An application I am debugging somehow manages to clear my hardware breakpoints. I am using TitanHide and x64dbg.
I am observing the following behaviour:
- When placing the first hw breakpoint, it is hit only once - still appears visible in x64dbg but I guess it is disabled in reality and x64dbg doesn't know that.
- When placing another breakpoint, the first breakpoint is hit exactly once.
I am not sure what causes this obscure behaviour, but what I do know is that my hardware breakpoints are not getting hit, so I researched what could possibly clear them. I have come up with:
- ZwSetInformationThread to hide the thread from the debugger.
- SetThreadContext to reset the debug registers .
- Installing a vectored exception handler, cause an exception deliberately, and modify the context from there
However all 3 methods should be caught by TitanHide, and exceptions should show up in the log of x64dbg (which they don't). Are there any further methods to clear hardware breakpoints?