-Hide NtGlobalFlag, -Hide ProcessHeapFlag
On XP+ simply add _NO_DEBUG_HEAP=1 to sytem enviroment
-Patch ZwQueryInformationProcess
If second parameter is ProcessDebugPort (7), execute original API, then simply put zero at adress, extracted from thrid parameter.
-ZwSetInformationThread
If second parameter is HideFromDebugger (11h) simply return with stack correction and zero in eax
-Patch CheckRemoteDebuggerPresen
No need to patch coz it uses ZwQueryInformationProcess do detect debugger