Evasion Technique Integration Methodology
⛔ In-depth Reference
7 categories of evasion techniques quick reference
| Type |
Purpose |
Complexity |
Typical Techniques |
| api_obfuscation |
Hide API imports |
medium |
API Hashing, IAT obfuscation |
| string_obfuscation |
Hide sensitive strings |
simple |
XOR encryption, compile-time obfuscation |
| memory_evasion |
Avoid RWX memory pages |
simple |
Permission flipping (RW→RX) |
| execution_evasion |
Bypass Hook |
complex |
Direct Syscall, indirect Syscall |
| anti_analysis |
Detect debugging/sandbox |
medium |
IsDebuggerPresent, timing difference, CPU core count |
| amsi_etw_bypass |
Disable AMSI/ETW |
medium |
AmsiScanBuffer Patch, EtwEventWrite Patch |
| unhooking |
Restore hooked DLL |
complex |
NTDLL remapping |
Integration process
1. 读取目标 Loader 源码
2. 查免杀技术库 → references/evasion-techniques-db.json
3. 分析兼容性
├─ 使用 RWX？ → 加 memory_evasion（权限翻转）
├─ 使用标准 API？ → 加 execution_evasion（Syscall）
├─ 有明文字符串？ → 加 string_obfuscation（XOR）
└─ 无反调试？ → 加 anti_analysis
4. 逐项整合（参考 references/integration-patterns.md）
5. 交叉编译验证
6. 输出变更报告
Compatibility matrix
| Loader characteristics |
Compatible techniques |
| Any Loader |
API obfuscation, string obfuscation, anti-debugging |
| Uses RWX memory |
Permission flipping |
| Uses standard Win API |
Syscall replacement |
| No Unhook performed |
NTDLL Unhooking |
Quick code example
Permission flipping (most commonly used)
// Before: PAGE_EXECUTE_READWRITE（一步到位，易被检测）
LPVOID addr = VirtualAlloc(NULL, size, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
// After: 先 RW 写入，再改 RX 执行
LPVOID addr = VirtualAlloc(NULL, size, MEM_COMMIT, PAGE_READWRITE);
memcpy(addr, shellcode, size);
VirtualProtect(addr, size, PAGE_EXECUTE_READ, &oldProtect);
String XOR
char dllName[] = { 0x1a, 0x14, 0x07, ... }; // XOR encrypted
for (int i = 0; i < sizeof(dllName); i++) dllName[i] ^= KEY;
RWX permission separation
- Two-step operation: write first, then execute (W+X separation), do not use RWX in one step
- Verify: compilation passes, functionality works, execution result verified
