[Feminist]

That's absolute bullshit, tonnes of legitimate processes use both functions and aren't detected.

So you are telling me not no antivirus in the world hooks any processes either in ring0 or ring3?

And that no antivirus in the world will detect a file as a virus for calling:
CreateProcessA
NtUnmapViewOfSection
WriteProcessMemory (for each section)
and then setting the context,
CreateRemoteThread

You are saying that no antivirus in the world does that?

Because I'm pretty sure your claim of "legitimate software" doing the above is false. Why not show me one "legit software" that does exactly as stated above?

Your assertions are laughable and can easily be disproved in a single screenshot.

[IRP_MJ_SCSI]

So you are telling me not no antivirus in the world hooks any processes either in ring0 or ring3?

And that no antivirus in the world will detect a file as a virus for calling:
CreateProcessA
NtUnmapViewOfSection
WriteProcessMemory (for each section)
and then setting the context,
CreateRemoteThread

You are saying that no antivirus in the world does that?

Because I'm pretty sure your claim of "legitimate software" doing the above is false. Why not show me one "legit software" that does exactly as stated above?

Your assertions are laughable and can easily be disproved in a single screenshot.

Do you have special needs or just no understanding of how security software works?

Proactive defense (or ring 3/ring 0 hooking as noobs call it) uses pattern matching and parameter checks to detect malicious use of certain native API functions, under no circumstance does it straight out detect a process just because it called a function.

[Feminist]

Do you have special needs or just no understanding of how security software works?

Proactive defense (or ring 3/ring 0 hooking as noobs call it) uses pattern matching and parameter checks to detect malicious use of certain native API functions, under no circumstance does it straight out detect a process just because it called a function.

Come back to my thread when you have reverse engineered antiviruses, can program something more than a hello world application, and know what you are talking about.

Avast antivirus increments an integer value for each time one of the above functions is called. Of course, it would have to check parameters to increment the specified integer for the specified process.

Once that integer reaches 3, it is detected as a virus.

So please, go away and come back when you have actually reverse engineered something and know what you are talking about.

Thanks.

[IRP_MJ_SCSI]

Come back to my thread when you have reverse engineered antiviruses, can program something more than a hello world application, and know what you are talking about.

Avast antivirus increments an integer value for each time one of the above functions is called. Of course, it would have to check parameters to increment the specified integer for the specified process.

Once that integer reaches 3, it is detected as a virus.

So please, go away and come back when you have actually reverse engineered something and know what you are talking about.

Thanks.

LMFAO, you're so stupid it's amazing. I just installed Avast and called WriteProcessMemory 4 times, no proactive detection: Please explain.

Big hackforums hacker who reverse engineers kernel mode antivirus components selling crypter on HF, hahahahah.

P.S Antiviruses can't even deploy SSDT hooks on x64.

[Feminist]

LMFAO, you're so stupid it's amazing. I just installed Avast and called WriteProcessMemory 4 times, no proactive detection: Please explain.

Big hackforums hacker who reverse engineers kernel mode antivirus components selling crypter on HF, hahahahah.

P.S Antiviruses can't even deploy SSDT hooks on x64.

We're having communication issues because of your poor reading comprehension skills.
Antiviruses can definitely still hook on x64. Oh no SSDT hooks patchguard skidding4lifeyolobean
Copy paste a RunPE module and execute it. And you'll see what I mean. You clearly didn't read my post properly, and you're clearly only here to make trouble.

[IRP_MJ_SCSI]

We're having communication issues because of your poor reading comprehension skills.
Antiviruses can definitely still hook on x64.
Copy paste a RunPE module and execute it. And you'll see what I mean. You clearly didn't read my post properly, and you're clearly only here to make trouble.

You're the one who cannot read, you specifically said "Additionally, some Antiviruses hook NtUnmapViewOfSection, WriteProcessMemory and will detect any file as malware if they call those functions."

What you said there was any file will be detected as malware if it calls NtUnmapViewOfSection and/or WriteProcessMemory, which isn't even close to true.

x64 they can't hook the SSDT which means they can't see if such functions are called without deploying usermode hooks which can be bypasses with like 3 instructions. Maybe you need to do some deeper reversing of your imaginary antivirus, because Proactive Defense uses complex heuristical patterns to detect malware based on in which order the functions are called, with which parameters and to which process, there's nothing as simple as "If NtUnmapViewOfSection is Called 3 times then detect as virus".

Need to study harder bro.

[Feminist]

You're the one who cannot read, you specifically said "Additionally, some Antiviruses hook NtUnmapViewOfSection, WriteProcessMemory and will detect any file as malware if they call those functions."

What you said there was any file will be detected as malware if it calls NtUnmapViewOfSection and/or WriteProcessMemory, which isn't even close to true.

x64 they can't hook the SSDT which means they can't see if such functions are called without deploying usermode hooks which can be bypasses with like 3 instructions. Maybe you need to do some deeper reversing of your imaginary antivirus, because Proactive Defense uses complex heuristical patterns to detect malware based on in which order the functions are called, with which parameters and to which process, there's nothing as simple as "If NtUnmapViewOfSection is Called 3 times then detect as virus".

Need to study harder bro.

Now you're rambling about SSDT hooks being the only possible hook in kernel mode. Unbelievable.

Hilarious bro. I never said that if NtUnmapViewOfSection is called 3 times then it will detect it as a virus. I stated the threshold value is 3, and if certain commands with certain params are called it will trigger Avast. (different thresholds for different types)

I more then welcome you to download Avast and analyze its driver files in IDA Pro and analyze it yourself Mr Pro Reverse Code Engineer Who Is Denying Everything I Say.

