ScyllaHide for IDA 7

m4n0w4r

ScyllaHide for IDA 7
ScyllaHide is an advanced open-source x64/x86 usermode Anti-Anti-Debug library. Experimental IDA7 support
Deployment
You need to deploy following files:

• HookLibraryx64.dll (at IDA7 folder)
• HookLibraryx86.dll (at IDA7 folder)
• InjectorCLIx64.exe (at IDA7's plugins folder)
• InjectorCLIx86.exe (at IDA7's plugins folder)
• NtApiCollection.ini (at IDA7's plugins folder)
• scylla_hide.ini (at IDA7's plugins folder)
• ScyllaHideForIda7Plugin.dll (at IDA7's plugins folder)
• ScyllaHideForIda7Plugin64.dll (at IDA7's plugins folder)
  

How it works
It uses InjectorCLI to inject HookLibrary when debugger starts or attaches.
No remote debugging is supported and no GUI options.For now change parameters manually in scylla_hide.ini






More info:  https://github.com/vdisasm/ScyllaHideForIda7

m4n0w4r

This plugin can PatchLocalWin32DebuggerPlugin when using IDA7 with the latest Win10

// IDA 7.0 for 32-bit bases
                // Error 1491 on debugger start (happens on adding modules to list)
// It is not proper solution, but makes it possible to test plugin.

chlygxy113

thank you

pojieit

看起来不错，非常感谢！

wapjywq751

虽然看不懂，还是要学习

hrdom

good东西不错，谢谢分享。

聪本

还有这种操作，赞一个。

test1550

好奇怪，插件显示已经激活，但是用scylla自带的test还是没有隐藏，请问楼主有测试过么？
还有，都过了2年多了，有没有IDA7.5的scyllahide？