ring0--hook NtContinue+source_code

ring0下面hookNtContinue 使用drx7寄存器实现的hook

this code hooks ntoskrnl!NtContinue to set dr7 to 0 (no updating of dr7)

so NtContinue called from ring3 cannot alter drX registers...

This hook will only PREVENT drX clearing from SEH (kiuser->ntcontinue)

and will not alter debugging using ring3 debuggers (olly->SetThreadContext)

mainly developed for personal reasearch and as anti-bpm...





Hook NtContinue (not exported from ntoskrnl.exe but exported in ntdll.dll with service number) to set dr7 to 0 prior to calling original NtContinue so debug registers won t be changed from seh and ring3 code =)



Its use for some targets such as armadillo... but never posted code...

by deroko