admin/x64dbg-ScyllaHide
1
0
Fork 0
mirror of https://github.com/x64dbg/ScyllaHide synced 2026-06-08 18:22:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enable OSBuildVersion in plugin menus (#109)

Browse Source
This commit is contained in:
Sam Russell
2020-09-09 10:50:28 -04:00
committed by GitHub
parent 75fcdc539e
commit 75fde06ac9
15 changed files with 26 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ConfigCollection/scylla_hide.ini
+6
View File
@@ -30,6 +30,7 @@ PebBeingDebugged=1
PebHeapFlags=1
PebNtGlobalFlag=1
PebStartupInfo=1
PebOsBuildNumber=1
PreventThreadCreation=0
RemoveDebugPrivileges=0
AutostartServer=1
@@ -89,6 +90,7 @@ PebBeingDebugged=1
PebHeapFlags=1
PebNtGlobalFlag=1
PebStartupInfo=1
PebOsBuildNumber=1
PreventThreadCreation=0
RemoveDebugPrivileges=0
AutostartServer=1
@@ -131,6 +133,7 @@ PebBeingDebugged=1
PebHeapFlags=1
PebNtGlobalFlag=1
PebStartupInfo=1
PebOsBuildNumber=1
PreventThreadCreation=0
RemoveDebugPrivileges=0
AutostartServer=1
@@ -173,6 +176,7 @@ PebBeingDebugged=1
PebHeapFlags=1
PebNtGlobalFlag=1
PebStartupInfo=1
PebOsBuildNumber=1
PreventThreadCreation=0
RemoveDebugPrivileges=0
AutostartServer=1
@@ -214,6 +218,7 @@ PebBeingDebugged=1
PebHeapFlags=1
PebNtGlobalFlag=1
PebStartupInfo=1
PebOsBuildNumber=1
PreventThreadCreation=0
RemoveDebugPrivileges=0
KillAntiAttach=0
@@ -273,6 +278,7 @@ PebBeingDebugged=0
PebHeapFlags=0
PebNtGlobalFlag=0
PebStartupInfo=0
PebOsBuildNumber=0
PreventThreadCreation=0
RemoveDebugPrivileges=0
KillAntiAttach=0
Documentation/ScyllaHideDocumentation.tex
+1
View File
@@ -124,6 +124,7 @@ The most important anti-anti-debug option. Almost every protector checks for PEB
\item NtGlobalFlag: Very important option, a lot of protectors check this value.
\item HeapFlags: Very important option. E.g. Themida checks for heap artifacts and heap flags.
\item StartupInfo: This is not really important, only a few protectors check for this. Maybe Enigma checks it.
\item OsBuildNumber: VMProtect checks this on newer versions of Windows 10 (2019 onwards).
\end{itemize}
\subsubsection{NtSetInformationThread}
HookLibrary/HookMain.h
+1
View File
@@ -32,6 +32,7 @@ typedef struct _HOOK_DLL_DATA {
BOOLEAN EnablePebHeapFlags;
BOOLEAN EnablePebNtGlobalFlag;
BOOLEAN EnablePebStartupInfo;
BOOLEAN EnablePebOsBuildNumber;
BOOLEAN EnableOutputDebugStringHook;
InjectorCLI/CliMain.cpp
+3 -2
View File
@@ -132,11 +132,11 @@ static bool StartHooking(HANDLE hProcess, BYTE * dllMemory, DWORD_PTR imageBase)
peb_flags |= PEB_PATCH_NtGlobalFlag;
if (g_settings.opts().fixPebStartupInfo)
peb_flags |= PEB_PATCH_ProcessParameters;
if (g_settings.os_version_patch_needed())
if (g_settings.opts().fixPebOsBuildNumber)
peb_flags |= PEB_PATCH_OsBuildNumber;
ApplyPEBPatch(hProcess, peb_flags);
if (g_settings.os_version_patch_needed())
if (g_settings.opts().fixPebOsBuildNumber)
ApplyNtdllVersionPatch(hProcess);
if (dllMemory == nullptr || imageBase == 0)
@@ -312,6 +312,7 @@ void ReadSettings()
g_hdd.EnablePebHeapFlags = g_settings.opts().fixPebHeapFlags;
g_hdd.EnablePebNtGlobalFlag = g_settings.opts().fixPebNtGlobalFlag;
g_hdd.EnablePebStartupInfo = g_settings.opts().fixPebStartupInfo;
g_hdd.EnablePebOsBuildNumber = g_settings.opts().fixPebOsBuildNumber;
g_hdd.EnablePreventThreadCreation = g_settings.opts().preventThreadCreation;
g_hdd.EnableProtectProcessId = g_settings.opts().protectProcessId;
}
PluginGeneric/Injector.cpp
+3 -2
View File
@@ -269,11 +269,11 @@ bool StartHooking(HANDLE hProcess, HOOK_DLL_DATA *hdd, BYTE * dllMemory, DWORD_P
peb_flags |= PEB_PATCH_NtGlobalFlag;
if (g_settings.opts().fixPebStartupInfo)
