diff --git a/src/windows-emulator/emulator_thread.hpp b/src/windows-emulator/emulator_thread.hpp index 4f14aa7a..d80f2556 100644 --- a/src/windows-emulator/emulator_thread.hpp +++ b/src/windows-emulator/emulator_thread.hpp @@ -102,6 +102,8 @@ class emulator_thread : public ref_counted_object std::vector last_registers{}; + bool debugger_hide{false}; + void mark_as_ready(NTSTATUS status); bool is_await_time_over(utils::clock& clock) const @@ -180,6 +182,8 @@ class emulator_thread : public ref_counted_object buffer.write_optional(this->wow64_cpu_reserved); buffer.write_vector(this->last_registers); + + buffer.write(this->debugger_hide); } void deserialize_object(utils::buffer_deserializer& buffer) override @@ -225,6 +229,8 @@ class emulator_thread : public ref_counted_object buffer.read_optional(this->wow64_cpu_reserved, [this] { return emulator_object(*this->memory_ptr); }); buffer.read_vector(this->last_registers); + + buffer.read(this->debugger_hide); } void leak_memory() diff --git a/src/windows-emulator/syscalls/thread.cpp b/src/windows-emulator/syscalls/thread.cpp index ffd9120b..e4991bdc 100644 --- a/src/windows-emulator/syscalls/thread.cpp +++ b/src/windows-emulator/syscalls/thread.cpp @@ -58,6 +58,7 @@ namespace syscalls if (info_class == ThreadHideFromDebugger) { + c.win_emu.current_thread().debugger_hide = true; c.win_emu.callbacks.on_suspicious_activity("Hiding thread from debugger"); return STATUS_SUCCESS; } @@ -276,8 +277,10 @@ namespace syscalls return STATUS_BUFFER_OVERFLOW; } + emulator_thread& thread = c.win_emu.current_thread(); + const emulator_object info{c.emu, thread_information}; - info.write(0); + info.write(thread.debugger_hide); return STATUS_SUCCESS; }