http://bugs.winehq.org/show_bug.cgi?id=12859
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |focht@gmx.net
--- Comment #4 from Anastasius Focht focht@gmx.net 2008-05-02 04:45:28 --- Hello,
this blog entry gives a possible "use case": http://nsylvain.blogspot.com/2007/08/threadhidefromdebugger-but-why.html
--- quote blog --- Alex_Ionescu said...
It's actually used by RtlQueryProcessDebugInformation when you're querying remote information... the routine creates a remote thread and hides it from the debugger, supposedly to stop the deadlock that would otherwise happen once the debugger receives the thread start routine. --- quote blog ---
Sounds plausible.
--- quote --- This allows programs which employ a common anti-debugging technique under windows to run under wine. --- quote ---
I'm curious ... do you have any example apps? I have yet to see the use of this information class in commercial protections because it's actually easy to "fix" = pretty useless.
Regards