From 83b507e67278e40d04388d286c995db1bcd2bf0a Mon Sep 17 00:00:00 2001
From: jtaw5649 <213313463+jtaw5649@users.noreply.github.com>
Date: Mon, 1 Jun 2026 11:46:43 +0100
Subject: [PATCH] fix: correct HyperEvade hide guard

---
 hyperdbg/hyperevade/code/SyscallFootprints.c           |  6 ++++--
 hyperdbg/hyperevade/code/Transparency.c                |  2 +-
 hyperdbg/hyperevade/header/SyscallFootprints.h         |  2 +-
 hyperdbg/hyperevade/header/pch.h                       |  7 -------
 hyperdbg/include/config/Configuration.h                |  2 +-
 .../code/debugger/commands/extension-commands/hide.cpp | 10 ++++++++--
 6 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/hyperdbg/hyperevade/code/SyscallFootprints.c b/hyperdbg/hyperevade/code/SyscallFootprints.c
index 75305a82..33273254 100644
--- a/hyperdbg/hyperevade/code/SyscallFootprints.c
+++ b/hyperdbg/hyperevade/code/SyscallFootprints.c
@@ -11,6 +11,8 @@
  */
 #include "pch.h"
 
+#if ActivateHyperEvadeProject != TRUE
+
 /**
  * @brief Handle The triggered hook on KiSystemCall64 system call handler
  * when the Transparency mode is disabled
@@ -50,7 +52,7 @@ TransparentCallbackHandleAfterSyscall(GUEST_REGS *                      Regs,
     UNREFERENCED_PARAMETER(Params);
 }
 
-#if DISABLE_HYPERDBG_HYPEREVADE == FALSE
+#else  // ActivateHyperEvadeProject != TRUE
 
 /**
  * @brief Handle The triggered hook on KiSystemCall64 system call handler
@@ -1968,4 +1970,4 @@ TransparentCallbackHandleAfterSyscall(GUEST_REGS *                      Regs,
                 Params->OptionalParam4);
     }
 }
-#endif
+#endif // ActivateHyperEvadeProject != TRUE
diff --git a/hyperdbg/hyperevade/code/Transparency.c b/hyperdbg/hyperevade/code/Transparency.c
index 62b40b10..ee68a703 100644
--- a/hyperdbg/hyperevade/code/Transparency.c
+++ b/hyperdbg/hyperevade/code/Transparency.c
@@ -54,7 +54,7 @@ TransparentHideDebugger(HYPEREVADE_CALLBACKS *                        Hyperevade
         RtlCopyBytes(&g_SystemCallNumbersInformation,
                      &TransparentModeRequest->SystemCallNumbersInformation,
                      sizeof(SYSTEM_CALL_NUMBERS_INFORMATION));
-#if DISABLE_HYPERDBG_HYPEREVADE == FALSE
+#if ActivateHyperEvadeProject == TRUE
         //
         // Choose a random genuine vendor string to replace hypervisor vendor data
         //
diff --git a/hyperdbg/hyperevade/header/SyscallFootprints.h b/hyperdbg/hyperevade/header/SyscallFootprints.h
index 25acd6b5..40ab41dc 100644
--- a/hyperdbg/hyperevade/header/SyscallFootprints.h
+++ b/hyperdbg/hyperevade/header/SyscallFootprints.h
@@ -161,7 +161,7 @@ SYSTEM_CALL_NUMBERS_INFORMATION g_SystemCallNumbersInformation;
 //				   Constants        			//
 //////////////////////////////////////////////////
 
-#if DISABLE_HYPERDBG_HYPEREVADE == FALSE
+#if ActivateHyperEvadeProject == TRUE
 
 /**
  * @brief A list of windows processes, for which to ignore systemcall requests
diff --git a/hyperdbg/hyperevade/header/pch.h b/hyperdbg/hyperevade/header/pch.h
index c0144bb0..fb9bccaf 100644
--- a/hyperdbg/hyperevade/header/pch.h
+++ b/hyperdbg/hyperevade/header/pch.h
@@ -23,13 +23,6 @@
 
 #ifdef HYPERDBG_ENV_WINDOWS
 
-//
-// The DLL is flagged by antivirus software, since it contains anti-debugging and anti-hypervisor methods
-// as well as different anti-debugging strings
-// For now, we disable the HyperDbg Hyperevade module
-//
-#    define DISABLE_HYPERDBG_HYPEREVADE TRUE
-
 //
 // Windows defined functions
 //
diff --git a/hyperdbg/include/config/Configuration.h b/hyperdbg/include/config/Configuration.h
index e0e4dec3..9a78bc41 100644
--- a/hyperdbg/include/config/Configuration.h
+++ b/hyperdbg/include/config/Configuration.h
@@ -77,4 +77,4 @@
 /**
  * @brief Activates the hyperevade project
  */
-#define ActivateHyperEvadeProject TRUE
+#define ActivateHyperEvadeProject FALSE
diff --git a/hyperdbg/libhyperdbg/code/debugger/commands/extension-commands/hide.cpp b/hyperdbg/libhyperdbg/code/debugger/commands/extension-commands/hide.cpp
index 8a3c989b..cedeee31 100644
--- a/hyperdbg/libhyperdbg/code/debugger/commands/extension-commands/hide.cpp
+++ b/hyperdbg/libhyperdbg/code/debugger/commands/extension-commands/hide.cpp
@@ -217,7 +217,7 @@ CommandHideFillSystemCalls(SYSTEM_CALL_NUMBERS_INFORMATION * SyscallNumberDetail
         Result = FALSE;
     }
 
-    return TRUE;
+    return Result;
 }
 
 /**
@@ -267,6 +267,12 @@ HyperDbgEnableTransparentMode(UINT32 ProcessId, CHAR * ProcessName, BOOLEAN IsPr
         RequestBufferSize               = sizeof(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE) + HideRequest.LengthOfProcessName;
     }
 
+    if (!CommandHideFillSystemCalls(&HideRequest.SystemCallNumbersInformation))
+    {
+        ShowMessages("warning, failed to resolve one or more syscall numbers for transparent-mode\n");
+        return FALSE;
+    }
+
     //
     // Allocate the requested buffer
     //
@@ -365,7 +371,7 @@ CommandHide(vector<CommandToken> CommandTokens, string Command)
     UINT32  TargetPid;
     BOOLEAN TrueIfProcessIdAndFalseIfProcessName;
 
-#if ActivateHyperEvadeProject == TRUE
+#if ActivateHyperEvadeProject != TRUE
 
     ShowMessages("warning, the !hide command (hyperevade project) is in the Beta phase and is not yet well-tested, "
                  "so it is disabled in this version. If you want to test, you can enable it "