Do not attempt to hook NtSetContextThread if the call is coming from …

…kernel mode

*Zw*Get/SetContextThread behaves very differently from *Nt*Get/SetContextThread; e.g. calling ZwSetContextThread will modify a thread's kernel trap frame rather than the user mode CONTEXT structure that the Nt syscall expects. Modifying the KTRAP_FRAME is a good way to kill a thread and probably the rest of the OS with it

TitanHide/hooks.cpp

@@ -292,7 +292,8 @@ static NTSTATUS NTAPI HookNtSetContextThread(
     IN PCONTEXT Context)
 {
     ULONG pid = (ULONG)PsGetCurrentProcessId();
-    bool IsHidden = Hider::IsHidden(pid, HideNtSetContextThread);
+    KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
+    bool IsHidden = PreviousMode != KernelMode && Hider::IsHidden(pid, HideNtSetContextThread);
     ULONG OriginalContextFlags = 0;
     if(IsHidden)
     {