NtRemoveProcessDebug

Prototype

NTSTATUS NtRemoveProcessDebug(
  HANDLE ProcessHandle,
  HANDLE DebugObjectHandle
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 80 01 00 00      mov eax, 0x180
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Calls DbgkpRemoveProcessDebugObject, which clears EPROCESS.DebugPort, drains the DebugObject's pending-event list and continues any frozen threads. After it returns, the process is once again attachable by an external debugger — this matters when malware wants to *temporarily* hold the debug port and release it once a sensitive code region has finished executing. Returns STATUS_PORT_NOT_SET (0xC000033C) if the process was not actually being debugged by the supplied DebugObject. Unlike NtCreateDebugObject's SSN, this one lives in the high-0x150s/0x180 range and is one of the syscalls that moves *every* feature update — dynamic resolution mandatory.

Common malware usage

Used in two patterns. (1) Time-windowed anti-attach: hold the debug port during unpacking, then release it once execution reaches the long-lived C2 loop — keeps the attack surface for analysts low while the implant is dormant. (2) Self-debug cleanup before a fork-and-run or migrate: the new process inherits an EPROCESS.DebugPort if forked under DEBUG_ONLY_THIS_PROCESS, so loaders explicitly detach before handing off to a clean child. Mostly seen inside commercial protector runtimes (Themida, VMProtect) rather than in commodity crypters.

Detection opportunities

Same provider as NtDebugActiveProcess — Microsoft-Windows-Threat-Intelligence emits an event for debug detach. Far less common in legitimate telemetry than attach: detaches by anything other than windbg.exe / vsjitdebugger.exe / devenv.exe / cdb.exe / a kernel-debugger relay are notable. Always correlate with the matching attach event — orphan detach events with no preceding attach can indicate handle reuse or a debugger that injected via NtCreateDebugObject directly without going through DebugActiveProcess.

Direct syscall examples

// Once the loader has decrypted and resolved imports, release the debug
// port so long-running operations don't have the burden of servicing the
// DebugObject's event loop. Analysts attaching later will succeed — but by
// then the interesting work has already happened.
typedef NTSTATUS(NTAPI* fnNtRemoveProcessDebug)(HANDLE, HANDLE);

void ReleaseSelfDebug(HANDLE hDebugObject) {
    HMODULE n = GetModuleHandleA("ntdll.dll");
    fnNtRemoveProcessDebug pRemove = (fnNtRemoveProcessDebug)
        GetProcAddress(n, "NtRemoveProcessDebug");
    pRemove((HANDLE)-1 /* self */, hDebugObject);
    CloseHandle(hDebugObject);
}

; SSN 0x180 on win11-24h2 / winserver-2025. Moves on every channel update.
NtRemoveProcessDebug PROC
    mov  r10, rcx
    mov  eax, 180h
    syscall
    ret
NtRemoveProcessDebug ENDP

// Detach our DebugObject before doing a fork-and-run so that the child
// process inherits a clean EPROCESS.DebugPort.
use windows_sys::Win32::System::LibraryLoader::{GetModuleHandleA, GetProcAddress};

type NtRemoveProcessDebug = unsafe extern "system" fn(p: isize, d: isize) -> i32;

pub unsafe fn detach(process: isize, debug_object: isize) -> i32 {
    let n = GetModuleHandleA(b"ntdll.dll\0".as_ptr());
    let addr = GetProcAddress(n, b"NtRemoveProcessDebug\0".as_ptr()).unwrap();
    let f: NtRemoveProcessDebug = std::mem::transmute(addr);
    f(process, debug_object)
}

MITRE ATT&CK mappings

• T1622Debugger Evasionmitre ↗
• T1106Native APImitre ↗