{
  "added_at": "2026-11-06",
  "additional_evidence_urls": [
    "https://github.com/x64dbg/ScyllaHide/blob/baa5c8e853ace2bee752631f27fdfe5b271d92f6/Documentation/ScyllaHideDocumentation.tex",
    "https://github.com/x64dbg/ScyllaHide/blob/baa5c8e853ace2bee752631f27fdfe5b271d92f6/LICENSE",
    "https://github.com/x64dbg/ScyllaHide/releases/tag/v1.4",
    "https://github.com/x64dbg/ScyllaHide/releases/download/docs-2019-05-17/ScyllaHide.pdf"
  ],
  "category": "dynamic-analysis",
  "description_en": "User-mode (ring 3) anti-anti-debug library for 32- and 64-bit Windows programs that hooks system functions so the program being debugged cannot detect the debugger. Its documentation covers options for PEB debug flags such as BeingDebugged, NtGlobalFlag and heap flags, threads hidden with ThreadHideFromDebugger, debugger windows and processes found through window and process-list queries, invalid-handle NtClose checks, input blocking, timing checks, hardware-breakpoint detection and exception-based checks; extra options inject DLLs, prevent thread creation and dump processes started RunPE-style. Plugins integrate it with x64dbg, OllyDbg v1 and v2, IDA and TitanEngine, and the standalone InjectorCLI injects its hook library into a process under any debugger.",
  "description_zh": "面向 32 位和 64 位 Windows 程序的用户态（ring 3）反反调试库，通过挂钩系统函数，让被调试程序察觉不到调试器。其文档逐项说明各个选项：处理 BeingDebugged、NtGlobalFlag 和堆标志等 PEB 调试标志，应对借助 ThreadHideFromDebugger 隐藏的线程，在窗口查询和进程列表中隐藏调试器的窗口与进程，应对以无效句柄调用 NtClose 的检测，以及输入屏蔽、计时检测、硬件断点检测和基于异常的检测；附加选项可注入 DLL、阻止创建线程，并转储以 RunPE 方式启动的进程。它以插件形式集成到 x64dbg、OllyDbg v1/v2、IDA 和 TitanEngine，也可用独立的 InjectorCLI 把钩子库注入到任意调试器下的进程。",
  "entry_url": "https://awesomerea.org/resources/scyllahide/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/scyllahide/",
  "evidence_url": "https://github.com/x64dbg/ScyllaHide/blob/baa5c8e853ace2bee752631f27fdfe5b271d92f6/README.md",
  "group": "tools",
  "id": "scyllahide",
  "json_url": "https://awesomerea.org/resources/scyllahide/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/scyllahide/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/scyllahide/index.md",
  "name": "ScyllaHide",
  "name_zh": "ScyllaHide 用户态反反调试库",
  "record_type": "resource",
  "relationship": "foundation",
  "requirement_facets": [
    "prerequisites",
    "limits",
    "license"
  ],
  "requirements": [
    "Windows; release at review: v1.4, published 2023-03-24, with the reviewed master commit dated 2023-07-29. Plugins cover x64dbg, OllyDbg v1 and v2, TitanEngine v2 and IDA; the README lists the IDA v6 plugin as not supported and says PE x64 debugging is fully supported with the x64dbg and IDA plugins.",
    "It works only in user mode, and the README points to TitanHide for kernel-mode (ring 0) anti-anti-debug. Each option targets specific anti-debug checks: the documentation advises enabling the timing, hardware-breakpoint, thread-prevention and NtYieldExecution options only when needed, and using the RunPE unpacker, which terminates and dumps newly created processes, only inside a virtual machine.",
    "GPL-3.0. The project is a fork of the original ScyllaHide repository on Bitbucket; the full manual is a PDF attached to the docs-2019-05-17 release, and its LaTeX source is in Documentation/."
  ],
  "requirements_zh": [
    "需要 Windows；审阅时的版本为 v1.4，于 2023-03-24 发布，所审阅的 master 分支提交日期为 2023-07-29。插件覆盖 x64dbg、OllyDbg v1 和 v2、TitanEngine v2 以及 IDA；README 注明 IDA v6 插件已不再支持，并表示借助 x64dbg 和 IDA 插件可完整支持 PE x64 程序调试。",
    "它只在用户态工作，README 建议需要内核态（ring 0）反反调试时改用 TitanHide。每个选项针对特定的反调试检测：文档建议计时、硬件断点保护、阻止线程创建和 NtYieldExecution 等选项只在确有需要时启用，并且只在虚拟机中使用会终止并转储新建进程的 RunPE 脱壳选项。",
    "采用 GPL-3.0 许可。项目派生自 Bitbucket 上原始的 ScyllaHide 仓库；完整手册是附在 docs-2019-05-17 发布中的 PDF，其 LaTeX 源文件位于 Documentation/ 目录。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/x64dbg/ScyllaHide",
  "verification": "source-reviewed",
  "verified_at": "2026-11-05"
}