ring0--hook NtContinue+source_code

ring0下面hookNtContinue 使用drx7寄存器实现的hook

this code hooks ntoskrnl!NtContinue to set dr7 to 0 (no updating of dr7)

so NtContinue called from ring3 cannot alter drX registers...

This hook will only PREVENT drX clearing from SEH (kiuser->ntcontinue)

and will not alter debugging using ring3 debuggers (olly->SetThreadContext)

mainly developed for personal reasearch and as anti-bpm...





Hook NtContinue (not exported from ntoskrnl.exe but exported in ntdll.dll with service number) to set dr7 to 0 prior to calling original NtContinue so debug registers won t be changed from seh and ring3 code =)



Its use for some targets such as armadillo... but never posted code...

by deroko-ring0- hook NtContinue+ source_codering0 use the following hookNtContinue register drx7 realize the hook this code hooks ntoskrnl! NtContinue to set dr7 to 0 (no updating of dr7) so NtContinue called from ring3 cannot alter drX registers ... This hook will only PREVENT drX clearing from SEH (kiuser-> ntcontinue) and will not alter debugging using ring3 debuggers (olly-> SetThreadContext) mainly developed for personal reasearch and as anti-bpm ... Hook NtContinue (not exported from ntoskrnl.exe but exported in ntdll. dll with service number) to set dr7 to 0 prior to calling original NtContinue so debug registers won t be changed from seh and ring3 code =) Its use for some targets such as armadillo ... but never posted code ... by deroko