Why do some antiviruses hook x64 Ntdll in WOW64 process? However, the same antiviruses do not hook Ntdll in the native x64 processes.
2
-
Two guesses, although I can not offer an authoritative answer (and I doubt anyone can without spilling business secrets). For starters WOW64 has been used for evasion in the past. So that may be part of the motivation behind doing it that way. However, it also makes sense to hook the 64-bit underlying code, because that's what it comes down to in the end and in case a kernel mode driver partakes in the hooking process (e.g. via APCs) that would be an explanation, too, for targeting the 64-bit code. However, this question is pretty much opinion-based.– 0xC0000022L ♦Jan 5, 2021 at 12:55
-
@0xC0000022L is correc that: x64 Ntdll is hooked in order to capture execution in the 64-bit mode after switching from 32-bit mode (e.g. via Heaven's Gate technique). If the x64 Ntdll isn't hooked in 64-bit processes, it might be due to different detection techniques.– peter ferrieJan 8, 2021 at 19:51
Add a comment
|