Jump to content
Tuts 4 You

ScyllaHide 1.2

Teddy Rogers

1 Screenshot

About This File

ScyllaHide is an open-source x64/x86 usermode Anti-Anti-Debug library. It hooks various functions in usermode to hide debugging. This will stay usermode! For kernelmode hooks use TitanHide.

Debugger Hiding:

  • PEB - BeingDebugged, NtGlobalFlag, Heap Flags
  • NtSetInformationThread - ThreadHideFromDebugger
  • NtQuerySystemInformation - SystemKernelDebuggerInformation, SystemProcessInformation
  • NtQueryInformationProcess - ProcessDebugFlags, ProcessDebugObjectHandle, ProcessDebugPort, ProcessBasicInformation, ProcessBreakOnTermination, ProcessHandleTracing
  • NtSetInformationProcess - ProcessBreakOnTermination, ProcessHandleTracing
  • NtQueryObject - ObjectTypesInformation, ObjectTypeInformation
  • NtYieldExecution
  • NtSetDebugFilterState
  • NtUserBuildHwndList - EnumWindows
  • NtUserFindWindowEx - FindWindowA/W, FindWindowExA/W
  • NtUserQueryWindow
  • NtClose
  • NtCreateThreadEx
  • BlockInput
  • Remove Debug Privileges
  • OutputDebugStringA - OutputDebugStringW

Timing Hooks:

  • GetTickCount
  • GetTickCount64
  • GetLocalTime
  • GetSystemTime
  • NtQuerySystemTimeHook
  • NtQueryPerformanceCounter

Special functions:

  • Prevent Thread creation - for protectors like Execryptor. Only use if you know what you are doing !
  • Malware RUNPE Unpacker - Hooks NtResumeThread and terminates + dumps the process created by malware

Protecting and Stealthing DRx (Hardware Breakpoints):

  • NtGetContextThread
  • NtSetContextThread
  • KiUserExceptionDispatcher (only x86)
  • NtContinue (only x86)


  • Stealth hooks for 32-bit targets (Tested against Themida/VMProtect)

User Feedback

Recommended Comments

There are no comments to display.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...