Exetools - ScyllaHide

Page 2 of 3

Show 40 post(s) from this thread on one page

Exetools (https://forum.exetools.com/index.php)

- Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)

- - ScyllaHide (https://forum.exetools.com/showthread.php?t=15712)

jump	08-18-2014 23:35

Does it support any version of IDA or specific version ?

Carbon

08-19-2014 00:38

ScyllaHide is tested with IDA Pro 6.1, 6.3 and 6.5.

Storm Shadow

08-20-2014 05:03

Plugin is running like a charm, and hiding very well.
Would it be possible to add the very nice pdf , as tooltips to the combo box explaining each item in future versions.
Im using the ida version.

Regards

Carbon

08-22-2014 02:31

@Storm Shadow

I don't think it is necessary to add tooltips. This is a lot of work for a very little usability increase

@ALL
There is a mistake in the provided Themida configuration!!! You must enable all NtUser* hooks for Themida! This is missing in the standard configuration.

NtUserBuildHwndListHook=1
NtUserFindWindowExHook=1
NtUserQueryWindowHook=1

The Olly v1 plugin was updated with a little olly bugfix.
https://bitbucket.org/NtQuery/scyllahide/downloads/ScyllaHideOllyv1_v1.2.rar

And doc update:
https://bitbucket.org/NtQuery/scyllahide/downloads/ScyllaHidev1.2Doc.pdf
(e.g. more info about RunPE)

UniSoft

08-22-2014 07:32

1 Attachment(s)

Quote:

Originally Posted by Carbon (Post 93937)

I don't think it is necessary to add tooltips. This is a lot of work for a very little usability increase

indeed it is not too much work!
Check in attach... By the way maybe someone can help to fill all the tips.
There is only one problem, you've made a separate checkBox'es and labels in dialog template, but need to use only checkBox (Set Caption and Left Text = True).

UniSoft

08-22-2014 11:40

1 Attachment(s)

In attach normalized resources... i removed all unused STATIC controls.

cypher

08-25-2014 19:03

Quote:

Originally Posted by UniSoft (Post 93944)

There is only one problem, you've made a separate checkBox'es and labels in dialog template, but need to use only checkBox (Set Caption and Left Text = True).

I tried single checkbox with text left before but I got problems with nice aligning and layouting. Thats why I used separate controls. But you seem to got it looking nice with single checkbox :) thanks hehe

Carbon

08-28-2014 04:10

Check out the awesome new attach dialog for all debugger plugins! Drag'n'Drop the crosshair to your attach target...

dl: https://bitbucket.org/NtQuery/scyllahide/downloads/ScyllaHide_v1.2.rar

new doc https://bitbucket.org/NtQuery/scyllahide/downloads/ScyllaHidev1.2Doc.pdf

Version 1.2
- All Plugins: New attach dialog with crosshair/bullseye window finder.
- All Plugins: Tooltips with information (unfinished). Thanks to UniSoft!
- Olly v1 Plugin: Fix for faulty handle bug
- Olly v1 Plugin: Fix for NT symbol path bug added to "Fix Olly Bugs", thanks to redblkjck

cypher

08-28-2014 05:11

since we aim to unify and replace good old plugins phantOm, strongOD, ollyAdvanced into one open-source plugin:

Are there any features by them you still miss in ScyllaHide ? Features you really use and dont want to miss

Storm Shadow

08-28-2014 05:49

Very cool feture shooting targets.:)
All work as exepected.
You should add flag

Code:

PLUGIN_FIX |

when loading plugin.
So sculla show in ida plugin at startup. So we dont have to load a file, and then shoot targets:D.

cypher

08-28-2014 05:51

Quote:

Originally Posted by Storm Shadow (Post 94209)

You should add flag

Code:

PLUGIN_FIX |

when loading plugin.
So sculla show in ida plugin at startup. So we dont have to load a file, and then shoot targets:D.

