Would writing a wrapper for some sort of standard lib affect detection rates?
I know lots of that stuff is determined compile-time statically, but if I make a library that basically just calls some standard libraries in its stead, would compilers be smart enough to ignore the wrapping and go straight to those functions or potentially try to work with it and end up linking everything together as verbosely as I write it?
Or rather, are there any compiler options/optimizations that could add this functionality that you know of? I'm about 90% sure that MSVCP/VS C++ compiler debug mode does something like this, but again, I don't like having a resulting binary that's 10x bigger than the release mode.
As far as detection rates are concerned, I'm more focused on the usual signature detection, so it's pretty easy to get around with other means (LD_PRELOAD, adding shit, changing shit, throwing around the order of shit, etc.)
I know lots of that stuff is determined compile-time statically, but if I make a library that basically just calls some standard libraries in its stead, would compilers be smart enough to ignore the wrapping and go straight to those functions or potentially try to work with it and end up linking everything together as verbosely as I write it?
Or rather, are there any compiler options/optimizations that could add this functionality that you know of? I'm about 90% sure that MSVCP/VS C++ compiler debug mode does something like this, but again, I don't like having a resulting binary that's 10x bigger than the release mode.
As far as detection rates are concerned, I'm more focused on the usual signature detection, so it's pretty easy to get around with other means (LD_PRELOAD, adding shit, changing shit, throwing around the order of shit, etc.)
humble rubyist in a world of pythonistas



