✨ANTIVIRUS EXPLAINED !

Always with the excellently written tutorials and highly informative threads, at some point we need to discuss bypass methods like using obscure api calls to determine if software is run in a sandbox which is emulating the actual environment. Maybe also touch on memory permissions, AV doesn't like seeing sections with RWX.

Some simple things like attempting to access Web domains which does not exist also work. In the real world, it fails. In an AV, it will work since the AV will use its own simulated page, also sometime allocating large memory like 100 MB also works  :wesmart: