x64dbg · 0xeb · Mar 19, 2021
diff --git a/3rdparty/README.txt b/3rdparty/README.txt
@@ -1 +1 @@
-To build the IDA plugin, extract the contents of idasdk695.zip in the directory "idasdk"
+To build the IDA plugin, extract the contents of idasdk75.zip into any directory of your choice and export it to the "IDASDK" environment variable.
diff --git a/3rdparty/ntdll/ntdll.h b/3rdparty/ntdll/ntdll.h
@@ -223,18 +223,20 @@ typedef struct _UNICODE_STRING
 typedef const UNICODE_STRING *PCUNICODE_STRING;
 
 #define DECLARE_UNICODE_STRING_SIZE(_var, _size) \
-WCHAR _var ## _buffer[_size]; \
-__pragma(warning(push)) \
-__pragma(warning(disable:4221)) __pragma(warning(disable:4204)) \
-UNICODE_STRING _var = { 0, (_size) * sizeof(WCHAR) , _var ## _buffer } \
-__pragma(warning(pop))
+    WCHAR _var ## _buffer[_size]; \
+    __pragma(warning(push)) \
+    __pragma(warning(disable:4221)) \
+    __pragma(warning(disable:4204)) \
+    UNICODE_STRING _var = { 0, (_size) * sizeof(WCHAR) , _var ## _buffer } \
+    __pragma(warning(pop))
 
 #define DECLARE_STATIC_UNICODE_STRING_SIZE(_var, _size) \
-WCHAR _var ## _buffer[_size]; \
-__pragma(warning(push)) \
-__pragma(warning(disable:4221)) __pragma(warning(disable:4204)) \
-static UNICODE_STRING _var = { 0, (_size) * sizeof(WCHAR) , _var ## _buffer } \
-__pragma(warning(pop))
+    WCHAR _var ## _buffer[_size]; \
+    __pragma(warning(push)) \
+    __pragma(warning(disable:4221)) \
+    __pragma(warning(disable:4204)) \
+    static UNICODE_STRING _var = { 0, (_size) * sizeof(WCHAR) , _var ## _buffer } \
+    __pragma(warning(pop))
 
 #if defined(__clang__)
 #define RTL_CONSTANT_STRING(s) \

diff --git a/Documentation/ScyllaHideDocumentation.tex b/Documentation/ScyllaHideDocumentation.tex
@@ -60,7 +60,7 @@ \section{Description}
 \begin{itemize}
 \item OllyDbg v1 and v2 \url{http://www.ollydbg.de}
 \item x64dbg \url{http://x64dbg.com} or \url{https://github.com/x64dbg/x64dbg}
-\item Hex-Rays IDA v6 \url{https://www.hex-rays.com/products/ida}
+\item Hex-Rays IDA v7.5 \url{https://www.hex-rays.com/products/ida}
 \item TitanEngine v2 \url{https://bitbucket.org/mrexodia/titanengine-update} and \url{http://www.reversinglabs.com/open-source/titanengine.html}
 \end{itemize}
 
@@ -85,14 +85,16 @@ \subsection{OllyDbg v1}
 \subsection{OllyDbg v2}
 Copy scylla\_hide.ini, HookLibraryx86.dll and ScyllaHideOlly2.dll to your specific plugins directory.
 
-\subsection{IDA v6}
+\subsection{IDA v7.5}
 \textbf{32-bit:}
 Copy scylla\_hide.ini, HookLibraryx86.dll and ScyllaHideIDA.plw to your IDA plugins directory.
 
 \textbf{64-bit:}
-Copy scylla\_hide.ini, HookLibraryx64.dll, ScyllaHideIDASrvx64.exe and ScyllaHideIDA.p64 to your IDA plugins directory.
+Copy HookLibraryx64.dll, ScyllaHideIDAServerx64.exe to your host machine where you intended to debug (normally a Virtual Machine).
 
-Note: \\Start ScyllaHideIDASrvx64.exe to debug 64bit applications remotely. \\Start ScyllaHideIDASrvx86.exe to debug 32bit applications remotely.
+Copy ScyllaHideIDAProPlugin64.dll and scylla\_hide.ini to your IDA plugins directory.
+
+Note: \\Start ScyllaHideIDAServerx64.exe to debug 64bit applications remotely. \\Start ScyllaHideIDASrvx86.exe to debug 32bit applications remotely.
 
 Command line: ScyllaHideIDASrvxXX.exe <port>\\
 For example: ScyllaHideIDASrvxXX.exe 1345

diff --git a/HookLibrary/DllMain.cpp b/HookLibrary/DllMain.cpp
@@ -2,8 +2,9 @@
 
 #pragma comment(linker, "/ENTRY:DllMain")
 
+//----------------------------------------------------------------------------------
 BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
 {
     LdrDisableThreadCalloutsForDll(hinstDLL);
     return TRUE;
-}
+}
diff --git a/HookLibrary/Export.def b/HookLibrary/Export.def
@@ -1,33 +1,33 @@
 LIBRARY
 EXPORTS
-HookDllData
-HookedGetLocalTime
-HookedGetSystemTime
-HookedGetTickCount
-HookedGetTickCount64
-HookedKiUserExceptionDispatcher
-HookedNativeCallInternal
-HookedNtClose
-HookedNtContinue
-HookedNtCreateThread
-HookedNtCreateThreadEx
-HookedNtDuplicateObject
-HookedNtGetContextThread
-HookedNtQueryInformationProcess
-HookedNtQueryObject
-HookedNtQueryPerformanceCounter
-HookedNtQuerySystemInformation
-HookedNtQuerySystemTime
-HookedNtSetContextThread
-HookedNtSetDebugFilterState
-HookedNtSetInformationProcess
-HookedNtSetInformationThread
-HookedNtUserBlockInput
-HookedNtUserBuildHwndList
-HookedNtUserBuildHwndList_Eight
-HookedNtUserFindWindowEx
-HookedNtUserGetForegroundWindow
-HookedNtUserQueryWindow
-HookedNtYieldExecution
-HookedOutputDebugStringA
-HookedNtResumeThread
+	HookDllData
+	HookedGetLocalTime
+	HookedGetSystemTime
+	HookedGetTickCount
+	HookedGetTickCount64
+	HookedKiUserExceptionDispatcher
+	HookedNativeCallInternal
+	HookedNtClose
+	HookedNtContinue
+	HookedNtCreateThread
+	HookedNtCreateThreadEx
+	HookedNtDuplicateObject
+	HookedNtGetContextThread
+	HookedNtQueryInformationProcess
+	HookedNtQueryObject
+	HookedNtQueryPerformanceCounter
+	HookedNtQuerySystemInformation
+	HookedNtQuerySystemTime
+	HookedNtSetContextThread
+	HookedNtSetDebugFilterState
+	HookedNtSetInformationProcess
+	HookedNtSetInformationThread
+	HookedNtUserBlockInput
+	HookedNtUserBuildHwndList
+	HookedNtUserBuildHwndList_Eight
+	HookedNtUserFindWindowEx
+	HookedNtUserGetForegroundWindow
+	HookedNtUserQueryWindow
+	HookedNtYieldExecution
+	HookedOutputDebugStringA
+	HookedNtResumeThread
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		To build the IDA plugin, extract the contents of idasdk695.zip in the directory "idasdk"
		To build the IDA plugin, extract the contents of idasdk75.zip into any directory of your choice and export it to the "IDASDK" environment variable.