Unwinder, another approach to Thread Stack Spoofing by walking PE's unwind information. This technique allows to automatically create "any" desired call stack by parsing .pdata structures.
It took me a little bit longer than expected, but worth the effort!
Conversation
Not bad! The last piece you're missing from the one I presented in the original thread is a ROP gadget (like this: unknowncheats.me/forum/anti-che ) you can use to desynchronize unwinding from real control flow. Using such you can completely eliminate your module from the stack trace.
Hey! Well, that's a really good idea, I was thinking on hardware breakpoints to hide the module from the stack, but since I've been playing with ROP lately I think i will try your approach. Thank you for the advice, once again ;)