• v馒头v
  • C/C++
  • 456KB
  • zip
  • 0
  • 1 积分
  • 2
  • 2019-06-05 00:36
内核反反调试插件源码Kernel anti-debugging plug-in source code
**Do not come here and open issues about problems with installation, crashes with bug check 0x109: CRITICAL_STRUCTURE_CORRUPTION or questions on how to disable PatchGuard. I will permanently ban you from the issue tracker. If you don't know how to properly install the tool you don't know enough to use it responsibly and you should use something else like [ScyllaHide](https://github.com/x64dbg/ScyllaHide). To disable PatchGuard, try [EfiGuard](https://github.com/Mattiwatti/EfiGuard) or [UPGDSED](https://github.com/hfiref0x/UPGDSED).** ## Latest build: [![Build status](https://ci.appveyor.com/api/projects/status/cb17ic9sxmccc74d?svg=true)](https://ci.appveyor.com/project/mrexodia/titanhide/build/artifacts) # Overview TitanHide is a driver intended to hide debuggers from certain processes. The driver hooks various Nt* kernel functions (using SSDT table hooks) and modifies the return values of the original functions. To hide a process, you must pass a simple structure with a ProcessID and the hiding option(s) to enable, to the driver. The internal API is designed to add hooks with little effort, which means adding features is really easy. # Features - ProcessDebugFlags (NtQueryInformationProcess) - ProcessDebugPort (NtQueryInformationProcess) - ProcessDebugObjectHandle (NtQueryInformationProcess) - DebugObject (NtQueryObject) - SystemKernelDebuggerInformation (NtQuerySystemInformation) - SystemDebugControl (NtSystemDebugControl) - NtClose (STATUS_INVALID_HANDLE/STATUS_HANDLE_NOT_CLOSABLE exceptions) - ThreadHideFromDebugger (NtSetInformationThread) - Protect DRx (HW BPs) (NtGetContextThread/NtSetContextThread) # Test environments - Windows 10 x64 & x86 - Windows 8.1 x64 & x86 - Windows 7 x64 & x86 (SP1) - Windows XP x86 (SP3) - Windows XP x64 (SP1) # Compiling 1. Install Visual Studio 2013 (Express Edition untested). 2. Install the [WDK8](http://www.microsoft.com/en-us/download/details.aspx?id=42273)/[WDK7](https://www.microsoft.com/en-us/download/details.aspx?id=11800). 3. Open `TitanHide.sln` and hit compile! # Installation Method 1 1. Copy `TitanHide.sys` to `%systemroot%\system32\drivers`. 2. Run the command `sc create TitanHide binPath= %systemroot%\system32\drivers\TitanHide.sys type= kernel` to create the TitanHide service. 3. Run the command `sc start TitanHide` to start the TitanHide service. 4. Run the command `sc query TitanHide` to check if TitanHide is running. # Installation Method 2 1. Copy `TitanHide.sys` to `%systemroot%\system32\drivers`. 2. Start `ServiceManager.exe` (available on the download page). 3. Delete the old service (when present). 4. Install a new service (specify the full path to `TitanHide.sys`). 5. Start the service you just created. 6. Use `TitanHideGUI.exe` to set hide options for a PID. # Testsigning & PatchGuard To enable testsigning run the following command: ``` bcdedit /set testsigning on ``` To disable PatchGuard, find a tool like KPP Destroyer to disable it (Google is your friend). To check if TitanHide is working correctly, use [DebugView](https://technet.microsoft.com/en-us/sysinternals/debugview.aspx) or check `C:\TitanHide.log`. You can also try [EfiGuard](https://github.com/Mattiwatti/EfiGuard) or [UPGDSED](https://github.com/hfiref0x/UPGDSED). # Remarks - When using x64dbg, you can use the TitanHide plugin (available on the download page). - **NEVER RUN THIS DRIVER ON A PRODUCTION SYSTEM, ALWAYS USE A VM!**
    • TitanHide-master.zip
      内核层 进程保护 反检测 反反调试 保护调试器
    • ScyllaHide-vs13反反调试插件
      它hook用户模式(ring3)中的各种函数以隐藏调试。 此工具旨在保留在用户模式(ring3)中。 如果您需要内核模式(ring0)Anti-Anti-Debug,请参阅TitanHide。 ScyllaHide在用户模式中尽可能隐蔽,目标是不干扰任何...
    • qpopper2.53.tar.Z
      pop3 server
    • imap-4.7.tar.Z
      被广泛使用的email服务器 /IMAPD/POPD
    • 53308459Add_Dlt_TabCtrl.rar
    • ns-allinone-2.33.tar.gz
    • NetVideoActiveX23.rar
      海康威视 网络监控插件 带有例子 和开发的dll文件,非常易用
    • UR054g_(R01).zip
    • eat.rar
      装摄像头驱动需要用到的文件。Microsoft DirectX 9 SDK