search

Air14 / HyperHide

Hypervisor based anti anti debug plugin for x64dbg
MIT License
1.23k stars 279 forks source link

Please also handle NtContinueEx #2

Closed DavidXanatos closed 3 years ago

DavidXanatos commented 3 years ago

Hello,

First of all let me say that you created here a really great peace of software, thank you very much.

But now to the issue, since windows 10 2004 MSFT added an extended version of the NtContinue sys call called NtContinueEx And I already have seen it being used for example by the Line messager.

It would be great if you could add handling for the NtContinueEx as well

Cheers David

Air14 commented 3 years ago

It's actually implemented but it isn't mentioned anywhere. Since windows 10 2004 hyperhide hooks NtContinueEx instead of normal NtCotinue (NtContinue in newer windows versions is just a wrapper for NtContinueEx)