网站 › 『逆向资源区』 › ScyllaHide 1.2

A-new 发表于 2014-9-29 12:45

ScyllaHide 1.2

海风牛的sod好久没更新了，看到这个也不知道怎么样大家试试
这个有od2.X、ida、x64_dbg 的插件一起发这里算了，不上传了，给链接
ScyllaHide is an open-source x64/x86 usermode Anti-Anti-Debug library. It hooks various functions in usermode to hide debugging. This will stay usermode! For kernelmode hooks use TitanHide.

Debugger Hiding:
- PEB - BeingDebugged, NtGlobalFlag, Heap Flags
- NtSetInformationThread - ThreadHideFromDebugger
- NtQuerySystemInformation - SystemKernelDebuggerInformation, SystemProcessInformation
- NtQueryInformationProcess - ProcessDebugFlags, ProcessDebugObjectHandle, ProcessDebugPort, ProcessBasicInformation, ProcessBreakOnTermination, ProcessHandleTracing
- NtSetInformationProcess - ProcessBreakOnTermination, ProcessHandleTracing
- NtQueryObject - ObjectTypesInformation, ObjectTypeInformation
- NtYieldExecution
- NtSetDebugFilterState
- NtUserBuildHwndList - EnumWindows
- NtUserFindWindowEx - FindWindowA/W, FindWindowExA/W
- NtUserQueryWindow
- NtClose
- NtCreateThreadEx
- BlockInput
- Remove Debug Privileges
- OutputDebugStringA - OutputDebugStringW

Timing Hooks:
- GetTickCount
- GetTickCount64
- GetLocalTime
- GetSystemTime
- NtQuerySystemTimeHook
- NtQueryPerformanceCounter

Special functions:
- prevent Thread creation - for protectors like Execryptor. Only use if you know what you are doing !
- Malware RUNPE Unpacker - Hooks NtResumeThread and terminates + dumps the process created by malware

Protecting and Stealthing DRx (Hardware Breakpoints):
- NtGetContextThread
- NtSetContextThread
- KiUserExceptionDispatcher (only x86)
- NtContinue (only x86)

Hooks:
- Stealth hooks for 32-bit targets (Tested against Themida/VMProtect)
lOllyDbg 1.xx Plugins ：https://tuts4you.com/download.php?view.3596
OllyDbg 2.xx Plugins ：https://tuts4you.com/download.php?view.3560
IDA Plugins：https://tuts4you.com/download.php?view.3597
x64_dbg Plugins：https://tuts4you.com/download.php?view.3598

Godfather.Cr 发表于 2014-9-29 13:06

还是等有大牛汉化吧
E文是硬伤啊{:301_972:}

軒雲閣 发表于 2014-9-29 13:31

最好能打包提供就好了，不过还是要谢谢楼主........

manbajie 发表于 2014-9-30 09:48

全英文啊看不懂的样子

kkkwz 发表于 2014-9-30 11:28

a牛最近身体怎嘛样，好些了，如果以后身体不适，建议你来这个地方看，河北保定满城第二中医院，找武占元大夫，医术绝对可以，论中医排中国前五水平，医术比华佗不差

xxhaishixx 发表于 2015-1-4 02:29

希望汉化啊啊

kevinmou 发表于 2015-4-23 15:23

这个如何到X x64_dbg里呀？我放了没有反应。在x64_dbg里的Plugins菜单里，看不到。

evedeity 发表于 2017-1-29 21:39

这个要怎么在OD里用啊,我把这个都复制到plugin里面了也显示不出来呀

查看完整版本: ScyllaHide 1.2