[push r12]

Depends on the emulator.

There are plenty of reasons why HeapAlloc could fail.

If it doesn't contain that value, the emulator is buggy.

The AV must be incredibly dumb to interpret an access violation as "clean" code.

Here is a shorter version of "your" code. Show me an "emulator" that produces the !=123😎

Code

include \masm32\include\masm32rt.inc
.code
start:
mov ecx, 154720540
push ecx
invoke HeapAlloc, rv(GetProcessHeap), 0, ecx
pop ecx
.if eax
    xchg eax, edi
    push edi
    mov al, 123
    rep stosb
    push 0
    .if [edi-1] != al
        xor esp, esp
    .endif
    call GetProcessHeap
    push eax
    call HeapFree
    invoke MessageBox, 0, chr$("my code"), chr$("it's not emulated:"), MB_OK
.endif
invoke ExitProcess, 0
end start

It's 2016 and OP thinks junk calls do anything for creating an undetected binary.

Flagging systems exist, it's 2016. 👍

[wong]

Great man, helped me much, thank you

[๖ۣۜDead]

This method is similar to VirtualAllocExNumA AV bypass but it should work on every Windows

[Wardow]

This method is similar to VirtualAllocExNumA AV bypass but it should work on every Windows

VirtualAllocExNumA is not available on all systems counting on a range from Windows XP to Windows 10, this is likely to decrease execution rate and not a reliable method to base on, I'm sharing this, but there is also regular methods that will always work such as complex anti-emulator loops, they are so easy to make and always works, but obviously delays execution from a bit.

[๖ۣۜDead]

Indeed but there is much shorten code which is unsaturated.
Opcode RDTSC hxxps://en.wikipedia.org/wiki/Time_Stamp_Counter
This opcode may have several variants so CPUID is not bad idea
Just in one proc place RDTSC twice and sub 2 values. If result is higher than ~100, code is emulated.
It may be used inside your code

pseudo:

RDTSC
MOV t0,EAX
RDTSC
MOV t1, EAX
SUB t1,t0
CMP EAX, 100
JG @DETECTED

Emulation have own abnormal features. Eg. you can obtain handle to kernel process from OpenProcess without privileges etc.

[Wardow]

Indeed but there is much shorten code which is unsaturated.
Opcode RDTSC hxxps://en.wikipedia.org/wiki/Time_Stamp_Counter
This opcode may have several variants so CPUID is not bad idea
Just in one proc place RDTSC twice and sub 2 values. If result is higher than ~100, code is emulated.
It may be used inside your code

pseudo:

RDTSC
MOV t0,EAX
RDTSC
MOV t1, EAX
SUB t1,t0
CMP EAX, 100
JG @DETECTED

Emulation have own abnormal features. Eg. you can obtain handle to kernel process from OpenProcess without privileges etc.

Such bugs in emulators are very likely to be fixed easily, here is the Eset's reply about that emulator piece of code:

Spoiler (Click to View)

I prefer limitations than exploits of bugs :)

[๖ۣۜDead]

Well, that only confirming that AVs are made by shitcoders

[Wardow]

Well, that only confirming that AVs are made by shitcoders

We both know that since a while 🤗

[ng-Coder]

We both know that since a while 🤗

Good of you Wardow, nice share.

This bypass AV's emulation at the moment doesn't mean comodo, kaspersky or esset coders are shit.

trust me, few good AV vendors are having very smart coders but the thing is no AV/code can perform magic.

they'll continue updating their modules and DB while you also continue updating your code.

[Wardow]

Good of you Wardow, nice share.

This bypass AV's emulation at the moment doesn't mean comodo, kaspersky or esset coders are shit.

trust me, few good AV vendors are having very smart coders but the thing is no AV/code can perform magic.

they'll continue updating their modules and DB while you also continue updating your code.

There is still pretty easy way to detect such methods that I posted here, they clearly announced it's a limitation.

[G0dl1k3]

thanks for share :) - ill try to implement for some of my source codes, ill come back with result :)

[Hoody]

So essentially... you malloc out 147 Mb of ram, and since the AV vm isnt going to complete the request it will stop the virtualization? Is that the theory here? If so its nothing all that new. Also, creating tcp sockets with fake urls is a good method. Havent checked if it works in a while, but my guess is yes?

EDIT: Also, youll want to use 8 (HEAP_ZERO_MEMORY) as the dwFlag for HeapAlloc. If you dont there could already be a 123 byte in the allocation and it would stop early, possibly allowing the antivirus virtual machine to execute the payload

[Nitai]

The idea is pretty clever, however AVs is capable detecting anti emulation tricks using AI. but you still can break them :)

[PELock]

I suggest SSE2 instructions :) or hell even AVX at the start. Btw RDTSC will fail on multicore CPUs (it can return false results when used to measure the execution time), use QueryPerformanceCounter and QueryPerformanceFrequency.

[sepluv]

This seems pretty interesting. Definitely going to test it out. What emulators have you tested it with so far?