EXETOOLS FORUM  

Go Back   EXETOOLS FORUM > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #46  
Old 08-22-2014, 11:40
UniSoft's Avatar
UniSoft UniSoft is offline
Family
 
Join Date: May 2010
Location: Temporary in China
Posts: 62
Rept. Given: 20
Rept. Rcvd 245 Times in 34 Posts
Thanks Given: 12
Thanks Rcvd at 102 Times in 19 Posts
UniSoft Reputation: 200-299 UniSoft Reputation: 200-299 UniSoft Reputation: 200-299
In attach normalized resources... i removed all unused STATIC controls.
Attached Files
File Type: zip scyllahide_rc.zip‎ (13.9 KB, 37 views)
Reply With Quote
The Following 3 Users Gave Reputation+1 to UniSoft For This Useful Post:
besoeso (08-22-2014), Carbon (08-23-2014), Storm Shadow (08-22-2014)
  #47  
Old 08-25-2014, 19:03
cypher cypher is offline
Friend
 
Join Date: Mar 2014
Posts: 13
Rept. Given: 0
Rept. Rcvd 9 Times in 4 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
cypher Reputation: 9
Quote:
Originally Posted by UniSoft View Post
There is only one problem, you've made a separate checkBox'es and labels in dialog template, but need to use only checkBox (Set Caption and Left Text = True).
I tried single checkbox with text left before but I got problems with nice aligning and layouting. Thats why I used separate controls. But you seem to got it looking nice with single checkbox thanks hehe
Reply With Quote
  #48  
Old 08-28-2014, 04:10
Carbon Carbon is offline
VIP
 
Join Date: Sep 2013
Posts: 113
Rept. Given: 7
Rept. Rcvd 189 Times in 48 Posts
Thanks Given: 0
Thanks Rcvd at 51 Times in 15 Posts
Carbon Reputation: 100-199 Carbon Reputation: 100-199
Check out the awesome new attach dialog for all debugger plugins! Drag'n'Drop the crosshair to your attach target...

dl: https://bitbucket.org/NtQuery/scyllahide/downloads/ScyllaHide_v1.2.rar

new doc https://bitbucket.org/NtQuery/scyllahide/downloads/ScyllaHidev1.2Doc.pdf

Version 1.2
- All Plugins: New attach dialog with crosshair/bullseye window finder.
- All Plugins: Tooltips with information (unfinished). Thanks to UniSoft!
- Olly v1 Plugin: Fix for faulty handle bug
- Olly v1 Plugin: Fix for NT symbol path bug added to "Fix Olly Bugs", thanks to redblkjck
__________________
My blog: https://ntquery.wordpress.com
Reply With Quote
The Following 7 Users Gave Reputation+1 to Carbon For This Useful Post:
besoeso (08-29-2014), MarcElBichon (08-28-2014), Nukem (08-28-2014), quygia128 (08-28-2014), sendersu (08-28-2014), Storm Shadow (08-28-2014)
  #49  
Old 08-28-2014, 05:11
cypher cypher is offline
Friend
 
Join Date: Mar 2014
Posts: 13
Rept. Given: 0
Rept. Rcvd 9 Times in 4 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
cypher Reputation: 9
since we aim to unify and replace good old plugins phantOm, strongOD, ollyAdvanced into one open-source plugin:

Are there any features by them you still miss in ScyllaHide ? Features you really use and dont want to miss
Reply With Quote
  #50  
Old 08-28-2014, 05:49
Storm Shadow's Avatar
Storm Shadow Storm Shadow is offline
Family
 
Join Date: Jun 2014
Posts: 269
Rept. Given: 186
Rept. Rcvd 191 Times in 78 Posts
Thanks Given: 120
Thanks Rcvd at 190 Times in 65 Posts
Storm Shadow Reputation: 100-199 Storm Shadow Reputation: 100-199
Very cool feture shooting targets.
All work as exepected.
You should add flag
Code:
PLUGIN_FIX |
when loading plugin.
So sculla show in ida plugin at startup. So we dont have to load a file, and then shoot targets.
__________________
The devil whispered in my ear, "you're not strong enough to withstand the storm."

Today I whispered in the devils ear, "I am the storm."
Reply With Quote
  #51  
Old 08-28-2014, 05:51
cypher cypher is offline
Friend
 
Join Date: Mar 2014
Posts: 13
Rept. Given: 0
Rept. Rcvd 9 Times in 4 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
cypher Reputation: 9
Quote:
Originally Posted by Storm Shadow View Post
You should add flag
Code:
PLUGIN_FIX |
when loading plugin.
So sculla show in ida plugin at startup. So we dont have to load a file, and then shoot targets.
I tried that before but its not working because of the way the SDK calls the attach function (forwarder to callui(ui_dbg_attach_process..) = same as entering AttachProcess(pid,-1) in the cmd line), you first need to open a IDB in IDA and then you can attach to any process.
Also make sure you select proper debugger engine in that combobox before ! You CANT attach without opened IDB like IDA can Menu->Debugger->Attach
Reply With Quote
The Following User Gave Reputation+1 to cypher For This Useful Post:
Storm Shadow (08-28-2014)
  #52  
Old 08-28-2014, 06:12
Storm Shadow's Avatar
Storm Shadow Storm Shadow is offline
Family
 
