I'm sure many of you are familiar with this classic antidebug trick accomplished by calling
ThreadInformationClass set to 0x11. Although many OllyDbg modules exist for the purposes of revealing the existence of threads hidden with this method, I haven't been able to find any information on the canonical technique employed to unhide these threads in OllyDbg.
Is the function generally hooked in user mode (e.g
SetWindowsHookEx), or is it more pragmatic to patch instructions that either call the NTDLL function directly or system calls which indirectly invoke it?