AwesomeREA.org

Tool

ScyllaHide

User-mode (ring 3) anti-anti-debug library for 32- and 64-bit Windows programs that hooks system functions so the program being debugged cannot detect the debugger. Its documentation covers options for PEB debug flags such as BeingDebugged, NtGlobalFlag and heap flags, threads hidden with ThreadHideFromDebugger, debugger windows and processes found through window and process-list queries, invalid-handle NtClose checks, input blocking, timing checks, hardware-breakpoint detection and exception-based checks; extra options inject DLLs, prevent thread creation and dump processes started RunPE-style. Plugins integrate it with x64dbg, OllyDbg v1 and v2, IDA and TitanEngine, and the standalone InjectorCLI injects its hook library into a process under any debugger.

Targets
Binary
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Prerequisites: Windows; release at review: v1.4, published 2023-03-24, with the reviewed master commit dated 2023-07-29. Plugins cover x64dbg, OllyDbg v1 and v2, TitanEngine v2 and IDA; the README lists the IDA v6 plugin as not supported and says PE x64 debugging is fully supported with the x64dbg and IDA plugins.
  • Limits: It works only in user mode, and the README points to TitanHide for kernel-mode (ring 0) anti-anti-debug. Each option targets specific anti-debug checks: the documentation advises enabling the timing, hardware-breakpoint, thread-prevention and NtYieldExecution options only when needed, and using the RunPE unpacker, which terminates and dumps newly created processes, only inside a virtual machine.
  • License: GPL-3.0. The project is a fork of the original ScyllaHide repository on Bitbucket; the full manual is a PDF attached to the docs-2019-05-17 release, and its LaTeX source is in Documentation/.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · x64dbg/ScyllaHide · Revision baa5c8e
  2. Documentation/ScyllaHideDocumentation.tex GitHub · x64dbg/ScyllaHide · Revision baa5c8e
  3. LICENSE GitHub · x64dbg/ScyllaHide · Revision baa5c8e
  4. https://github.com/x64dbg/ScyllaHide/releases/tag/v1.4
  5. https://github.com/x64dbg/ScyllaHide/releases/download/docs-2019-05-17/ScyllaHide.pdf

More in Native binaries

All 166 entries in Native binaries