Safedisc C-Dilla Detection

[OnionTerror]

using 32 bit debugger (x64dbg), Scyllahide seems to be detected by the old safedisc protection

[nckstwrt]

This always bugged me too - thinking how can ScyllaHide not be able to hide from Safedisc? One thing that was catching me out was that Safedisc scans through all the Kernel32 functions checking the first byte for 0xCC to see if there's a breakpoint on any one of them. If there is the debugger will be detected. So either remove all your breakpoints from the very start of system functions or patch the check. The check looked like the below for me:

6670C161 |> |8B19 /MOV EBX,DWORD PTR DS:[ECX]
6670C163 |. |803C03 CC |CMP BYTE PTR DS:[EAX+EBX],0CC
6670C167 |. |75 01 |JNE SHORT 6670C16A
6670C169 |. |46 |INC ESI <--- NOP this or similar to patch it
6670C16A |> |83C1 04 |ADD ECX,4
6670C16D |. |4A |DEC EDX
6670C16E |.^|75 F1 \JNZ SHORT 6670C161
(in ~df394b.tmp)