peb_flags |= PEB_PATCH_ProcessParameters;
if (g_settings.os_version_patch_needed())
if (g_settings.opts().fixPebOsBuildNumber)
peb_flags |= PEB_PATCH_OsBuildNumber;
ApplyPEBPatch(hProcess, peb_flags);
if (g_settings.os_version_patch_needed())
if (g_settings.opts().fixPebOsBuildNumber)
ApplyNtdllVersionPatch(hProcess);
if (dllMemory == nullptr || imageBase == 0)
@@ -627,6 +627,7 @@ void FillHookDllData(HANDLE hProcess, HOOK_DLL_DATA *hdd)
hdd->EnablePebHeapFlags = g_settings.opts().fixPebHeapFlags;
hdd->EnablePebNtGlobalFlag = g_settings.opts().fixPebNtGlobalFlag;
hdd->EnablePebStartupInfo = g_settings.opts().fixPebStartupInfo;
hdd->EnablePebOsBuildNumber = g_settings.opts().fixPebOsBuildNumber;
hdd->EnableOutputDebugStringHook = g_settings.opts().hookOutputDebugStringA;
hdd->EnableNtSetInformationThreadHook = g_settings.opts().hookNtSetInformationThread;
hdd->EnableNtQueryInformationProcessHook = g_settings.opts().hookNtQueryInformationProcess;
PluginGeneric/OptionsDialog.cpp
+8 -2
View File
@@ -95,8 +95,9 @@ static void UpdateOptions(HWND hWnd, const scl::Settings *settings)
CheckDlgButton(hWnd, IDC_PEBHEAPFLAGS, opts->fixPebHeapFlags);
CheckDlgButton(hWnd, IDC_PEBNTGLOBALFLAG, opts->fixPebNtGlobalFlag);
CheckDlgButton(hWnd, IDC_PEBSTARTUPINFO, opts->fixPebStartupInfo);
CheckDlgButton(hWnd, IDC_PEBOSBUILDNUMBER, opts->fixPebOsBuildNumber);
BOOL peb_state = opts->fixPebBeingDebugged && opts->fixPebHeapFlags && opts->fixPebNtGlobalFlag && opts->fixPebStartupInfo;
BOOL peb_state = opts->fixPebBeingDebugged && opts->fixPebHeapFlags && opts->fixPebNtGlobalFlag && opts->fixPebStartupInfo && opts->fixPebOsBuildNumber;
CheckDlgButton(hWnd, IDC_PEB, peb_state);
CheckDlgButton(hWnd, IDC_NTSETINFORMATIONTHREAD, opts->hookNtSetInformationThread);
@@ -191,6 +192,7 @@ void SaveOptions(HWND hWnd, scl::Settings *settings)
opts->fixPebHeapFlags = (IsDlgButtonChecked(hWnd, IDC_PEBHEAPFLAGS) == BST_CHECKED);
opts->fixPebNtGlobalFlag = (IsDlgButtonChecked(hWnd, IDC_PEBNTGLOBALFLAG) == BST_CHECKED);
opts->fixPebStartupInfo = (IsDlgButtonChecked(hWnd, IDC_PEBSTARTUPINFO) == BST_CHECKED);
opts->fixPebOsBuildNumber = (IsDlgButtonChecked(hWnd, IDC_PEBOSBUILDNUMBER) == BST_CHECKED);
opts->hookNtSetInformationThread = (IsDlgButtonChecked(hWnd, IDC_NTSETINFORMATIONTHREAD) == BST_CHECKED);
opts->hookNtSetInformationProcess = (IsDlgButtonChecked(hWnd, IDC_NTSETINFORMATIONPROCESS) == BST_CHECKED);
opts->hookNtQuerySystemInformation = (IsDlgButtonChecked(hWnd, IDC_NTQUERYSYSTEMINFORMATION) == BST_CHECKED);
@@ -276,6 +278,7 @@ HWND CreateTooltips(HWND hDlg)
{ IDC_PEBHEAPFLAGS, L"Very important option, a lot of protectors check for this value." },
{ IDC_PEBNTGLOBALFLAG, L"Very important option. E.g. Themida checks for heap artifacts and heap flags." },
{ IDC_PEBSTARTUPINFO, L"This is not really important, only a few protectors check for this. Maybe Enigma checks it." },
{ IDC_PEBOSBUILDNUMBER, L"VMProtect checks this on newer versions of Windows 10 (2019 onwards)." },
{
IDC_NTSETINFORMATIONTHREAD,
L"The THREADINFOCLASS value ThreadHideFromDebugger is a well-known\r\n"
@@ -755,6 +758,7 @@ INT_PTR CALLBACK OptionsDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM l
CheckDlgButton(hDlg, IDC_PEBHEAPFLAGS, state);
CheckDlgButton(hDlg, IDC_PEBNTGLOBALFLAG, state);
CheckDlgButton(hDlg, IDC_PEBSTARTUPINFO, state);
CheckDlgButton(hDlg, IDC_PEBOSBUILDNUMBER, state);
break;
}
@@ -762,6 +766,7 @@ INT_PTR CALLBACK OptionsDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM l
case IDC_PEBHEAPFLAGS:
case IDC_PEBNTGLOBALFLAG:
case IDC_PEBSTARTUPINFO:
