NtSetInformationThread test failed

[hexadecimal233]

Using al-khaser with x64dbg, Checking NtSetInformationThread with ThreadHideFromDebugger returns bad.

[privacyguy123]

For me "Software breakpoints" returns bad - how did you fix that one?

[zuernerd]

I noticed the same while benchmarking scyllahide against al-khaser.

The hook is actually working but al-khaser uses some more sophisticated testing to detect simple hooks.

It is implemented in: https://github.com/ayoubfaouzi/al-khaser/blob/master/al-khaser/AntiDebug/NtSetInformationThread_ThreadHideFromDebugger.cpp

Look at this for example:

// First issue a bogus call with an incorrect length parameter. If it succeeds, we know NtSetInformationThread was hooked.
	Status = NtSetInformationThread(GetCurrentThread(), ThreadHideFromDebugger, &isThreadHidden, 12345);
	if (Status == 0)
		return TRUE;

The simple hook in Scyalla will already fall for this. Not sure if it would make sense to implement all of these test cases....