The preparation
Unlike when searching for vulnerabilities and exploiting them, bypass techniques do not mainly deal with antivirus engine vulnerability research. Instead, they deal more with writing malware that contains a number of bypass techniques and then test the malware containing these techniques against the antivirus engines we seek to bypass.
For example, if we want to find a particular vulnerability in an antivirus engine, we need to the following:
- We need to gather research leads. Then, for each lead, we will have to determine what the lead does, when it starts running, whether it is a service, whether it starts running when we scan a file, and whether it is a DLL injected into all processes, along with many further questions to help guide our research.
- After that, we need to understand which vulnerability we are looking for, and only then can we actually begin researching antivirus software to find the vulnerability.
- To use a bypass technique, we first...