Search Evasion Techniques
Names, Techniques, Definitions, Keywords
Search Result
12 item(s) found so far for this keyword.
Tamper DLL Export Names & GetProcAddress Spoofing Process Manipulating
When a process is running, it is possible to change the results of the call to GetProcAddress API, for the exported functions of a module along with modifying the export's offsets and name at runtime.
For example, the offset of kernel32.dll's function VirtualAlloc can be change to the offset of another function. When VirtualAlloc is called (after getting its …
Al-Khaser_WriteWatch Anti-Debugging
Default invalid parameter values of Al-Khaser's Anti-Debug technique (VirtualAlloc/MEM_WRITE_WATCH). Used for checking API hooks in debuggers/sandboxes.