mrexodia/TitanHide

Health v2 · maintenance only

Adoption not part of the score

2840 stars · 490 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

TitanHide is a Windows kernel driver that hides debuggers from selected processes by hooking Nt* kernel functions via SSDT hooks and altering their return values. It defeats common anti-debugging checks such as ProcessDebugPort, ProcessDebugFlags, NtClose, and hardware breakpoint protection.

Use cases

• hide a debugger from anti-debug-protected processes
• bypass anti-debugging checks when reverse engineering malware
• defeat ProcessDebugPort and ProcessDebugFlags detection
• hide hardware breakpoints from a target process
• research Windows kernel SSDT hooking techniques
• analyze protected or packed binaries under a debugger

When to choose

• you need kernel-level anti-anti-debug on Windows x86/x64
• user-mode tools like ScyllaHide are insufficient for your target
• you want an extensible driver to add custom hiding hooks

When to avoid

• you are not comfortable disabling PatchGuard and driver signing enforcement
• you need a simple user-mode anti-anti-debug solution
• you are on a non-Windows platform
• you cannot accept the risk of CRITICAL_STRUCTURE_CORRUPTION bugchecks

Facets

library · maturity active

security reverse-engineering developer-tools security reverse-engineering windows developer-tools windows cpp kernel-driver anti-anti-debug ssdt-hooks debugging rootkit-techniques x86 x64

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mrexodia/TitanHide")