Advanced open-source x64/x86 user mode anti-anti-debug library that hides debugging from applications.
ScyllaHide is an advanced open-source x64/x86 user mode Anti-Anti-Debug library that hooks various functions to hide debugging activities from applications. It operates entirely in user mode (ring 3) and helps reverse engineers and security researchers analyze software that employs anti-debugging protections. The tool supports multiple debuggers through plugins and can be used standalone with any debugging environment.
Reverse engineers, malware analysts, and security researchers who need to debug protected applications on Windows systems. It's particularly valuable for those working with software that employs anti-debugging techniques.
Developers choose ScyllaHide because it provides comprehensive anti-anti-debugging capabilities while staying entirely in user mode, avoiding the complexities of kernel-mode solutions. Its plugin architecture and standalone flexibility make it adaptable to various debugging workflows.
Advanced usermode anti-anti-debugger. Forked from https://bitbucket.org/NtQuery/scyllahide
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Works seamlessly with OllyDbg v1/v2, x64dbg, and IDA through dedicated plugins, as highlighted in the README, reducing setup effort for popular debuggers.
Can be injected into any process debugged by any debugger via the command line version, providing flexibility beyond supported plugins, as noted in the README.
Offers complete PE x64 debugging support with plugins for x64dbg and IDA, crucial for modern 64-bit applications, explicitly mentioned in the features.
Stays entirely in ring 3, avoiding the complexities and stability issues of kernel-mode solutions, per the project philosophy for practical debugging.
The README states that IDA v6 is not supported, limiting its use with newer versions of this industry-standard debugger and potentially requiring workarounds.
Primary documentation is a PDF from 2019, which may not reflect current features or address recent Windows updates, posing a learning curve for new users.
Cannot counter kernel-mode anti-debugging techniques, as admitted in the README by pointing to TitanHide, limiting effectiveness for advanced threats.