case IDC_PEBOSBUILDNUMBER:
{
if (HIWORD(wParam) != BN_CLICKED)
break;
@@ -769,7 +774,8 @@ INT_PTR CALLBACK OptionsDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM l
auto checked = IsDlgButtonChecked(hDlg, IDC_PEBBEINGDEBUGGED)
|| IsDlgButtonChecked(hDlg, IDC_PEBHEAPFLAGS)
|| IsDlgButtonChecked(hDlg, IDC_PEBNTGLOBALFLAG)
|| IsDlgButtonChecked(hDlg, IDC_PEBSTARTUPINFO);
|| IsDlgButtonChecked(hDlg, IDC_PEBSTARTUPINFO)
|| IsDlgButtonChecked(hDlg, IDC_PEBOSBUILDNUMBER);
CheckDlgButton(hDlg, IDC_PEB, checked);
break;
Scylla/Settings.cpp
+2
View File
@@ -92,6 +92,7 @@ void scl::Settings::LoadProfile(const wchar_t *file, const wchar_t *name, Profil
profile->fixPebHeapFlags = IniLoadNum(file, name, L"PebHeapFlags", 1);
profile->fixPebNtGlobalFlag = IniLoadNum(file, name, L"PebNtGlobalFlag", 1);
profile->fixPebStartupInfo = IniLoadNum(file, name, L"PebStartupInfo", 1);
profile->fixPebOsBuildNumber = IniLoadNum(file, name, L"PebOsBuildNumber", 1);
profile->preventThreadCreation = IniLoadNum(file, name, L"PreventThreadCreation", 0);
profile->protectProcessId = IniLoadNum(file, name, L"ProtectProcessId", 1);
@@ -167,6 +168,7 @@ bool scl::Settings::SaveProfile(const wchar_t *file, const wchar_t *name, const
success &= IniSaveNum(file, name, L"PebHeapFlags", profile->fixPebHeapFlags);
success &= IniSaveNum(file, name, L"PebNtGlobalFlag", profile->fixPebNtGlobalFlag);
success &= IniSaveNum(file, name, L"PebStartupInfo", profile->fixPebStartupInfo);
success &= IniSaveNum(file, name, L"PebOsBuildNumber", profile->fixPebOsBuildNumber);
success &= IniSaveNum(file, name, L"PreventThreadCreation", profile->preventThreadCreation);
success &= IniSaveNum(file, name, L"ProtectProcessId", profile->protectProcessId);
success &= IniSaveNum(file, name, L"RemoveDebugPrivileges", profile->removeDebugPrivileges);
Scylla/Settings.h
+1 -5
View File
@@ -42,6 +42,7 @@ namespace scl
BOOL fixPebHeapFlags;
BOOL fixPebNtGlobalFlag;
BOOL fixPebStartupInfo;
BOOL fixPebOsBuildNumber;
BOOL preventThreadCreation;
BOOL protectProcessId;
BOOL removeDebugPrivileges;
@@ -133,11 +134,6 @@ namespace scl
profile_.malwareRunpeUnpacker;
}
bool os_version_patch_needed() const
{
return profile_name_.find(L"VMProtect") != std::wstring::npos;
}
protected:
static void LoadProfile(const wchar_t *file, const wchar_t *name, Profile *profile);
static bool SaveProfile(const wchar_t *file, const wchar_t *name, const Profile *profile);
ScyllaHideIDAProPlugin/IdaServerClient.cpp
+1
View File
@@ -44,6 +44,7 @@ bool SendEventToServer(unsigned long notif_code, unsigned long ProcessId)
idaExchange.EnablePebHeapFlags = g_settings.opts().fixPebHeapFlags;
idaExchange.EnablePebNtGlobalFlag = g_settings.opts().fixPebNtGlobalFlag;
idaExchange.EnablePebStartupInfo = g_settings.opts().fixPebStartupInfo;
idaExchange.EnablePebOsBuildNumber = g_settings.opts().fixPebOsBuildNumber;
idaExchange.EnableOutputDebugStringHook = g_settings.opts().hookOutputDebugStringA;
idaExchange.EnableNtSetInformationThreadHook = g_settings.opts().hookNtSetInformationThread;
idaExchange.EnableNtQueryInformationProcessHook = g_settings.opts().hookNtQueryInformationProcess;
ScyllaHideIDAProPlugin/ScyllaHideIDAProPlugin.rc
BIN
View File
Binary file not shown.
ScyllaHideIDAProPlugin/resource.h
BIN
View File
Binary file not shown.
ScyllaHideOlly1Plugin/resource.h
BIN
View File
Binary file not shown.
ScyllaHideOlly2Plugin/resource.h
BIN
View File
Binary file not shown.
ScyllaHideX64DBGPlugin/ScyllaHideX64DBGPlugin.rc
BIN
View File
Binary file not shown.
ScyllaHideX64DBGPlugin/resource.h
BIN
View File
Binary file not shown.