ZwSetInformationThread - anti-dbg trick, but how?

[haggar]

I see that lot of these protectors use ZwSetInformationThread API as some anti-debug trick. Googling and finding reference, I see that ZwSetInformationThread just set thread priority !? How is that used as anti-trick?

In my case, when this API is called, Olly CPU windows just shows nothing, like nothing is loaded in it. Here is what I found:

[TheHyper]

Damn, I was planning to include this trick in my new unpackme

The ZwSetInformationThread allows us to increase the thread priority plus other things

Okay, here is the function definition:

NTSYSAPI NTSTATUS NTAPI ZwSetInformationThread(
IN HANDLE ThreadHandle,
IN THREADINFOCLASS ThreadInformationClass,
IN PVOID ThreadInformation,
IN ULONG ThreadInformationLength
);

Here are the possible values for THREADINFOCLASS:

typedef enum _THREADINFOCLASS {
ThreadBasicInformation,
ThreadTimes,
ThreadPriority,
ThreadBasePriority,
ThreadAffinityMask,
ThreadImpersonationToken,
ThreadDescriptorTableEntry,
ThreadEnableAlignmentFaultFixup,
ThreadEventPair_Reusable,
ThreadQuerySetWin32StartAddress,
ThreadZeroTlsCell,
ThreadPerformanceCount,
ThreadAmILastThread,
ThreadIdealProcessor,
ThreadPriorityBoost,
ThreadSetTlsArrayAddress,
ThreadIsIoPending,
ThreadHideFromDebugger,
ThreadBreakOnTermination,
MaxThreadInfoClass
} THREADINFOCLASS;

Here is some sample code:
void main()
{
int id=(int)GetCurrentThread();
GetProcAddress(GetModuleHandle("ntdll.dll"),"ZwSetInformationThread");
_asm
{
push 0
push NULL
push ThreadHideFromDebugger
push id
call eax
}
}

Once the ZwSetInformationThread function is called, all user mode debuggers are unable to read the process memory

[haggar]

Thanks , I didn't know that. Is that ThreadHideFromDebugger boolean value, like 1 and 0 ? I'm gona check some files now.

Btw, how it's going with your protector, when we will see new unpackme?

[TheHyper]

ThreadHideFromDebugger is 17(0x11)

I have fixed all the previous vulnerabilities and added some anti-debugging tricks

I am trying to think of a cool api redirection and binary code obfuscation.
Hopefully, I will be releasing my new unpackme within 2 weeks.

I must make it a real hard nut to crack

[haggar]

Yep, I sow in some files that it pushes 11.

Hard you sad. Well, I'm waiting for it I like interesting unpackmes.


See you