# ScyllaHide

> User-mode (ring 3) anti-anti-debug library for 32- and 64-bit Windows programs that hooks system functions so the program being debugged cannot detect the debugger. Its documentation covers options for PEB debug flags such as BeingDebugged, NtGlobalFlag and heap flags, threads hidden with ThreadHideFromDebugger, debugger windows and processes found through window and process-list queries, invalid-handle NtClose checks, input blocking, timing checks, hardware-breakpoint detection and exception-based checks; extra options inject DLLs, prevent thread creation and dump processes started RunPE-style. Plugins integrate it with x64dbg, OllyDbg v1 and v2, IDA and TitanEngine, and the standalone InjectorCLI injects its hook library into a process under any debugger.

- Type: Tool
- Targets: Binary
- Category: Debugging and dynamic analysis
- Relationship: Foundation tool
- Sources reviewed: 2026-11-05
- Added to the catalog: 2026-11-06
- Original resource: <https://github.com/x64dbg/ScyllaHide>
- Primary source: <https://github.com/x64dbg/ScyllaHide/blob/baa5c8e853ace2bee752631f27fdfe5b271d92f6/README.md>
- Catalog page: <https://awesomerea.org/resources/scyllahide/>
- Record JSON: <https://awesomerea.org/resources/scyllahide/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/scyllahide/index.md)

## Requirements & limits

- **Prerequisites:** Windows; release at review: v1.4, published 2023-03-24, with the reviewed master commit dated 2023-07-29. Plugins cover x64dbg, OllyDbg v1 and v2, TitanEngine v2 and IDA; the README lists the IDA v6 plugin as not supported and says PE x64 debugging is fully supported with the x64dbg and IDA plugins.
- **Limits:** It works only in user mode, and the README points to TitanHide for kernel-mode (ring 0) anti-anti-debug. Each option targets specific anti-debug checks: the documentation advises enabling the timing, hardware-breakpoint, thread-prevention and NtYieldExecution options only when needed, and using the RunPE unpacker, which terminates and dumps newly created processes, only inside a virtual machine.
- **License:** GPL-3.0. The project is a fork of the original ScyllaHide repository on Bitbucket; the full manual is a PDF attached to the docs-2019-05-17 release, and its LaTeX source is in Documentation/.

## Primary sources

1. <https://github.com/x64dbg/ScyllaHide/blob/baa5c8e853ace2bee752631f27fdfe5b271d92f6/README.md>
2. <https://github.com/x64dbg/ScyllaHide/blob/baa5c8e853ace2bee752631f27fdfe5b271d92f6/Documentation/ScyllaHideDocumentation.tex>
3. <https://github.com/x64dbg/ScyllaHide/blob/baa5c8e853ace2bee752631f27fdfe5b271d92f6/LICENSE>
4. <https://github.com/x64dbg/ScyllaHide/releases/tag/v1.4>
5. <https://github.com/x64dbg/ScyllaHide/releases/download/docs-2019-05-17/ScyllaHide.pdf>

## More in Native binaries

- [YARA-X](https://awesomerea.org/resources/yara-x/index.md) · Tool
- [ReClass.NET](https://awesomerea.org/resources/reclass-net/index.md) · Tool
- [Keypatch](https://awesomerea.org/resources/keypatch/index.md) · Tool
- [edb-debugger](https://awesomerea.org/resources/edb-debugger/index.md) · Tool
- [BinNavi](https://awesomerea.org/resources/binnavi/index.md) · Tool
- [flare-emu](https://awesomerea.org/resources/flare-emu/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.