[EP_X0FF]

This is already done by HideTools and Phanton alike plugins for OllyDbg.

[Tigzy]

This is already done by HideTools and Phanton alike plugins for OllyDbg.

I couldn't find any HideTools link, do you have one?

[EP_X0FF]

This is already done by HideTools and Phanton alike plugins for OllyDbg.

I couldn't find any HideTools link, do you have one?

not original, binary modified version by Fyyre

http://fyyre.ivory-tower.de/

[Tigzy]

Thanks, kind of usefull tool!

EDIT: Any documentation about what is hidden or not ? It hides registry keys as well?

[EP_X0FF]

Thanks, kind of usefull tool!

EDIT: Any documentation about what is hidden or not ? It hides registry keys as well?

Look at it's hooks in SST/SSST. That's all documentation you need to know.

[Tigzy]

Yes I saw this, so this is basically only a process hider?
Any anti-VM which checks for VMware registry keys will found it, I thought it was a built-in VM hider

[EP_X0FF]

This is program A. It detects by malware. This is program B. It detects by malware. A and B all the different and all GUI based. How do you planning to protect them from detection in a generic way? It's impossible.

I mean every program often targeted (process exp , ollyDbg, etc...). Malware have generic ways to detect them, so I only need to act as well.

My initial reply was for this post.

Yet again, it's impossible and no sense to built such hide anything stuff. You will create BSOD-generator nothing more.

[Tigzy]

Yet again, it's impossible and no sense to built such hide anything stuff. You will create BSOD-generator nothing more.

We'll see. You're probably right, but as this tools will be for VMs, we don't take much risks.

[EP_X0FF]

BlueRidge AppGuard is primitive SSDT hooker. And as any hooker it can be easily detected by backtracing system call which it hooked for example OpenProcess. The only problem here is start payload executable, because startup is controlled by primitive NtCreateSection hook. There is BTW easy way to turn this idiocy ban itself, but this is offtopic and I'm not going to help developers of this paid app.