Some Anti-Attaching Candidate Functions

//http://waleedassar.blogspot.com/
//http://www.twitter.com/waleedassar

Windows XP (32-bit):
KiUserApcDispatcher-calls->LdrInitializeThunk-calls->LdrpInitialize-calls->LdrpInitializeThread
                   -calls->ZwContinue(pContext,..);

N.B. KiUserApcDispatcher, LdrInitializeThunk, and ZwContinue are exported from ntdll.dll.
N.B. In normal threads ZwContinue is called with "EIP" in CONTEXT set to "kernel32!BaseThreadStartThunk"
and "EAX" set to user-defined entrypoint. i.e. BaseThreadStartThunk is reponsible for redirecting
execution to the user-defined entrypoint. But in "DebugActiveProcess" threads "EIP" in CONTEXT is
directly set to the "DbgUiRemoteBreakin" function and "EAX" is set to zero.

N.B. Even though the "BaseThreadStartThunk" function is not exported from kernel32.dll, we can still
resolve its address by creating any process in debugging state CreateProcess(DEBUG_PROCESS) and
inspecting the "lpStartAddress" field of the "CREATE_THREAD_DEBUG_INFO" structure.
-----------------------------------------------------------------
Windows 7 (32-bit):
LdrInitializeThunk-calls->LdrpInitialize-calls->LdrpInitializeThread-->RtlIsCurrentThreadAttachExempt
                                                                    -->LdrpCallInitRoutines
LdrInitializeThunk-calls-> ZwContinue(pContext,..);

N.B. LdrInitializeThunk and ZwContinue are exported from ntdll.dll.
N.B. In normal threads ZwContinue is called with the "EIP" in CONTEXT set to "ntdll!RtlUserThreadStart"
and "EAX" set to user-defined entrypoint i.e. RtlUserThreadStart is responsible for redirecting
execution to the user-defined entrypoint.
But in "DebugActiveProcess" threads, ZwContinue is called directly with "EIP" set to the
"DbgUiRemoteBreakin" function and "EAX" set to zero.
-------------------------------------------------------------------
Windows 7 (64-bit), Wow64 Thread:
ntdll!LdrInitializeThunk-calls->ntdll!LdrpInitialize-calls->Wow64!Wow64LdrpInitialize if(UseWow64)
                                                    -calls->ntdll!LdrpInitializeThread if(!UseWow64)

Wow64LdrpInitialize--calls--->Wow64!ProcessInit (if first thread).
                          --->Context conversion from 64Bit to 32Bit
                          --->Simulation code via. wow64cpu!CpuSimulate-->ntdll32!LdrInitializeThunk and so on.