NtDetours

NTSTATUS NTAPI TrInitPVOID ImageBase = &ImageBase; make IAT writable. look for simple.cpp TimedSleepEx calls the real SleepEx API through the TrueSleepEx function pointer. static DWORD WINAPI TrueSleepExDWORD dwMilliseconds, BOOL bAlertable = SleepEx; DWORD WINAPI TimedSleepExDWORD dwMilliseconds...

New Malware Can't Be Caught Napping

The aptly named Trojan Nap, a stealthy type of malware recently discovered by researchers at FireEye is able to evade detection methods by tricking scanners into thinking it’s asleep. This is according to researchers Abhishek Singh and Ali Islam with the California-based security firm who wrote o...