0

So if I inject my dll to a pprocess (or all running processes, including AVs) and it hooks some functions, why can't I just simply hook the functions (WinAPI functions) that could detect my injection and hook process? But the thing is, I don't know what API does AVs use to detect it. Do you know any? Or does AVs even use WINAPI to detect these hooks? or injections?

Just some questions: * What possible WinAPI can be used to detect injected dll's or unknown threads (from CreateRemoteThread?)? Like, maybe an API that enumerate's all dll process or threads. * If I hooks those functions, should I be able to hide my hook?

What I'm talking about here is that, can't I hook the functions that AVs use to detect my malicous activity?

0

Antivirus vendors don't publicise all their methods of detecting malware, otherwise someone else would just copy them. There's more to detection than watching API calls.

Are you trying to detect DLL hooks yourself, or is this just a thought exercise?

Here's a discussion on the reverse engineering stack exchange that talks about I'll hook detection from a victim software POV.

https://reverseengineering.stackexchange.com/questions/2262/how-can-dll-injection-be-detected

That community may be a better fit for this question as DLL injection is common in malware and they analyse malware all day long.

  • "someone else would just copy them". That's not the main concern. Malware authors will know how to avoid detection. – ThoriumBR Sep 1 at 18:56
0

The chief problem with your approach is that a process doesn't need any API to check its own address space. It can just read from it; that's pretty much the definition of its address space. So an AV product can set up a "bait" process which knows what should and should not be running in its address space, and catch unexpected code.

Would you know how this bait process looks? Not realistically. The AV code can generate this bait process on the fly, so it's different every time. For another AV product this would look awfully fishy, hence the advise to never run two AV products in parallel.

There's one slight complication with this method: your hooks could be somewhat stealthy, and actually be generated on the fly via an exception handler. But this exception handler itself has to exist, and can be detected instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.