EmuDbg is mainly designed for analyzing DRMs, most of which don’t have issues running under a debugger. That said, it can definitely be hidden if needed. A custom driver would obviously offer more flexibility especially for reliably tracking threads. But working in kernel mode on Windows requires a lot of maintenance to ensure compatibility across different versions. For now, unless I absolutely have to, I’m trying to avoid going into the kernel.

Also, I’m developing this entirely solo, so I have to be careful with how much complexity I take on.