Do not come here and open issues about problems with installation, crashes with bug check 0x109: CRITICAL_STRUCTURE_CORRUPTION or questions on how to disable PatchGuard. I will permanently ban you from the issue tracker. If you don't know how to properly install the tool you don't know enough to use it responsibly and you should use something else like ScyllaHide. To disable PatchGuard, try EfiGuard, UPGDSED or Shark.
TitanHide is a driver intended to hide debuggers from certain processes. The driver hooks various Nt* kernel functions (using SSDT table hooks) and modifies the return values of the original functions. To hide a process, you must pass a simple structure with a ProcessID and the hiding option(s) to enable, to the driver. The internal API is designed to add hooks with little effort, which means adding features is really easy.
The idea for this project was thought of together with cypher, shoutout man!
- ProcessDebugFlags (NtQueryInformationProcess)
- ProcessDebugPort (NtQueryInformationProcess)
- ProcessDebugObjectHandle (NtQueryInformationProcess)
- DebugObject (NtQueryObject)
- SystemKernelDebuggerInformation (NtQuerySystemInformation)
- SystemDebugControl (NtSystemDebugControl)
- NtClose (STATUS_INVALID_HANDLE/STATUS_HANDLE_NOT_CLOSABLE exceptions)
- ThreadHideFromDebugger (NtSetInformationThread)
- Protect DRx (HW BPs) (NtGetContextThread/NtSetContextThread)
- Windows 10 x64 & x86
- Windows 8.1 x64 & x86
- Windows 7 x64 & x86 (SP1)
- Windows XP x86 (SP3)
- Windows XP x64 (SP1)
- Install Visual Studio 2013 (Express Edition untested).
- Install the WDK10/WDK8/WDK7.
- Open
TitanHide.slnand hit compile!
- Copy
TitanHide.systo%systemroot%\system32\drivers. - Run the command
sc create TitanHide binPath= %systemroot%\system32\drivers\TitanHide.sys type= kernelto create the TitanHide service. - Run the command
sc start TitanHideto start the TitanHide service. - Run the command
sc query TitanHideto check if TitanHide is running.
- Copy
TitanHide.systo%systemroot%\system32\drivers. - Start
ServiceManager.exe(available on the download page). - Delete the old service (when present).
- Install a new service (specify the f
709E
ull path to
TitanHide.sys). - Start the service you just created.
- Use
TitanHideGUI.exeto set hide options for a PID.
To enable testsigning run the following command:
bcdedit /set testsigning on
To disable PatchGuard, find a tool like KPP Destroyer to disable it (Google is your friend). To check if TitanHide is working correctly, use DebugView or check C:\TitanHide.log. You can also try EfiGuard, UPGDSED or Shark.
- When using x64dbg, you can use the TitanHide plugin (available on the download page).
- NEVER RUN THIS DRIVER ON A PRODUCTION SYSTEM, ALWAYS USE A VM!