I tried that before but its not working because of the way the SDK calls the attach function (forwarder to callui(ui_dbg_attach_process..) = same as entering AttachProcess(pid,-1) in the cmd line), you first need to open a IDB in IDA and then you can attach to any process.
Also make sure you select proper debugger engine in that combobox before ! You CANT attach without opened IDB like IDA can Menu->Debugger->Attach

Storm Shadow

08-28-2014 06:12

Well would be alot of work to bypass to gain maybe 5 seconds of file loading.by the way have you seen in the sdk, how to execute commands via the windbg console in scripts / plugins
I searched the idapython api, no result.would be great creating memory dumpers, or writing unpackers scripts..
Maybe there is somwthing in the c ++ end.

quygia128

08-28-2014 18:48

Quote:

Originally Posted by cypher (Post 94208)

since we aim to unify and replace good old plugins phantOm, strongOD, ollyAdvanced into one open-source plugin.

Great idea, cypher.

Are there any features by them you still miss in ScyllaHide ? Features you really use and dont want to miss

Your plugin is very good so im really like all futures except "Inject Lib", I haven't success any times with any library.(are you test with Inject lib by StrongOD/WeakOD ?)

Maybe place StrongOD :) you need to make future "More Dump Windows"(StrongOD have 5 windows, would like if we have more dump windows to work with memory)

greets,
quygia128

cypher

08-28-2014 20:17

Quote:

Originally Posted by quygia128 (Post 94221)

I haven't success any times with any library

Maybe place StrongOD :) you need to make future "More Dump Windows"(StrongOD have 5 windows, would like if we have more dump windows to work with memory)

hm strange. did you try both normal and stealth injection and with different targets?
we tested this of course and for us its working well

Yes I also like and use the multiple memory dump windows but imho that is alot of work to realize

Storm Shadow

08-29-2014 05:58

Quote:

Originally Posted by cypher (Post 94210)

Yeah thats damn wierd , only shows after load of file.

Plugin is shown in start off ida when no file is loaded.

Got attach proccess box up, and ecerything but nothing to attach. :D

put in pluginfolder

Zullu.py

Code:

import re

import idaapi

import idc

from idc import *

from idaapi import *

import idautils





class Sculla(idaapi.plugin_t):

        flags = idaapi.PLUGIN_PROC | idaapi.PLUGIN_FIX

        comment = "This is a comment"

        help = "Sculla"

        wanted_name = "Sculla"

        wanted_hotkey = "Alt-F7"



        def init(self):

                idaapi.msg("Sculla located")

                return idaapi.PLUGIN_OK



        def run(self, arg):

                idaapi.msg("run() called with %d!\n" % arg)



        def term(self):

                idaapi.msg("")

        

        def run(self, arg = 0):

                import idc        



                idc.LoadDebugger("windbg", 1)



                

                idc.SetProcessorType('metapc', SETPROC_USER) #force cpu

                idaapi.load_and_run_plugin("windbg_user.plw", 0) #force

                idc.LoadDebugger("wingdbg", 1)

                idc.AttachProcess(-1, idaapi.PROCESS_ATTACH)



        

def PLUGIN_ENTRY():

    return Sculla()

Now im getting stubern :)

i did however get it to show pids adding the code to spu processor and load file, so its maybe not save database independent.
its enoufgh with *.d0 and *.d1 (temp database), or the processor_t that tells it to load a file.
So if you can somehow create the temp databse when attaching it should work. Well i think :rolleyes:

EDIT!

actuelly they are there but got no names , since i didnt got the pid names.
Got errot that database is only 16 bits, when using plugin.

proberly need GetProcessPid(idx) and GetProcessName(idx)
And tell pluginbits 32 bit.

