Exetools

Exetools (https://forum.exetools.com/index.php)
-   Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)
-   -   ScyllaHide (https://forum.exetools.com/showthread.php?t=15712)

ZeNiX 04-15-2014 17:37

Problem solved.
After downloaded the symbols, we need to use pdb-getprocaddress to get three addresses.

In my system, they are...

[060200000109_x86_000162F9]
NtUserQueryWindow=00009965
NtUserBuildHwndList=0000FBB1
NtUserFindWindowEx=0000804C

Carbon 04-16-2014 03:03

Thanks ZeNiX, I added it here:
https://bitbucket.org/NtQuery/pdb-getprocaddress/commits/8ac27b0c21d3df3b95e775afff24ad993fc492d8

If somebody wants to share his config, please do it :D

DMichael 04-16-2014 05:05

heres mine:
[060200000100_x86_00025FBF]
NtUserQueryWindow=00008CC1
NtUserBuildHwndList=00011DC3
NtUserFindWindowEx=00007757
NtUserInternalGetWindowText=0000CC60
NtUserGetClassName=00008CE3

Carbon 04-17-2014 20:44

Version 0.3

- Fix for Olly plugins caption reset
- Fix STARTUPINFO structure, GetStartupInfoA/W
- Resume/Suspend all Threads in Thread window
- x64 compatibility mode for Olly1
- fix PE-Bugs for Olly1
- fix FPU-Bug for Olly1
- split "Protect DRx" into its options (ini option ProtectDRx now deprecated)
- Fix PEB Patch bug, now Themida works on WinXP

Binary: https://bitbucket.org/NtQuery/scyllahide/downloads/ScyllaHide_v0.3.rar
Source: https://bitbucket.org/NtQuery/scyllahide/

Carbon 04-21-2014 03:35

Version 0.4

- Olly v1/v2 Plugins: Apply hooks without restarting
- Olly v1 Plugin: Added "Break on TLS"


https://bitbucket.org/NtQuery/scyllahide/downloads/ScyllaHide_v0.4.rar

leetone 04-23-2014 13:48

Thank you for the binary release. I've got the source via github and I'm building my own "nightlies" - was this built in VS2008 or VS2010? It isn't native to 2012 or 2013 :)

cypher 04-23-2014 21:55

I'm building with VS2010. Since the platform toolset is set to v90, you either need to have VS2008 express installed to get that toolset or you simply change toolset to v100.
We use v90 on purpose to guarantee max compatibility on older systems but for testing, v100 is just fine.

Carbon 04-24-2014 02:39

Version 0.5

- NtCreateThreadEx hook
- Prevent Thread creation
(special hook for some protectors like Execryptor. Only use this if you know what you do)
- Split Hide PEB into 4 options (ini option PEB now deprecated)
- Inject DLL option added (2 methods)
- Replaced Olly2 dialog
- Improved "Break on TLS"

Download: you know where

cypher 04-29-2014 21:23

Version 0.7

- IDA 64bit plugin
- IDA 32/64bit remote server
- IDA DLL Injection
- IDA option to start x64 server automatically

cypher 05-03-2014 03:53

Version 0.8

- Olly v1 Plugin: option "Skip EP outside of code message"
- Fix for NtSetInformationProcess -> ProcessHandleTracing
- All plugins: Update-Check
- Timing Hooks: GetTickCount, GetTickCount64, GetLocalTime, GetSystemTime, NtQuerySystemTime, NtQueryPerformanceCounter
- "Remove Debug Privileges" added

besoeso 05-04-2014 01:15

@cypher

Is posible add io hooks support too?, so DeviceIoControlFile.

Carbon 05-04-2014 02:47

@besoeso
How does this work? Antidebug with DeviceIoControlFile? Do you have an example code?

giv 05-05-2014 14:42

Congrats mate...
I have tested today with a VMProtect target and to my real surprise it works flawless.
:)

Offtopic:
Just don't forget the Scylla 0.9.6b problem that i have reported of Themida nnpack in tuts4you.

See ya!

ahmadmansoor 05-06-2014 19:59

x64 need more test
 
Hi Carbon
I have make some more check on x64 .
I keep get ((Warning wrong struct size 504 != 396))
or the HookLibraryx64.dll not been injected .

by the way what the useful of :
Quote:

if (specialPebFix)
{
StartFixBeingDebugged(ProcessId, false);
specialPebFix = false;
}

if (PLUG_CB_DEBUGEVENTx->DebugEvent->u.LoadDll.lpBaseOfDll == hNtdllModule)
{
StartFixBeingDebugged(ProcessId, true);
specialPebFix = true;
}
it work as opposite of each other !!

Carbon 05-07-2014 00:39

Quote:

Originally Posted by ahmadmansoor (Post 91263)
Hi Carbon
I have make some more check on x64 .
I keep get ((Warning wrong struct size 504 != 396))
or the HookLibraryx64.dll not been injected .

Did you compile it yourself? This is some alginment check, this should not be a problem in the release builds.


Quote:

if (specialPebFix)
{
StartFixBeingDebugged(ProcessId, false);
specialPebFix = false;
}

if (PLUG_CB_DEBUGEVENTx->DebugEvent->u.LoadDll.lpBaseOfDll == hNtdllModule)
{
StartFixBeingDebugged(ProcessId, true);
specialPebFix = true;
}
This is from the POISON source and to be honest I don't understand it completly but it works very well. It is something against Heap flag artifacts. Themida/WL looks for special artifacts on the process heaps and this little trick prevents the creation of these artifacts. I think other hide plugin use the same trick. I don't know who invented it originally, but it is a very clever way to solve this problem, so the author is probably some genius.


All times are GMT +8. The time now is 06:49.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX