Terminate DebugActiveProcess or other debugging routines

Question

I kinda want to leave this more as a thought experiment (I asked about it in chat but was directed here). But I can provide code if it will be helpful. Here is the scenario!

Process 1 is running and constantly debugging Process 2, I have injected a DLL into Process 2 and detoured one of the Windows functions it relies on so I can execute my own code. Is there a way from within Process 2 that I can prevent Process 1 from continuing to debug Process 2?

Answer 1

I dont know what do you excatly mean for "preventing debug".

You could avoid debbuger to recive any event related to your process, using NtSetInformationThread

push 0
push 0
push 11h ;ThreadHideFromDebugger
push -2 ;GetCurrentThread() // you can use it on every thread
call NtSetInformationThread

Reference: Peter Ferrie anti debug tricks http://pferrie.host22.com/papers/antidebug.pdf