Carbon

09-14-2014 23:46

This is an update for olly v1 only right now.

https://bitbucket.org/NtQuery/scyllahide/downloads/ScyllaHide_v1.3_Olly1.rar

Olly v1:
- custom toolbar for dump and cpu window
- del und insert shortcut
- don't consume exceptions

Olly v1 works now perfectly with EXECryptor, Obsidium and Themida... See documentation -> 1.1.19 Raise Exception, 1.3.13 Exception Problem
https://bitbucket.org/NtQuery/scyllahide/downloads/ScyllaHidev1.3Doc.pdf

niculaita

09-20-2014 01:40

Oops, you've found a dead link. 1st please reupload ScyllaHide_v1.3_Olly1.rar

RedBlkJck

09-20-2014 02:03

Quote:

Originally Posted by niculaita (Post 94681)

Oops, you've found a dead link. 1st please reupload ScyllaHide_v1.3_Olly1.rar

https://bitbucket.org/NtQuery/scyllahide/downloads/ScyllaHide_v1.3fix_Olly1.rar
you can view all downloads available directly at
https://bitbucket.org/NtQuery/scyllahide/downloads

Apuromafo

07-13-2015 21:21

today was used scyllahide, was say this:

Quote:

ERROR
---------------------------
NT APIs missing

section

060200000109_x86_000169B0

file

C:\Users\Pc\Desktop\release\x32\plugins\NtApiCollection.ini
---------------------------
Aceptar
---------------------------

when run ntapi from
https://bitbucket.org/NtQuery/scyllahide/downloads
was show as there if wana add:

Quote:

[060200000109_x86_000169B0]
NtUserQueryWindow=0000B235
NtUserBuildHwndList=0000EA55
NtUserFindWindowEx=0000EBAF
NtUserInternalGetWindowText=00022902
NtUserGetClassName=0000B78D

im runing in w8.1 single language

Computer_Angel

09-03-2015 12:04

Anyone try using ScyllaHide in win 10 ? I try but could not hide from debugger anymore :(. Now debugging to find the problem.

Computer_Angel

09-04-2015 11:58

Alot changes in ntdll in windows 10 make scyllahide failed to hook functions in ntdll.
Example:

NtQueryInformationProcess

Code:

CPU Disasm

Address   Hex dump          Command                                  Comments

77768D50    B8 19000000     MOV EAX,19                               ; NTSTATUS ntdll.NtQueryInformationProcess(ProcessHandle,ProcessInfoClass,Buffer,Bufsize,pLength)

77768D55    E8 04000000     CALL ntdll.77768D5E

77768D5A    0000            ADD BYTE PTR DS:[EAX],AL

77768D5C    70 77           JO SHORT ntdll.77768DD5

77768D5E    5A              POP EDX

77768D5F    807A 03 4B      CMP BYTE PTR DS:[EDX+3],4B

77768D63    75 0A           JNE SHORT ntdll.77768D6F

77768D65    64:FF15 C000000 CALL DWORD PTR FS:[0C0]

77768D6C    C2 1400         RETN 14

NtSetInformationThread

Code:

CPU Disasm

Address   Hex dump          Command                                  Comments

77768C90    B8 0D000000     MOV EAX,0D

77768C95    BA B0D57777     MOV EDX,ntdll.7777D5B0

77768C9A    FFD2            CALL EDX

77768C9C    C2 1000         RETN 10

Call Wow64SystemServiceCall

Code:

CPU Disasm

Address   Hex dump          Command                                  Comments

7777D5B0    64:8B15 3000000 MOV EDX,DWORD PTR FS:[30]

7777D5B7    8B92 54020000   MOV EDX,DWORD PTR DS:[EDX+254]

7777D5BD    F7C2 02000000   TEST EDX,00000002

7777D5C3    74 03           JE SHORT ntdll.7777D5C8

7777D5C5    CD 2E           INT 2E

7777D5C7    C3              RETN

7777D5C8    EA CFD57777 330 JMP FAR 0033:7777D5CF                    ; Far jump or call

7777D5CF    41              INC ECX

7777D5D0    FFA7 F8000000   JMP DWORD PTR DS:[EDI+0F8]

ragdog

09-04-2015 15:56

Quote:

Anyone try using ScyllaHide in win 10 ? I try but could not hide from debugger anymore . Now debugging to find the problem.

