title: Is NtSetInformationThread safe to use?
body: <p>I am attempting to implement some very basic debugger protection to prevent kids from using easy tricks to reverse engineer my software. While these simple measures are easy to bypass, they will at least keep out the uninformed. The following code is from a tutorial online, and I wanted to ask for your opinions as to whether this is safe to use in production code? I am hesitant because of the fact that this function is undocumented by Microsoft and thus may or may not change completely from one version of Windows to another. The last thing I want is for my application to begin crashing on Windows 8, 9, etc because the function signature is wrong.</p>
  
  <p>The code is as follows:</p>
  
  <pre><code>// HideThread will attempt to use
  // NtSetInformationThread to hide a thread
  // from the debugger, Passing NULL for
  // hThread will cause the function to hide the thread
  // the function is running in. Also, the function returns
  // false on failure and true on success
  inline bool HideThread(HANDLE hThread)
  {
  typedef NTSTATUS (NTAPI *pNtSetInformationThread)
              (HANDLE, UINT, PVOID, ULONG);
  NTSTATUS Status;
  
  // Get NtSetInformationThread
  pNtSetInformationThread NtSIT = (pNtSetInformationThread)
      GetProcAddress(GetModuleHandle( TEXT("ntdll.dll") ),
      "NtSetInformationThread");
  
  // Shouldn't fail
  if (NtSIT == NULL)
      return false;
  
  // Set the thread info
  if (hThread == NULL)
      Status = NtSIT(GetCurrentThread(),
              0x11, // HideThreadFromDebugger
              0, 0);
  else
      Status = NtSIT(hThread, 0x11, 0, 0);
  
  if (Status != 0x00000000)
      return false;
  else
      return true;
  }
  </code></pre>
  
  <p>Is this safe to use?</p>
  
  <p>Kind regards,</p>
  
  <p>Philip Bennefall</p>