Join Date: Jun 2014
Posts: 269
Rept. Given: 186
Rept. Rcvd 191 Times in 78 Posts
Thanks Given: 120
Thanks Rcvd at 190 Times in 65 Posts
Storm Shadow Reputation: 100-199 Storm Shadow Reputation: 100-199
Well would be alot of work to bypass to gain maybe 5 seconds of file loading.by the way have you seen in the sdk, how to execute commands via the windbg console in scripts / plugins
I searched the idapython api, no result.would be great creating memory dumpers, or writing unpackers scripts..
Maybe there is somwthing in the c ++ end.
__________________
The devil whispered in my ear, "you're not strong enough to withstand the storm."

Today I whispered in the devils ear, "I am the storm."
Reply With Quote
  #53  
Old 08-28-2014, 18:48
quygia128's Avatar
quygia128 quygia128 is offline
Family
 
Join Date: Apr 2011
Location: SomeWhere
Posts: 106
Rept. Given: 233
Rept. Rcvd 182 Times in 47 Posts
Thanks Given: 43
Thanks Rcvd at 9 Times in 5 Posts
quygia128 Reputation: 100-199 quygia128 Reputation: 100-199
Quote:
Originally Posted by cypher View Post
since we aim to unify and replace good old plugins phantOm, strongOD, ollyAdvanced into one open-source plugin.

Great idea, cypher.

Are there any features by them you still miss in ScyllaHide ? Features you really use and dont want to miss
Your plugin is very good so im really like all futures except "Inject Lib", I haven't success any times with any library.(are you test with Inject lib by StrongOD/WeakOD ?)

Maybe place StrongOD you need to make future "More Dump Windows"(StrongOD have 5 windows, would like if we have more dump windows to work with memory)

greets,
quygia128
Reply With Quote
  #54  
Old 08-28-2014, 20:17
cypher cypher is offline
Friend
 
Join Date: Mar 2014
Posts: 13
Rept. Given: 0
Rept. Rcvd 9 Times in 4 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
cypher Reputation: 9
Quote:
Originally Posted by quygia128 View Post
I haven't success any times with any library

Maybe place StrongOD you need to make future "More Dump Windows"(StrongOD have 5 windows, would like if we have more dump windows to work with memory)
hm strange. did you try both normal and stealth injection and with different targets?
we tested this of course and for us its working well

Yes I also like and use the multiple memory dump windows but imho that is alot of work to realize
Reply With Quote
  #55  
Old 08-29-2014, 05:58
Storm Shadow's Avatar
Storm Shadow Storm Shadow is offline
Family
 
Join Date: Jun 2014
Posts: 269
Rept. Given: 186
Rept. Rcvd 191 Times in 78 Posts
Thanks Given: 120
Thanks Rcvd at 190 Times in 65 Posts
Storm Shadow Reputation: 100-199 Storm Shadow Reputation: 100-199
Post

Quote:
Originally Posted by cypher View Post
I tried that before but its not working because of the way the SDK calls the attach function (forwarder to callui(ui_dbg_attach_process..) = same as entering AttachProcess(pid,-1) in the cmd line), you first need to open a IDB in IDA and then you can attach to any process.
Also make sure you select proper debugger engine in that combobox before ! You CANT attach without opened IDB like IDA can Menu->Debugger->Attach
Yeah thats damn wierd , only shows after load of file.

Plugin is shown in start off ida when no file is loaded.

Got attach proccess box up, and ecerything but nothing to attach.


put in pluginfolder

Zullu.py

Code:
import re
import idaapi
import idc
from idc import *
from idaapi import *
import idautils


class Sculla(idaapi.plugin_t):
	flags = idaapi.PLUGIN_PROC | idaapi.PLUGIN_FIX
	comment = "This is a comment"
	help = "Sculla"
	wanted_name = "Sculla"
	wanted_hotkey = "Alt-F7"

	def init(self):
		idaapi.msg("Sculla located")
		return idaapi.PLUGIN_OK

	def run(self, arg):
		idaapi.msg("run() called with %d!\n" % arg)

	def term(self):
		idaapi.msg("")
	
	def run(self, arg = 0):
		import idc	

		idc.LoadDebugger("windbg", 1)

		
		idc.SetProcessorType('metapc', SETPROC_USER) #force cpu
		idaapi.load_and_run_plugin("windbg_user.plw", 0) #force
		idc.LoadDebugger("wingdbg", 1)
		idc.AttachProcess(-1, idaapi.PROCESS_ATTACH)

	
def PLUGIN_ENTRY():
    return Sculla()
Now im getting stubern

i did however get it to show pids adding the code to spu processor and load file, so its maybe not save database independent.
its enoufgh with *.d0 and *.d1 (temp database), or the processor_t that tells it to load a file.
So if you can somehow create the temp databse when attaching it should work. Well i think

EDIT!

actuelly they are there but got no names , since i didnt got the pid names.
Got errot that database is only 16 bits, when using plugin.

proberly need GetProcessPid(idx) and GetProcessName(idx)
And tell pluginbits 32 bit.
__________________
The devil whispered in my ear, "you're not strong enough to withstand the storm."

