Skip to content

Commit f1fbb18

Browse files
committed
Update installation instructions
1 parent 787876e commit f1fbb18

1 file changed

Lines changed: 21 additions & 19 deletions

File tree

README.md

Lines changed: 21 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
**Do not come here and open issues about problems with installation, crashes with bug check 0x109: CRITICAL_STRUCTURE_CORRUPTION or questions on how to disable PatchGuard. I will permanently ban you from the issue tracker. If you don't know how to properly install the tool you don't know enough to use it responsibly and you should use something else like [ScyllaHide](https://github.com/x64dbg/ScyllaHide). To disable PatchGuard, try [EfiGuard](https://github.com/Mattiwatti/EfiGuard), [UPGDSED](https://github.com/hfiref0x/UPGDSED) or [Shark](https://github.com/9176324/Shark).**
1+
**Do not come here and open issues about problems with installation, crashes with bug check 0x109: CRITICAL_STRUCTURE_CORRUPTION or questions on how to disable PatchGuard. I will permanently ban you from the issue tracker. If you don't know how to properly install the tool you don't know enough to use it responsibly and you should use something else like [ScyllaHide](https://github.com/x64dbg/ScyllaHide).
22

33
# Overview
44

@@ -28,35 +28,37 @@ The idea for this project was thought of together with cypher, shoutout man!
2828

2929
# Compiling
3030

31-
1. Install Visual Studio 2013 (Express Edition untested).
31+
1. Install Visual Studio 2022.
3232
2. Install the [WDK10](https://go.microsoft.com/fwlink/?linkid=2128854)/[WDK8](https://go.microsoft.com/fwlink/p/?LinkID=324284)/[WDK7](https://www.microsoft.com/download/confirmation.aspx?id=11800).
3333
3. Open `TitanHide.sln` and hit compile!
3434

35-
# Installation Method 1
35+
# Requirements
3636

37-
1. Copy `TitanHide.sys` to `%systemroot%\system32\drivers`.
38-
2. Run the command `sc create TitanHide binPath= %systemroot%\system32\drivers\TitanHide.sys type= kernel` to create the TitanHide service.
39-
3. Run the command `sc start TitanHide` to start the TitanHide service.
40-
4. Run the command `sc query TitanHide` to check if TitanHide is running.
37+
**You need to disable PatchGuard and driver signing enforcement (DSE) before using this driver.**
4138

42-
# Installation Method 2
39+
To disable PatchGuard you can try one of the following projects:
4340

44-
1. Copy `TitanHide.sys` to `%systemroot%\system32\drivers`.
45-
2. Start `ServiceManager.exe` (available on the download page).
46-
3. Delete the old service (when present).
47-
4. Install a new service (specify the full path to `TitanHide.sys`).
48-
5. Start the service you just created.
49-
6. Use `TitanHideGUI.exe` to set hide options for a PID.
50-
51-
# Testsigning & PatchGuard
41+
- [EfiGuard](https://github.com/Mattiwatti/EfiGuard)
42+
- [SandboxBootkit](https://github.com/thesecretclub/SandboxBootkit)
43+
- [Shark](https://github.com/9176324/Shark)
44+
- [UPGDSED](https://github.com/hfiref0x/UPGDSED) (archived in 2019)
5245

53-
To enable testsigning run the following command:
46+
To load the driver you can enable test signing:
5447

55-
```
48+
```sh
5649
bcdedit /set testsigning on
5750
```
5851

59-
To disable PatchGuard, find a tool like KPP Destroyer to disable it (Google is your friend). To check if TitanHide is working correctly, use [DebugView](https://technet.microsoft.com/en-us/sysinternals/debugview.aspx) or check `C:\TitanHide.log`. You can also try [EfiGuard](https://github.com/Mattiwatti/EfiGuard), [UPGDSED](https://github.com/hfiref0x/UPGDSED) or [Shark](https://github.com/9176324/Shark).
52+
# Installation
53+
54+
1. Copy `TitanHide.sys` to `%systemroot%\system32\drivers`.
55+
2. Run the command `sc create TitanHide binPath= %systemroot%\system32\drivers\TitanHide.sys type= kernel` to create the TitanHide service.
56+
3. Run the command `sc start TitanHide` to start the TitanHide service.
57+
4. Run the command `sc query TitanHide` to check if TitanHide is running.
58+
59+
To check if TitanHide is working correctly, use [DebugView](https://technet.microsoft.com/en-us/sysinternals/debugview.aspx) or check `C:\TitanHide.log`.
60+
61+
**Note**: For VMProtect 3.9.4 and above you need to change the service name to something else. For example `sc create NotTitanHide`, which will bypass their latest 'detection'.
6062

6163
# Remarks
6264

0 commit comments

Comments
 (0)