ZwCreateThreadEx/HiddenFromDebugger

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar
//In Windows versions that have ntdll.dll exporting NtCreateThreadEx, settings the 7th parameter
//passed to NtCreateThreadEx to 0x4 can cause the new thread to be hidden from debuggers.
#include "stdafx.h"
#include "windows.h"
#include "stdio.h"

struct UNICODE_S
{
    unsigned short len;
    unsigned short max;
    wchar_t* pStr;
};
struct OBJECT_ATTRIBUTES
{
  unsigned long           Length;
  HANDLE                  RootDirectory;
  UNICODE_S*              ObjectName;
  unsigned long           Attributes;
  void*           SecurityDescriptor;
  void*           SecurityQualityOfService;
};

typedef int(__stdcall *FUNC)(HANDLE* hThread,int DesiredAccess,OBJECT_ATTRIBUTES* ObjectAttributes,
HANDLE ProcessHandle,void* lpStartAddress,void* lpParameter,
unsigned long CreateSuspended_Flags,unsigned long StackZeroBits,
unsigned long SizeOfStackCommit,unsigned long SizeOfStackReserve,
void* lpBytesBuffer);

void dummy()
{
    MessageBox(0,"A new thread hidden from debuggers has been created!","waliedassar",0);
    return;
}

void main()
{
    FUNC ZwCreateThreadEx=(FUNC)GetProcAddress(GetModuleHandle("ntdll.dll"),"ZwCreateThreadEx");
    if(ZwCreateThreadEx)
    {
        HANDLE hThread=0;
        ZwCreateThreadEx(&hThread,0x1FFFFF,0,GetCurrentProcess(),&dummy,0,
                        0x4/*HiddenFromDebugger*/,0,0x1000,0x10000,0);
        if(hThread)
        {
            WaitForSingleObject(hThread,INFINITE);
        }
    }
}