ScyllaHide
Advanced open-source x64/x86 user mode anti-anti-debug library that hides debugging from applications.
What is ScyllaHide?
ScyllaHide is an advanced open-source x64/x86 user mode Anti-Anti-Debug library that hooks various functions to hide debugging activities from applications. It operates entirely in user mode (ring 3) and helps reverse engineers and security researchers analyze software that employs anti-debugging protections. The tool supports multiple debuggers through plugins and can be used standalone with any debugging environment.
Reverse engineers, malware analysts, and security researchers who need to debug protected applications on Windows systems. It's particularly valuable for those working with software that employs anti-debugging techniques.
Developers choose ScyllaHide because it provides comprehensive anti-anti-debugging capabilities while staying entirely in user mode, avoiding the complexities of kernel-mode solutions. Its plugin architecture and standalone flexibility make it adaptable to various debugging workflows.
Overview
Advanced usermode anti-anti-debugger. Forked from https://bitbucket.org/NtQuery/scyllahide
Use Cases
Best For
- Reverse engineering protected Windows applications
- Analyzing malware that employs anti-debugging techniques
- Debugging x64 applications with anti-debug protections
- Security research on software protection mechanisms
- Working with OllyDbg, x64dbg, or IDA debuggers
- User-mode debugging without kernel-mode dependencies
Not Ideal For
- Kernel-mode debugging scenarios, such as analyzing rootkits or drivers, where ring-0 anti-anti-debugging is required.
- Teams using debuggers without native plugin support who prefer integrated GUI tools over command-line injection.
- Projects requiring debugging with minimal performance overhead, as function hooking can introduce latency.
- Environments with cutting-edge anti-debugging techniques that may not be covered by ScyllaHide's current hook set.
Pros & Cons
Pros
Works seamlessly with OllyDbg v1/v2, x64dbg, and IDA through dedicated plugins, as highlighted in the README, reducing setup effort for popular debuggers.
Can be injected into any process debugged by any debugger via the command line version, providing flexibility beyond supported plugins, as noted in the README.
Offers complete PE x64 debugging support with plugins for x64dbg and IDA, crucial for modern 64-bit applications, explicitly mentioned in the features.
Stays entirely in ring 3, avoiding the complexities and stability issues of kernel-mode solutions, per the project philosophy for practical debugging.
Cons
The README states that IDA v6 is not supported, limiting its use with newer versions of this industry-standard debugger and potentially requiring workarounds.
Primary documentation is a PDF from 2019, which may not reflect current features or address recent Windows updates, posing a learning curve for new users.
Cannot counter kernel-mode anti-debugging techniques, as admitted in the README by pointing to TitanHide, limiting effectiveness for advanced threats.
Frequently Asked Questions
Related Projects
GhidraGhidra is a software reverse engineering (SRE) framework
dnSpy.NET debugger and assembly editor
BinwalkFirmware Analysis Tool
angrA powerful and user-friendly binary analysis platform!
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.