[Veebs]

Antiviruses work by scanning your program's instructions and comparing them to commonly known malicious instructions. You can confuse them by doing a little trick that I like to call "instruction misalignment."

Note: this only works if you are compiling in x86.

In simple terms, insert a couple of NOPs () in the beginning of your entry function (aka int main), like this:
int main()
{
    __asm
    {
        nop // 1
        nop // 2
        nop // 3
        nop // 4
        nop // 5
    }
    // Malicious (or falsly malicious) code here.
}

Afterwards, compile your exe and use a hex editor (like HxD) to make a short jump near the entry function. The hex code for this is "EB 03"
This makes you jump over the other NOPs and straight to your real code.

Now here is where the magic happens. In the hex editor, you should see this combination of bytes:
"EB 03 90 90 90"

Now, replace it with
"EB 03 90 90 A3"

This will cause an instruction misalignment, and the antivirus will interpret everything after this point incorrectly, masking the functionality of your executable.
Keep in mind that due to the interrupt paddings of most compilers, this process might have to be done in the beginning of every function that does something malicious.

I hope this isn't against the rules? I had a quick look through them, and nothing under the restricted black hat activities says I can't post malware tutorials. Please correct me if I'm wrong.

[N1k7]

Good post on anti-virus bypassing topic, I like your misalignment idea.

It would work good but AV's improved a lot, your current methodology will be detected as a small or mini red flag at scantime (memory scanners) due to that specific magic byte. It will be a false positive sometimes, unless the AV's are known to this trick.

Then at the runtime scanning the whole points of NOP instruction is defeated, because the real flow of the execution appears and then as soon as the suspicious call's appear, for example Nt API's and or any syscall's without any unhooking being performed.

They will be caught and get labeled instantly.

Either way, nice post. Keep up the work, learnt something new.

~ peace out.

[Veebs]

Good post on anti-virus bypassing topic, I like your misalignment idea.

It would work good but AV's improved a lot, your current methodology will be detected as a small or mini red flag at scantime (memory scanners) due to that specific magic byte. It will be a false positive sometimes, unless the AV's are known for this trick.

Then at the runtime scanning the whole points of NOP instruction is defeated, because the real flow of the execution appears and then as soon as the suspicious call's appear, for example Nt API's and or any syscall's without any unhooking being performed.

They will be caught and get labeled instantly.

Either way, nice post. Keep up the work, learnt something new.

~ peace out.

That's definitely true, yes. I actually came up with this when I wanted to make a non-malicious software that kept being flagged by windows defender for some reason. I haven't tested making an actually malicious software with this trick yet. I should definitely try that. Thanks for the heads up.