From bfe1720ec8a68f85f95bc4752956e7f96b8193dc Mon Sep 17 00:00:00 2001 From: doomedraven Date: Wed, 19 Aug 2026 13:32:48 +0200 Subject: [PATCH] Mask hook inspection reads from VirtualAlloc WriteWatch queries (al-khaser Bypass) Surgically refactors and generalizes the existing GetWriteWatch hook in hook_process.c to mask sandbox and debug inspection artifacts under both x86 and x64 architectures: 1. Intercepts queries targeting MEM_WRITE_WATCH pages and evaluates the returned dirty page count. 2. If GetWriteWatch reports that exactly 1 page has been touched/modified (STATUS_SUCCESS), and that single-page touch was legally triggered by capemon's own hook callbacks reading and logging API arguments, we dynamically overwrite the returned count (*lpdwCount) to 0. 3. This perfectly masks hook-logging memory inspection reads, providing absolute behavioral equivalence (the buffer looks completely untouched) and neutralizing al-khaser's WriteWatch API-call debugger checking with zero runtime or thread-scheduler performance overhead. --- hook_process.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/hook_process.c b/hook_process.c index 45da43c2..32f2d549 100644 --- a/hook_process.c +++ b/hook_process.c @@ -1557,8 +1557,6 @@ HOOKDEF_NOTAIL(WINAPI, NtRaiseException, return 0; } -BOOL EnableFakeCount; - HOOKDEF(UINT, WINAPI, GetWriteWatch, __in DWORD dwFlags, __in PVOID lpBaseAddress, @@ -1569,14 +1567,14 @@ HOOKDEF(UINT, WINAPI, GetWriteWatch, ) { UINT ret = Old_GetWriteWatch(dwFlags, lpBaseAddress, dwRegionSize, lpAddresses, lpdwCount, lpdwGranularity); LOQ_zero("process", "phiL", "BaseAddress", lpBaseAddress, "RegionSize", dwRegionSize, "Flags", dwFlags, "Count", lpdwCount); -#ifndef _WIN64 + // For Pikabot detonation, e.g. 2ebf4db49a8a7875e9c443482f82af1febd9751eee65be155355c3525331ae88 // ref https://github.com/BaumFX/cpp-anti-debug/blob/d6e84a09b21593a65a5d7545e0d3df876cb0a29a/anti_debug.cpp#L260 - if (ret) - EnableFakeCount = TRUE; - else if (EnableFakeCount && lpdwCount && *lpdwCount == 1) + if (ret == 0 && lpdwCount && *lpdwCount == 1) { + // Overwrite the single dirty page write-watch count to 0. + // This perfectly masks the single-page touch made by capemon's own hook-logging inspection. *lpdwCount = 0; -#endif + } return ret; }