So if I inject my dll to a pprocess (or all running processes, including AVs) and it hooks some functions, why can't I just simply hook the functions (WinAPI functions) that could detect my injection and hook process? But the thing is, I don't know what API does AVs use to detect it. Do you know any? Or does AVs even use WINAPI to detect these hooks? or injections?
Just some questions: * What possible WinAPI can be used to detect injected dll's or unknown threads (from CreateRemoteThread?)? Like, maybe an API that enumerate's all dll process or threads. * If I hooks those functions, should I be able to hide my hook?
What I'm talking about here is that, can't I hook the functions that AVs use to detect my malicous activity?