Tool
ScyllaHide
User-mode (ring 3) anti-anti-debug library for 32- and 64-bit Windows programs that hooks system functions so the program being debugged cannot detect the debugger. Its documentation covers options for PEB debug flags such as BeingDebugged, NtGlobalFlag and heap flags, threads hidden with ThreadHideFromDebugger, debugger windows and processes found through window and process-list queries, invalid-handle NtClose checks, input blocking, timing checks, hardware-breakpoint detection and exception-based checks; extra options inject DLLs, prevent thread creation and dump processes started RunPE-style. Plugins integrate it with x64dbg, OllyDbg v1 and v2, IDA and TitanEngine, and the standalone InjectorCLI injects its hook library into a process under any debugger.
- Targets
- Binary
- Category
- Debugging and dynamic analysis
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Prerequisites: Windows; release at review: v1.4, published 2023-03-24, with the reviewed master commit dated 2023-07-29. Plugins cover x64dbg, OllyDbg v1 and v2, TitanEngine v2 and IDA; the README lists the IDA v6 plugin as not supported and says PE x64 debugging is fully supported with the x64dbg and IDA plugins.
- Limits: It works only in user mode, and the README points to TitanHide for kernel-mode (ring 0) anti-anti-debug. Each option targets specific anti-debug checks: the documentation advises enabling the timing, hardware-breakpoint, thread-prevention and NtYieldExecution options only when needed, and using the RunPE unpacker, which terminates and dumps newly created processes, only inside a virtual machine.
- License: GPL-3.0. The project is a fork of the original ScyllaHide repository on Bitbucket; the full manual is a PDF attached to the docs-2019-05-17 release, and its LaTeX source is in Documentation/.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · x64dbg/ScyllaHide · Revision baa5c8e
- Documentation/ScyllaHideDocumentation.tex GitHub · x64dbg/ScyllaHide · Revision baa5c8e
- LICENSE GitHub · x64dbg/ScyllaHide · Revision baa5c8e
- https://github.com/x64dbg/ScyllaHide/releases/tag/v1.4
- https://github.com/x64dbg/ScyllaHide/releases/download/docs-2019-05-17/ScyllaHide.pdf
More in Native binaries
- YARA-X · Tool
- ReClass.NET · Tool
- Keypatch · Tool
- edb-debugger · Tool
- BinNavi · Tool
- flare-emu · Tool