This is an effort to integrate ScyllaHide, an advanced anti-anti-debugging and anti-reverse engineering tool, into Cheat Engine, a popular memory scanning and debugging software. While Cheat Engine offers robust features for stealthy debugging, it encounters difficulties when initiating the debugging of a process right from its entry point, particularly if the target game employs protection mechanisms. For instance, should one wish to investigate the unpacking routine of an obscure file format within a safeguarded game, Cheat Engine alone would not suffice for such a task with ease.
ScyllaHideCE emerges as particularly beneficial when utilizing the Windows debugger integrated within Cheat Engine.
Usage Instructions:
- Incorporate the plugin into Cheat Engine’s settings.
- Navigate to the “Memory View” window and proceed to the “Plugins” tab.
- Adjust the “ScyllaHideCE mode” setting to “Attach” if you intend to attach it to an already running process, or to “Open” if you aim to commence the debugging of a new process.
- To initiate a process within Cheat Engine, firstly ensure the Windows debugger is selected within the settings.
- Subsequently, click on the “Open Process” button, choose “File”, and then select “Create Process”.
ScyllaHide is an advanced open-source x64/x86 user mode Anti-Anti-Debug library. It hooks various functions to hide debugging. This tool is intended to stay in user mode (ring 3). If you need kernel mode (ring 0) Anti-Anti-Debug, please see TitanHide. Forked from NtQuery/ScyllaHide.
ScyllaHide supports various debuggers through plugins:
- OllyDbg v1 and v2
- x64dbg
- Hex-Rays IDA v6 (not supported)
- TitanEngine v2 (original and updated versions)
PE x64 debugging is fully supported with plugins for x64dbg and IDA.
Please note that ScyllaHide is not limited to these debuggers. You can use the standalone command line version of ScyllaHide. You can inject ScyllaHide into any process debugged by any debugger.
More information is available in the documentation (PDF).
ScyllaHide is licensed under the GNU General Public License v3.
- What for his POISON Assembler source code
- waliedassar for his blog posts
- Peter Ferrie for his PDFs
- MaRKuS-DJM for Olly Advanced
- Lim Bio Liong for MS Spy++ style Window Finder
