3

If program A scans RAM, running processes and whatever, can I hide program B from being detected by A?

Basically, I don't want program A to detect program B, or at least, stop it from identifying it. Is this possible or is something like changing the file name enough?

I can't modify any of the files of program A, but I probably can with program B. Program A is looking for, knows the name and probably looks for behavior as well of program B.

  • 1
    So, you just want to hide the process name? Do you have control over program A, or just program B? Does program A know the name of program B and is looking for it? Is program A also looking at the behaviour of program B? – schroeder Sep 3 '15 at 4:27
  • @schroeder I don't know what you mean exactly by control but I can't modify any of the files of program A but I probably can with program B. Yes, program A is looking for, knows the name and probably looks for behavior as well of program B. I don't know everything 100% but I guess every security measure is worth it (unless it requires too much time to do). – derter28 Sep 3 '15 at 4:40
8

Yes, it's possible.

This kind of behavior is seen on a class of programs called rootkit. A rootkit employs a number of techniques to avoid detection.

Some of those techniques:

  • Thread injection

    In this case, Program B injects a thread on another running process. If Program A is searching for program_b.exe, it will not find it.

  • Kernel Process Table manipulation

    In this case, Program B manipulates the kernel process table, removing itself from the list of running processes. It renders Program B invisible.

  • Polymorphism

    In this case, Program B will create lots of copies of itself, each one different from the another. This is called polymorphysm. As there is lots of different ways to execute the same action, it can create virtually infinite copies of itself. If Program A is searching for the signature of Program B, it will fail to detect the variations.

  • Behavior change

    Program B can have 2 modes of operation: safe and unsafe. Safe mode is how it will behave when it detects Program A running. As soon as it detects that Program A is not running, it loads anything it needs and enters unsafe mode, doing anything Program A would detect.

There's a lot of another techniques, those are just a few samples. A quick search for Detection avoidance will give you lots of pointers to research.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.