I'm working on a program that has lots of checks, and I've decided to start by disabling their anti-kernel mode, as it'd surely be more easy to isolate than normal anti-debugging. After poking around a little, I found that ntdll.zwquerysysteminformation runs in a loop in the main thread called by several .vmp addresses. Since I can't make memory changes, even in DLLs (or debug it normally), I was thinking about setting up kernel mode breakpoints until I have a bit more to go off of, but to do that, I'd need the offset from the base structure containing the byte. Microsoft doesn't seem to provide this, so would anyone happen to know? Or maybe have general pointers on getting past kernel mode detection in obfuscated targets? I know this is pretty broad, but I'm pretty sure they'd only have used the most basic of methods.
Anti-kernelmode functions (specifically zwquerysysteminformation)
disassembly;debuggers;kernel mode
I think the check you're talking about (NtQuerySystemInformation with SystemKernelDebuggerInformation) simply checks KdDebuggerEnabled and KdDebuggerNotPresent under the hood (both are single bytes exported from ntoskrnl.exe). You could simply patch those two to get past that particular check. Alternatively, you could go for hooking NtQuerySystemInformation either in usermode (you've mentioned that you can't make memory changes, but that's usually not true - if a memory change at some location is detected, then make the change somewhere else) or in kernelmode (requiring a PatchGuard bypass on 64-bit systems).However, your kernel debugger might still be detected by its window/driver name.