|
1 | | -**Do not come here and open issues about problems with installation, crashes with bug check 0x109: CRITICAL_STRUCTURE_CORRUPTION or questions on how to disable PatchGuard. I will permanently ban you from the issue tracker. If you don't know how to properly install the tool you don't know enough to use it responsibly and you should use something else like [ScyllaHide](https://github.com/x64dbg/ScyllaHide). To disable PatchGuard, try [EfiGuard](https://github.com/Mattiwatti/EfiGuard), [UPGDSED](https://github.com/hfiref0x/UPGDSED) or [Shark](https://github.com/9176324/Shark).** |
| 1 | +**Do not come here and open issues about problems with installation, crashes with bug check 0x109: CRITICAL_STRUCTURE_CORRUPTION or questions on how to disable PatchGuard. I will permanently ban you from the issue tracker. If you don't know how to properly install the tool you don't know enough to use it responsibly and you should use something else like [ScyllaHide](https://github.com/x64dbg/ScyllaHide). |
2 | 2 |
|
3 | 3 | # Overview |
4 | 4 |
|
@@ -28,35 +28,37 @@ The idea for this project was thought of together with cypher, shoutout man! |
28 | 28 |
|
29 | 29 | # Compiling |
30 | 30 |
|
31 | | -1. Install Visual Studio 2013 (Express Edition untested). |
| 31 | +1. Install Visual Studio 2022. |
32 | 32 | 2. Install the [WDK10](https://go.microsoft.com/fwlink/?linkid=2128854)/[WDK8](https://go.microsoft.com/fwlink/p/?LinkID=324284)/[WDK7](https://www.microsoft.com/download/confirmation.aspx?id=11800). |
33 | 33 | 3. Open `TitanHide.sln` and hit compile! |
34 | 34 |
|
35 | | -# Installation Method 1 |
| 35 | +# Requirements |
36 | 36 |
|
37 | | -1. Copy `TitanHide.sys` to `%systemroot%\system32\drivers`. |
38 | | -2. Run the command `sc create TitanHide binPath= %systemroot%\system32\drivers\TitanHide.sys type= kernel` to create the TitanHide service. |
39 | | -3. Run the command `sc start TitanHide` to start the TitanHide service. |
40 | | -4. Run the command `sc query TitanHide` to check if TitanHide is running. |
| 37 | +**You need to disable PatchGuard and driver signing enforcement (DSE) before using this driver.** |
41 | 38 |
|
42 | | -# Installation Method 2 |
| 39 | +To disable PatchGuard you can try one of the following projects: |
43 | 40 |
|
44 | | -1. Copy `TitanHide.sys` to `%systemroot%\system32\drivers`. |
45 | | -2. Start `ServiceManager.exe` (available on the download page). |
46 | | -3. Delete the old service (when present). |
47 | | -4. Install a new service (specify the full path to `TitanHide.sys`). |
48 | | -5. Start the service you just created. |
49 | | -6. Use `TitanHideGUI.exe` to set hide options for a PID. |
50 | | - |
51 | | -# Testsigning & PatchGuard |
| 41 | +- [EfiGuard](https://github.com/Mattiwatti/EfiGuard) |
| 42 | +- [SandboxBootkit](https://github.com/thesecretclub/SandboxBootkit) |
| 43 | +- [Shark](https://github.com/9176324/Shark) |
| 44 | +- [UPGDSED](https://github.com/hfiref0x/UPGDSED) (archived in 2019) |
52 | 45 |
|
53 | | -To enable testsigning run the following command: |
| 46 | +To load the driver you can enable test signing: |
54 | 47 |
|
55 | | -``` |
| 48 | +```sh |
56 | 49 | bcdedit /set testsigning on |
57 | 50 | ``` |
58 | 51 |
|
59 | | -To disable PatchGuard, find a tool like KPP Destroyer to disable it (Google is your friend). To check if TitanHide is working correctly, use [DebugView](https://technet.microsoft.com/en-us/sysinternals/debugview.aspx) or check `C:\TitanHide.log`. You can also try [EfiGuard](https://github.com/Mattiwatti/EfiGuard), [UPGDSED](https://github.com/hfiref0x/UPGDSED) or [Shark](https://github.com/9176324/Shark). |
| 52 | +# Installation |
| 53 | + |
| 54 | +1. Copy `TitanHide.sys` to `%systemroot%\system32\drivers`. |
| 55 | +2. Run the command `sc create TitanHide binPath= %systemroot%\system32\drivers\TitanHide.sys type= kernel` to create the TitanHide service. |
| 56 | +3. Run the command `sc start TitanHide` to start the TitanHide service. |
| 57 | +4. Run the command `sc query TitanHide` to check if TitanHide is running. |
| 58 | + |
| 59 | +To check if TitanHide is working correctly, use [DebugView](https://technet.microsoft.com/en-us/sysinternals/debugview.aspx) or check `C:\TitanHide.log`. |
| 60 | + |
| 61 | +**Note**: For VMProtect 3.9.4 and above you need to change the service name to something else. For example `sc create NotTitanHide`, which will bypass their latest 'detection'. |
60 | 62 |
|
61 | 63 | # Remarks |
62 | 64 |
|
|
0 commit comments