Is ScyllaHide compatible with Win 10?

Regards,

Computer_Angel

09-04-2015 16:05

Quote:

Originally Posted by ragdog (Post 101530)

Is ScyllaHide compatible with Win 10?

Regards,

Nopes. There's a lot of change. First need to fix the remote hook feature.

Carbon

09-05-2015 00:19

Win 10 is a nightmare for "stealth" hooking. Probably they wanted to defeat malware.

I think I can work on it this weekend.

Computer_Angel

09-07-2015 13:15

Call Wow64SystemServiceCall now is seperate for Ntdll & User32.dll .. maybe other dll too. So need to change the NativeContinue structure to suit this.

Carbon

09-08-2015 02:09

Win10 has more surprises to offer:

https://ntquery.wordpress.com/2015/09/07/windows-10-new-anti-debug-outputdebugstringw/

I also see some weird behavior of NtQueryInformationProcess. You can query ProcessBasicInformation with different buffer sizes.

size = 24 -> normal behavior, expected size like in all windows editions
size = 32 -> extended information? You can get more information...

Storm Shadow

12-11-2015 03:05

@Carbon is there any update on making this working win 10.

mudlord

04-21-2016 10:41

Don't ask questions, here is fixed ScyllaHide for Windows 10 x86/x64.
Tested with x64/x32dbg on VMProtect and Obsidium targets.

Quote:

http://rghost.net/69ndDMkDg

mr.exodia

04-22-2016 09:46

This is the version of ScyllaHide that I use personally. It includes the fix provided by mudlord in the previous post (fix made by Colin). I also push this to the 'vs13' branch on the original repository.

Code:
https://github.com/x64dbg/ScyllaHide

Build of the latest version is always available here:
https://ci.appveyor.com/project/mrex...uild/artifacts

Syoma

08-26-2016 19:30

Quote:

WRONG!!! Size of IDA_SERVER_EXCHANGE 648 == 645?

Does it need the special update?

Storm Shadow

08-26-2016 20:23

Quote:

Originally Posted by Syoma (Post 106762)

Does it need the special update?

I get same error in the newest version.

sendersu

08-27-2016 06:01

The error comes from idaserver.cpp:

Code:

int main(int argc, char *argv[])

{

        LogWrap = LogWrapper;

        LogErrorWrap = LogWrapper;



        if (sizeof(IDA_SERVER_EXCHANGE) != IDA_SERVER_EXCHANGE_STRUCT_SIZE)

        {

                printf("WRONG!!! Size of IDA_SERVER_EXCHANGE %d == %d?\n\n", sizeof(IDA_SERVER_EXCHANGE), IDA_SERVER_EXCHANGE_STRUCT_SIZE);

                getchar();

                return 0;

        }

mr.exodia

08-28-2016 19:19

Probably this can be fixed by updating the SDK to the same version as your IDA version...

sendersu

08-29-2016 04:57

I guess these days everybody has already switched to the latest public IDA...
six dot eight :)

BTW, anybody seen this kind of warning (error?) in IDA:

---------------------------
Error
---------------------------
Failed to unprotect WOW64 gateway
---------------------------
OK
---------------------------

Kla$	08-29-2016 21:56

Please fix bug on update Windows 10 in ollydbg1 and ollydbg2
thank you in advance

---------------------------
Error
---------------------------
Windows 10 SysWowSpecialJmpAddress was not found!
---------------------------
��
---------------------------

---------------------------
ERROR
---------------------------
Unknown syscall structure!
---------------------------
��
---------------------------

Storm Shadow

08-30-2016 23:33

Quote:

Originally Posted by sendersu (Post 106772)

The error comes from idaserver.cpp:

Code:

int main(int argc, char *argv[])

{

        LogWrap = LogWrapper;

        LogErrorWrap = LogWrapper;



        if (sizeof(IDA_SERVER_EXCHANGE) != IDA_SERVER_EXCHANGE_STRUCT_SIZE)

        {

                printf("WRONG!!! Size of IDA_SERVER_EXCHANGE %d == %d?\n\n", sizeof(IDA_SERVER_EXCHANGE), IDA_SERVER_EXCHANGE_STRUCT_SIZE);

                getchar();

                return 0;

        }

changing https://github.com/x64dbg/ScyllaHide/blob/b76835ab75ac384bedccb59119d972997c6d61aa/ScyllaHideIDAServer/IdaServerExchange.h#L89 to 648 will fix this error.
However it will break it for those that don't use the same ida version as you.
So one would need to do a pull request with a loop for making it work with each new version.