[IRP_MJ_SCSI]

Now you're rambling about SSDT hooks being the only possible hook in kernel mode. Unbelievable.

I more then welcome you to download Avast and analyze its driver files in IDA Pro and analyze it yourself Mr Pro Reverse Code Engineer Who Is Denying Everything I Say.

Go on the, tell me how you will detect calls to NtWriteProcessMemory and NtUnmapViewOfSection from kernel mode without SSDT hooks?

I mean it's pretty clear that you're a scriptkiddie who thinks he's some amazing malware guru and antivirus expert, but I'll pretend to believe what you say. If you want I'll give you extra points for knowing what IDA is.

Hilarious bro. I never said that if NtUnmapViewOfSection is called 3 times then it will detect it as a virus. I stated the threshold value is 3, and if certain commands with certain params are called it will trigger Avast. (different thresholds for different types)

"Avast antivirus increments an integer value for each time one of the above functions is called. Of course, it would have to check parameters to increment the specified integer for the specified process.

Once that integer reaches 3, it is detected as a virus."

Your short term memory isn't great, might want to get that checked out.

[Feminist]

Go on the, tell me how you will detect calls to NtWriteProcessMemory and NtUnmapViewOfSection from kernel mode without SSDT hooks?

I mean it's pretty clear that you're a scriptkiddie who thinks he's some amazing malware guru and antivirus expert, but I'll pretend to believe what you say. If you want I'll give you extra points for knowing what IDA is.

"Avast antivirus increments an integer value for each time one of the above functions is called. Of course, it would have to check parameters to increment the specified integer for the specified process.

Once that integer reaches 3, it is detected as a virus."

Your short term memory isn't great, might want to get that checked out.

You're 150% right bro. Absolutely. It's impossible to hook the kernel without using SSDT hooks. Absolutely 150% correct. Actually, you're 2000% correct.

You can only hook the kernel with SSDT hooks.
Spoiler (Click to View)
Hilarious. Just hilarious.

Now go troll someone else.

Thanks.

[IRP_MJ_SCSI]

You're 150% right bro. Absolutely. It's impossible to hook the kernel without using SSDT hooks. Absolutely 150% correct. Actually, you're 2000% correct.

You can only hook the kernel with SSDT hooks.
Spoiler (Click to View)
Hilarious. Just hilarious.

Now go troll someone else.

Thanks.

Are you trolling because you can't answer my question or because you legitimately think that somewhere in this thread I said "it is impossible to hook the kernel without using SSDT hooks".

Again more evidence of your reading disability.

[Reporter]

Same price as any crypter, how long its FUD that matter

[~Tom~]

it dosent matter if uses runpe or not,
the thing matter is for how many days or how long will it be FUD.

🤦‍♂ As you can probably see from the replies in this thread hf isn't the place to be selling such crypter.

[Razοr]

It is not even hard to make a runpe runtime FUD.
If you just C&P a public one it will be detected instantly, sure - but if you code one and modify it you can get it runtime FUD without any problem.
Good luck with your product, but 1. i think this is the wrong place to sell it and 2. you should actually stick to the truth when posting such "facts".

-Doesn't mean that i don't think runpes are overused, but if done right it is still effective.

[Feminist]

It is not even hard to make a runpe runtime FUD.
If you just C&P a public one it will be detected instantly, sure - but if you code one and modify it you can get it runtime FUD without any problem.
Good luck with your product, but 1. i think this is the wrong place to sell it and 2. you should actually stick to the truth when posting such "facts".

-Doesn't mean that i don't think runpes are overused, but if done right it is still effective.

And by "code and modify" you mean changing variable names and adding junk code.

AutoIT.

Of course you are going to blatantly defend RunPE when you have a product to sell on this forum. The truth of the matter is that changing variable names and adding junk code isn't going to make your RunPE bypass AV's that actually look for things.

What facts? Care to elaborate which "facts" I am posting which are false?

[Razοr]

And by "code and modify" you mean changing variable names and adding junk code.

AutoIT.

Of course you are going to blatantly defend RunPE when you have a product to sell on this forum. The truth of the matter is that changing variable names and adding junk code isn't going to make your RunPE bypass AV's that actually look for things.

What facts? Care to elaborate which "facts" I am posting which are false?

I'm not going to argue about AutoIT here, i already know that it gets called a "bad" language because of it's stub size and don't care about people with such ridiculous arguments.

In fact modifying variable names & adding junk code will not help against the most runtime detection (there are still shitty AVs that get confused by junk on runtime too - add 1M lines of junk to something runtime detected by bitdefender and watch what happens when you execute it - this is no solution that should be used to bypass runtime detection, but well just saying that it works on some AVs).

And sure i am "defending" runpes, as they still work - i know that they could get detected or even blocked very easily by AVs, but tell that the AV-companies as you can still bypass ALL AVs using a runpe without any problem. It is not my fault that AV-companies missed to fix this for years. The max you will ever get with a completely unknown runpe is a PUA detection and well if you ever needed to get around a PUA detection you know that it is no big deal.

Well you are implying that it is fact that runpes can't bypass AVs anymore - if you do some testing you will find out that it is not true very fast. Kaspery, ESET, Norton - all the "big" AVs will fail detecting a runpe once it gets modified a bit and not using the common sheme.

🤝 Razor

P.S.:
Also if you want to argue a bit about AutoIT, please do me a favor and take a look at the benefits of an interpreted language that works like AutoIT when it comes to this topic.