetTlsArrayAddress, // 15 N Y
ThreadIsIoPending, // 16 Y N
ThreadHideFromDebugger // 17 N Y
} THREAD_INFO_CLASS;

typedef NTSTATUS (NTAPI *ZwSetInformationThread)(
IN HANDLE ThreadHandle,
IN THREAD_INFO_CLASS ThreadInformaitonClass,
IN PVOID ThreadInformation,
IN ULONG ThreadInformationLength
);

应用层调用：

HANDLE hwnd;
HMODULE hModule;
hwnd=GetCurrentThread();
hModule=LoadLibrary(“ntdll.dll”);
ZwSetInformationThread myFunc;
myFunc=(ZwSetInformationThread)GetProcAddress(hModule,”ZwSetInformationThread”);
myFunc(hwnd,ThreadHideFromDebugger,NULL,NULL);

用IDA的字符串查看，可以看到ZwSetInformationThread来初步判断是否采用这个技术。