Quote:

Please fix bug on update Windows 10 in ollydbg1 and ollydbg2
thank you in advance

---------------------------
Error
---------------------------
Windows 10 SysWowSpecialJmpAddress was not found!

Last aniversary update made alot of changes to win 10.So it wont work on win 10.

Storm Shadow

08-31-2016 01:51

Little update

after crash with ida and after debugging it.
it seem to make a x64 hook first in a x86 app and idaserverx86
and some more problems

1 bug)
it crashes cause it attempts to make x64 connection in a x86 app

fails on

Code:

IDAServerx86.exe!DetourCreateRemoteNativeSysWow64(void * hProcess, void * lpFuncOrig, void * lpFuncDetour, bool createTramp, unsigned long * backupSize)  Line 356 + 0x5 bytes

but not on

Code:

 IDAServerx86.exe!DetourCreateRemoteNative32(void * hProcess, void * lpFuncOrig, void * lpFuncDetour, bool createTramp, unsigned long * backupSize)  Line 532 + 0x1a bytes  C++

i forwarded line 350-354 for spaces
https://github.com/x64dbg/ScyllaHide...k.cpp#L350-354
Not sure why , but i am a python guy.
It seems to jump to x86 hook insteed of the x64, but a smart person told me that it should not matter in c++.

suggestions:
Maybe dev should use

Code:

If __EA64__ 

    call x64



else:

    call x86

2 bug)
also i saw port access violation

In win 10 even if you have a firewall you bought you have to open ports in the internal win 10 one, even if disabled.
in start menu type WF.msc open udp-tcp port 1337.

3 bug)
and for fixing the structure error for now
untick NTQueryInformationprocess in scyllahide settings

result

Code:

Listening on port 1337...

Accepted Client 1

[ScyllaHide] Hook Injection successful, Imagebase 001D0000

nocturo

09-20-2016 22:45

I thought I was doing something wrong, then I found out this thread! Win10 (anniversary update) + x64dbg doesn't crash, but gives:
NT APIs missing section
060200000109_x86_0000A830
file NtApiCollection.ini.

I used scyllahide from link on x64dbg page (bitbucket link). Hopefully someone can make win10 a platform for RE. Thanks!

mudlord

10-05-2016 13:05

I did some testing.

https://github.com/x64dbg/ScyllaHide/issues/2

Seems there is junk bytes at Win10 Anniversary's NtQueryInformationProcess call as well as a different signature. The code leading to the gateway is a JMP to the jmp (so two jmps) to the gateway, whereas Win8.1 is a simple jmp. More details are at that issue link.

Quote:

Originally Posted by Kla$ (Post 106828)

That bug I managed to fix, but I haven't checked the remaining ones. There was also changes for 3 APIs that are enough for Obsidium and Themida targets to be detected. So far for me, managed to get VMP debugged.

SKiLLa

10-20-2016 00:01

It seems last month's Windows Updates for 8.1 (x64) also broke the NtApiCollection.ini PDB resolvers. It was working fine until I ran the updates, rebooted and started x64dbg. When it complained about missing "NTUser* API addresses, Section: 060300000109_x86_000158A0" I ran both PDB resolvers (as admin) and copied over the fresh .ini file, but not all API addresses were resolved properly. Just to be sure I also updated x64dbg to the latest commit, but without success ...

All times are GMT +8. The time now is 12:11.

Page 2 of 3

Show 40 post(s) from this thread on one page