New IDAStealth release - now including full source code

Bugs...and more bugs

A new version of IDAStealth - namely v1.0 Beta 2 - is now available.
Thanks to Peter Ferrie, a lot of bugs have been fixed, which could ultimately be used to unveil the presence of an attached debugger, even if the plugin was running and the appropriate stealth technique was activated.
Most errors outlined by Peter were due to improper input checking of parameters to hooked functions or incorrect return values, being an indication for the presence of IDA Stealth.
For instance, many API hooks didn't check if the supplied handle was invalid, so IDAStealth could easily be unveiled by passing an invalid handle to the API and checking if the function returned successfully.
Besides some functions didn't sanitize input buffers or returned successfully although improper parameters were supplied by the caller. There were also some minor really stupid bugs, such as that NtSetInformationThread wasn't hooked at all, because i mistyped the function name which was then passed to the hooking library (which in turn didn't hook anything because the function couldn't be resolved).
Although most of the bugs were really due to my laziness to create a perfect stealth plugin, some weren't really that obvious. You might want to have a look at the changelog or download the source code which is available by this time.

Source Code

The plugin now comes with full source code and can be build from scratch if you get some additional libraries. For details consult the IDAStealth page.
If you have questions, suggestions or find additional bugs, please contact me.