Close anti-debug syscall side channels - #103
Conversation
mrexodia
changed the title
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b13a71ca7a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e5aa6152da
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Live VM diagnosis for 35eaa4a:
The VS2019/WDK 19041 x86+x64 workflow also passes: https://github.com/mrexodia/TitanHide/actions/runs/29643206017 |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 35eaa4a93b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 75c43c4775
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 701c2cbead
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Summary
Match native anti-debug syscall behavior so malformed calls, thread lifecycle transitions, and overlapping output pointers cannot distinguish TitanHide's emulation from native state, without ever applying a delayed one-way thread-hide request.
Confirmed side channels
Live testing and hook-path auditing identified these observable differences:
ProcessDebugObjectHandlechecked process access before output alignment. A restricted process handle plus a misaligned output returnedSTATUS_ACCESS_DENIED; native Windows returnsSTATUS_DATATYPE_MISALIGNMENT.ThreadHideFromDebuggerqueries always returnedTRUE, including for fresh threads that never requested hiding.THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGERlost their observable hide state after TitanHide physically stripped the bit.NtGetContextThreadcalls still zeroed debug-register fields; native Windows leaves failed output untouched.ObjectTypesInformationtraversal trusted overwriteableUNICODE_STRINGfields. LegalReturnLengthoverlap could fault or skip DebugObject count filtering.Zw*calls could enter user-mode filtering paths and expose different statuses or corrupt kernel buffers.Changes
ProcessDebugObjectHandlelength, four-byte alignment, access, probing, output, and overlap order.ThreadHideFromDebuggerstate by referenced thread object.NtGetContextThreadfails, including WOW64.ObjectTypesInformationthrough bounded inline layout and a cached fixed DebugObject type signature, independent of any single field overwritten byReturnLength, and stop at the native returned-byte/count bounds.35eaa4a.Verification
The native contract suite covers unattached and actively debugged processes, restricted process/thread handles, malformed lengths, null and misaligned outputs, fresh/set/create/exited hidden threads, failed context queries, and overlaps with pointers, lengths, inline names, and type indexes, plus an oversized-buffer tail sentinel.
Runtime validation with TitanHide enabled still requires dedicated Windows 7/10/11 VMs with PatchGuard and DSE disabled.