Anti Debugging using NtSetInformationThread

악성코드 분석하다 나옴.

https://msdn.microsoft.com/en-us/library/windows/hardware/ff557675(v=vs.85).aspx

https://github.com/AdaCore/gsh/blob/master/os/src/ddk/ntddk.h

NtSetInformationThread에 두 번째 인자로 들어가는게 아래의 THREADINFOCLASS인데, 여기서 0x11번 째 멤버인 ThreadHideFromDebbger가 인자로 들어가면 디버거가 디버기에서 강제로 분리된다.

두 번째 인자로 값을 0x11이 아닌, 0x0을 주면 우회가 가능하다.

typedef enum _THREADINFOCLASS {
  ThreadBasicInformation,
  ThreadTimes,
  ThreadPriority,
  ThreadBasePriority,
  ThreadAffinityMask,
  ThreadImpersonationToken,
  ThreadDescriptorTableEntry,
  ThreadEnableAlignmentFaultFixup,
  ThreadEventPair_Reusable,
  ThreadQuerySetWin32StartAddress,
  ThreadZeroTlsCell,
  ThreadPerformanceCount,
  ThreadAmILastThread,
  ThreadIdealProcessor,
  ThreadPriorityBoost,
  ThreadSetTlsArrayAddress,
  ThreadIsIoPending,
  ThreadHideFromDebugger,
  ThreadBreakOnTermination,
  ThreadSwitchLegacyState,
  ThreadIsTerminated,
  ThreadLastSystemCall,
  ThreadIoPriority,
  ThreadCycleTime,
  ThreadPagePriority,
  ThreadActualBasePriority,
  ThreadTebInformation,
  ThreadCSwitchMon,
  ThreadCSwitchPmu,
  ThreadWow64Context,
  ThreadGroupInformation,
  ThreadUmsInformation,
  ThreadCounterProfiling,
  ThreadIdealProcessorEx,
  MaxThreadInfoClass
} THREADINFOCLASS;