New answers tagged


Some possibilities (out of many): 1. The program may call SetThreadContext, or ZwContinue which sets all registers using a new CONTEXT. If the DRx registers are reset then your hardware breakpoints are removed. 2. The program calls ZwSetInformationThread with the 0x11 (ThreadHideFromDebugger) parameter. If the thread is hidden from the debugger then ...

Top 50 recent answers are included