DOCSEARCHbyAlgolia
Submit Docs

TitanHide Documentation

repository·master·Indexed 25 days ago

https://github.com/mrexodia/titanhide

A kernel-mode driver used to hide debuggers from processes by hooking SSDT kernel functions. It allows reverse engineers to evade anti-debugging techniques by modifying the return values of Nt* kernel functions such as NtQueryInformationProcess and NtQuerySystemInformation. The driver can be controlled via the HIDE_INFO structure using WriteFile or through a provided GUI to manage hiding options for specific Process IDs (PIDs).

Tokens
986
Snippets
1
Records
10
Agent score
84%

What's inside TitanHide

  1. Overview of TitanHide

    master
    TitanHide is a kernel driver designed to hide debuggers from specific processes. It achieves this by hooking various Nt* kernel functions using SSDT (System Service Descriptor Table) hooks and modifying their return values. To hide a process, you provide a structure containing a ProcessID and the desired hiding options to the driver.

  2. Bypass VMProtect detection for TitanHide

    master

    For VMProtect 3.9.4 and above, you must change the service name to avoid detection.

    1. Create the service with a custom name (e.g., NotTitanHide) instead of TitanHide:
      sc create NotTitanHide binPath= %systemroot%\system32\drivers\TitanHide.sys type= kernel
    2. Configure the x64dbg plugin with the new name using the TitanHideName command:
      TitanHideName NotTitanHide

  3. Configure system requirements for TitanHide

    master

    Before using TitanHide, you must disable PatchGuard and Driver Signing Enforcement (DSE).

    To enable test signing (to allow loading the driver), run the following command in an elevated prompt:

    bcdedit /set testsigning on

    Recommended tools for disabling PatchGuard include:

    • EfiGuard
    • SandboxBootkit
    • Shark
    • UPGDSED (archived)

  4. Install and start the TitanHide driver

    master

    Follow these steps to install the driver as a system service:

    1. Copy TitanHide.sys to %systemroot%\system32\drivers.
    2. Create the service using sc create.
    3. Start the service using sc start.
    4. Verify the service status using sc query.

    You can verify if the driver is working correctly by checking C:\TitanHide.log or using DebugView.

  5. Use the TitanHide GUI to hide or unhide processes

    master

    To use the TitanHide GUI, follow these steps:

    1. Enter the target PID (Process ID) in the IDC_EDT_PID field.
    2. Specify the Driver name in the IDC_EDT_DRIVER field.
    3. Select the desired techniques from the Options group box.
    4. Click &Hide to apply the selected hiding options to the PID.
    5. Use &Unhide to remove hiding from a specific PID, or Unhide &All to clear all active hiding settings.

  6. List of TitanHide hiding features

    master

    TitanHide provides hiding capabilities for the following kernel functions and behaviors:

    • NtQueryInformationProcess: Hides ProcessDebugFlags, ProcessDebugPort, and ProcessDebugObjectHandle.
    • NtQueryObject: Hides DebugObject.
    • NtQuerySystemInformation: Hides SystemKernelDebuggerInformation.
    • NtSystemDebugControl: Hides SystemDebugControl.
    • NtClose: Handles STATUS_INVALID_HANDLE / STATUS_HANDLE_NOT_CLOSABLE exceptions.
    • NtSetInformationThread: Hides via ThreadHideFromDebugger.
    • NtGetContextThread / NtSetContextThread: Protects DRx (Hardware Breakpoints).

  7. Interact with TitanHide via HIDE_INFO structure

    master

    To control TitanHide from an external application, you must communicate with the driver using WriteFile. The driver expects a HIDE_INFO structure.

    Based on the GUI implementation, the HIDE_INFO structure contains the following fields:

    • Command: A HIDE_COMMAND value indicating the action (e.g., HidePid, UnhidePid, or UnhideAll).
    • Pid: The Process ID to target.
    • Type: A bitmask of HIDE_TYPE flags representing which hiding features to enable.

  9. Use HIDE_TYPE flags for hiding features

    master

    The HIDE_TYPE bitmask is used to select specific anti-debugging/anti-analysis features. The following flags are supported:

    • HideProcessDebugFlags
    • HideProcessDebugPort
    • HideProcessDebugObjectHandle
    • HideDebugObject
    • HideSystemDebuggerInformation
    • HideNtClose
    • HideThreadHideFromDebugger
    • HideNtGetContextThread
    • HideNtSetContextThread
    • HideNtSystemDebugControl