Reverse Engineering ScyllaHide v2020-12-15 - advanced open-source x64/x86 usermode Anti-Anti-Debug library

[itsMe]

ScyllaHide is an advanced open-source x64/x86 usermode Anti-Anti-Debug library. It hooks various functions in usermode to hide debugging. This tool is intended to stay in usermode (ring3).

ScyllaHide supports various debuggers with plugins:

    OllyDbg v1 and v2
    x64dbg
    Hex-Rays IDA v6+
    TitanEngine v2

PE x64 debugging is fully supported with plugins for x64dbg and IDA.

Please note: ScyllaHide is not limited to these debuggers. You can use the standalone commandline version of ScyllaHide. You can inject ScyllaHide in any process debugged by any debugger.

Features

    Anti-Anti-Debug
        Process Environment Block (PEB)
        NtSetInformationThread
        NtSetInformationProcess
        NtQuerySystemInformation
        NtQueryInformationProcess
        NtQueryObject
        NtYieldExecution
        NtCreateThreadEx
        OutputDebugStringA (deprecated since v1.3)
        BlockInput
        NtUserFindWindowEx
        NtUserBuildHwndList
        NtUserQueryWindow
        NtSetDebugFilterState
        NtClose
        Remove Debug Privileges
        Hardware Breakpoint Protection (DRx)
        Timing
        Raise Exception
    Special
        DLL Injection
        Prevent Thread Creation
        RunPE Unpacker
        Improved Attach Dialog
    OllyDbg v1 Specific
        Remove entry point breakpoint
        Fix Olly Bugs
        x64 single-step fix
        Skip Entrypoint outside code
        Ignore bad PE image
        Skip compressed code warning
        Skip ”load dll” warning
        Break on TLS
        Advanced CTRL+G
        Change window caption
        Special Keyboard Shortcuts
        Custom Toolbar
        Exception Problem
    OllyDbg v2 Specific
        Change window caption
    IDA Specific
        Server Option
    x64dbg Specific
    TitanEngine Specific

Changelog v2020-12-15

    Fix regression in x64dbg plugin caused by 9ad0839d. Fixes #115

To see this hidden content, you must like this content.