You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
4. Configure in `Edit > Settings > Debugger > scyllahide`:
27
27
- Set "ScyllaHide Directory" to the path containing extracted files
28
-
- Select a profile (default: Basic)
28
+
- Enable "Enable Automatic ScyllaHide Injection" (if you want)
29
+
- Select a profile (default: Basic) or make a custom one
29
30
30
-
5. Open a x64/x86 binary of your choice
31
+
5. Open a x64/x86 binary and start debugging
31
32
32
-
6. Set a breakpoint on the program's entry
33
-
34
-
7. ScyllaHide is automatically injected and set up.
33
+
6. ScyllaHide is automatically injected when the debugger hits the initial breakpoint
35
34
36
35
## Usage
37
36
38
-
Once configured, ScyllaHide automatically injects when you start debugging any Windows executable. Console output will indicate injection status.
37
+
### Automatic Injection
38
+
39
+
If configured (see Settings), ScyllaHide automatically injects when you start debugging any Windows executable. The status bar shows real-time progress during injection, and console output logs detailed status.
40
+
41
+
### Manual Injection
42
+
43
+
You can manually inject ScyllaHide at any time during a debug session via:
44
+
-**Plugins > ScyllaNinja > Inject ScyllaHide**
45
+
46
+
This is useful for:
47
+
- Retrying if automatic injection failed
48
+
- Injecting after the initial breakpoint
49
+
- Re-injecting after modifying settings
50
+
51
+
The plugin prevents accidental double-injection by tracking injection state and prompting for confirmation.
39
52
40
53
## Settings
41
54
42
-
Found in Binary Ninja Settings under `Debugger > ScyllaHide`:
55
+
Found in Binary Ninja Settings under `Debugger > scyllahide`:
| Individual Hooks | varies | PEB, NT API, and timing hooks (only apply when Profile = Custom) |
50
63
64
+
**Note:** Remember that the individual hook settings are only used when Profile is set to "Custom". For preset profiles like "Basic" or "VMProtect x86/x64", ScyllaHide uses its already built-in configurations.
65
+
51
66
## Minimum Version
52
67
53
68
This plugin (was only tested on but likely) requires the following minimum version of Binary Ninja:
@@ -60,6 +75,8 @@ The following dependencies are required for this plugin:
60
75
61
76
* ScyllaHide binaries (InjectorCLI + HookLibrary DLLs) from https://github.com/x64dbg/ScyllaHide/releases
62
77
78
+
The plugin will alert you if these files don't exist and are not set up in the settings.
Copy file name to clipboardExpand all lines: plugin.json
+3-3Lines changed: 3 additions & 3 deletions
Original file line number
Diff line number
Diff line change
@@ -3,15 +3,15 @@
3
3
"name": "ScyllaNinja",
4
4
"type": ["helper", "ui"],
5
5
"api": ["python3"],
6
-
"description": "Automatically inject ScyllaHide anti-anti-debug DLL when debugging Windows executables",
7
-
"longdescription": "Binary Ninja integration for [ScyllaHide](https://github.com/x64dbg/ScyllaHide) by x64dbg. Automatically injects the ScyllaHide DLL when the debugger hits the initial breakpoint, helping bypass common anti-debugging techniques.\n\n**Setup:**\n1. Download ScyllaHide binaries from https://github.com/x64dbg/ScyllaHide/releases/tag/v1.4\n2. Extract InjectorCLI (x86/x64) and HookLibrary DLLs (x86/x64)\n3. Configure directory in Settings > Debugger > ScyllaHide\n4. Select a profile and start debugging\n\nScyllaHide handles PEB manipulation, NT API hooking, and timing protection to hide the debugger from anti-debug checks.",
6
+
"description": "Automated ScyllaHide injection and setup/configuration for Binary Ninja's debugger",
7
+
"longdescription": "Binary Ninja integration for [ScyllaHide](https://github.com/x64dbg/ScyllaHide) by x64dbg. Automatically injects the ScyllaHide DLL when the debugger hits the initial breakpoint, helping bypass anti-debugging techniques commonly found in packed or protected executables.\n\n**Features:**\n- Automatic injection on debug start with status bar progress feedback\n- Manual injection via Plugins > ScyllaNinja > Inject ScyllaHide\n- Intelligent process detection with fuzzy matching\n- Multi-binary support with independent injection state\n- Double-injection prevention\n\n**Setup:**\n1. Download ScyllaHide binaries from https://github.com/x64dbg/ScyllaHide/releases/tag/v1.4\n2. Extract InjectorCLIx64.exe, InjectorCLIx86.exe, HookLibraryx64.dll, HookLibraryx86.dll\n3. Configure in Settings > Debugger > scyllahide\n4. Enable automatic injection and select a profile\n5. Start debugging - ScyllaHide injects automatically\n\nScyllaHide handles PEB manipulation, NT API hooking, and timing protection to hide the debugger from anti-debug checks.",
8
8
"license": {
9
9
"name": "MIT",
10
10
"text": "Copyright (c) 2025 Script-Ware Software\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE."
11
11
},
12
12
"platforms": ["Windows"],
13
13
"installinstructions": {
14
-
"Windows": "1. Install plugin via Binary Ninja Plugin Manager or copy to plugins directory\n2. Download ScyllaHide from https://github.com/x64dbg/ScyllaHide/releases/tag/v1.4\n3. Extract InjectorCLIx64.exe, InjectorCLIx86.exe, HookLibraryx64.dll, HookLibraryx86.dll\n4. Set ScyllaHide directoryin Settings > Debugger > ScyllaHide\n5. Restart Binary Ninja"
14
+
"Windows": "1. Install plugin via Binary Ninja Plugin Manager or copy to %APPDATA%\\Binary Ninja\\plugins\n2. Download ScyllaHide from https://github.com/x64dbg/ScyllaHide/releases/tag/v1.4\n3. Extract InjectorCLIx64.exe, InjectorCLIx86.exe, HookLibraryx64.dll, HookLibraryx86.dll to a directory\n4. Configure in Settings > Debugger > scyllahide:\n - Set ScyllaHide Directory\n - Enable automatic injection (optional)\n - Select profile (default: Basic)\n5. Open a binary and start debugging"
0 commit comments