Today I whispered in the devils ear, "I am the storm."

Last edited by Storm Shadow; 08-29-2014 at 06:28.
Reply With Quote
  #56  
Old 09-14-2014, 23:46
Carbon Carbon is offline
VIP
 
Join Date: Sep 2013
Posts: 113
Rept. Given: 7
Rept. Rcvd 189 Times in 48 Posts
Thanks Given: 0
Thanks Rcvd at 51 Times in 15 Posts
Carbon Reputation: 100-199 Carbon Reputation: 100-199
This is an update for olly v1 only right now.

https://bitbucket.org/NtQuery/scyllahide/downloads/ScyllaHide_v1.3_Olly1.rar

Olly v1:
- custom toolbar for dump and cpu window
- del und insert shortcut
- don't consume exceptions

Olly v1 works now perfectly with EXECryptor, Obsidium and Themida... See documentation -> 1.1.19 Raise Exception, 1.3.13 Exception Problem
https://bitbucket.org/NtQuery/scyllahide/downloads/ScyllaHidev1.3Doc.pdf
__________________
My blog: https://ntquery.wordpress.com
Reply With Quote
The Following 4 Users Gave Reputation+1 to Carbon For This Useful Post:
besoeso (09-15-2014), chessgod101 (09-15-2014), niculaita (09-20-2014)
  #57  
Old 09-20-2014, 01:40
niculaita's Avatar
niculaita niculaita is offline
Family
 
Join Date: Jun 2011
Location: here
Posts: 739
Rept. Given: 756
Rept. Rcvd 81 Times in 53 Posts
Thanks Given: 1,104
Thanks Rcvd at 88 Times in 64 Posts
niculaita Reputation: 81
Oops, you've found a dead link. 1st please reupload ScyllaHide_v1.3_Olly1.rar
Reply With Quote
  #58  
Old 09-20-2014, 02:03
RedBlkJck RedBlkJck is offline
Family
 
Join Date: Oct 2011
Posts: 98
Rept. Given: 66
Rept. Rcvd 80 Times in 43 Posts
Thanks Given: 19
Thanks Rcvd at 6 Times in 5 Posts
RedBlkJck Reputation: 80
Quote:
Originally Posted by niculaita View Post
Oops, you've found a dead link. 1st please reupload ScyllaHide_v1.3_Olly1.rar
https://bitbucket.org/NtQuery/scyllahide/downloads/ScyllaHide_v1.3fix_Olly1.rar
you can view all downloads available directly at
https://bitbucket.org/NtQuery/scyllahide/downloads
Reply With Quote
The Following User Gave Reputation+1 to RedBlkJck For This Useful Post:
niculaita (09-20-2014)
  #59  
Old 07-13-2015, 21:21
Apuromafo Apuromafo is offline
Friend
 
Join Date: Nov 2010
Location: Chile
Posts: 58
Rept. Given: 8
Rept. Rcvd 12 Times in 7 Posts
Thanks Given: 26
Thanks Rcvd at 46 Times in 13 Posts
Apuromafo Reputation: 13
today was used scyllahide, was say this:
Quote:
ERROR
---------------------------
NT APIs missing

section

060200000109_x86_000169B0

file

C:\Users\Pc\Desktop\release\x32\plugins\NtApiCollection.ini
---------------------------
Aceptar
---------------------------

when run ntapi from
https://bitbucket.org/NtQuery/scyllahide/downloads
was show as there if wana add:
Quote:
[060200000109_x86_000169B0]
NtUserQueryWindow=0000B235
NtUserBuildHwndList=0000EA55
NtUserFindWindowEx=0000EBAF
NtUserInternalGetWindowText=00022902
NtUserGetClassName=0000B78D
im runing in w8.1 single language
Reply With Quote
  #60  
Old 09-03-2015, 12:04
Computer_Angel's Avatar
Computer_Angel Computer_Angel is offline
Lo*eXeTools*rd
 
Join Date: Aug 2003
Posts: 151
Rept. Given: 65
Rept. Rcvd 37 Times in 18 Posts
Thanks Given: 7
Thanks Rcvd at 0 Times in 0 Posts
Computer_Angel Reputation: 37
Anyone try using ScyllaHide in win 10 ? I try but could not hide from debugger anymore . Now debugging to find the problem.
__________________
Welcome to my place http://www.reaonline.net
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 03:22.


ICP05004977
vBulletin Security provided by vBSecurity v2.2.0 (Lite) - vBulletin Mods & Addons Copyright © 2017 DragonByte Technologies Ltd.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX