From a949bf66cde146e9451f9e2e4503e7d86570f62a Mon Sep 17 00:00:00 2001
From: sina <sina@hyperdbg.org>
Date: Mon, 18 Aug 2025 00:30:13 +0200
Subject: [PATCH] temporarily hyperevade project

---
 hyperdbg/hyperevade/code/SyscallFootprints.c  | 23 +++++++++++++++++++
 hyperdbg/hyperevade/code/Transparency.c       |  3 ++-
 .../hyperevade/header/SyscallFootprints.h     |  4 ++++
 hyperdbg/hyperevade/header/pch.h              |  7 ++++++
 4 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/hyperdbg/hyperevade/code/SyscallFootprints.c b/hyperdbg/hyperevade/code/SyscallFootprints.c
index e018d82e..3b9bc966 100644
--- a/hyperdbg/hyperevade/code/SyscallFootprints.c
+++ b/hyperdbg/hyperevade/code/SyscallFootprints.c
@@ -11,6 +11,28 @@
  */
 #include "pch.h"
 
+VOID
+TransparentHandleSystemCallHook(GUEST_REGS * Regs)
+{
+    UNREFERENCED_PARAMETER(Regs);
+}
+
+VOID
+TransparentCallbackHandleAfterSyscall(GUEST_REGS *                      Regs,
+                                      UINT32                            ProcessId,
+                                      UINT32                            ThreadId,
+                                      UINT64                            Context,
+                                      SYSCALL_CALLBACK_CONTEXT_PARAMS * Params)
+{
+    UNREFERENCED_PARAMETER(Regs);
+    UNREFERENCED_PARAMETER(ProcessId);
+    UNREFERENCED_PARAMETER(ThreadId);
+    UNREFERENCED_PARAMETER(Context);
+    UNREFERENCED_PARAMETER(Params);
+}
+
+#if DISABLE_HYPERDBG_HYPEREVADE == FALSE
+
 /**
  * @brief Handle The triggered hook on KiSystemCall64 system call handler
  * when the Transparency mode is enabled
@@ -1927,3 +1949,4 @@ TransparentCallbackHandleAfterSyscall(GUEST_REGS *                      Regs,
                 Params->OptionalParam4);
     }
 }
+#endif
diff --git a/hyperdbg/hyperevade/code/Transparency.c b/hyperdbg/hyperevade/code/Transparency.c
index 1ab77304..22cfb044 100644
--- a/hyperdbg/hyperevade/code/Transparency.c
+++ b/hyperdbg/hyperevade/code/Transparency.c
@@ -54,12 +54,13 @@ TransparentHideDebugger(HYPEREVADE_CALLBACKS *                        Hyperevade
         RtlCopyBytes(&g_SystemCallNumbersInformation,
                      &TransparentModeRequest->SystemCallNumbersInformation,
                      sizeof(SYSTEM_CALL_NUMBERS_INFORMATION));
-
+#if DISABLE_HYPERDBG_HYPEREVADE == FALSE
         //
         // Choose a random genuine vendor string to replace hypervisor vendor data
         //
         TRANSPARENT_GENUINE_VENDOR_STRING_INDEX = TransparentGetRand() %
                                                   (sizeof(TRANSPARENT_LEGIT_VENDOR_STRINGS_WCHAR) / sizeof(TRANSPARENT_LEGIT_VENDOR_STRINGS_WCHAR[0]));
+#endif
 
         //
         // Enable the transparent mode
diff --git a/hyperdbg/hyperevade/header/SyscallFootprints.h b/hyperdbg/hyperevade/header/SyscallFootprints.h
index 976001fd..86a25ffc 100644
--- a/hyperdbg/hyperevade/header/SyscallFootprints.h
+++ b/hyperdbg/hyperevade/header/SyscallFootprints.h
@@ -161,6 +161,8 @@ SYSTEM_CALL_NUMBERS_INFORMATION g_SystemCallNumbersInformation;
 //				   Constants        			//
 //////////////////////////////////////////////////
 
+#if DISABLE_HYPERDBG_HYPEREVADE == FALSE
+
 /**
  * @brief A list of windows processes, for which to ignore systemcall requests
  * when the transparency mode is enabled
@@ -609,6 +611,8 @@ static const PCHAR HV_FIRM_NAMES[] = {
 
 };
 
+#endif
+
 //////////////////////////////////////////////////
 //				   Functions					//
 //////////////////////////////////////////////////
diff --git a/hyperdbg/hyperevade/header/pch.h b/hyperdbg/hyperevade/header/pch.h
index 6684367a..d52101a9 100644
--- a/hyperdbg/hyperevade/header/pch.h
+++ b/hyperdbg/hyperevade/header/pch.h
@@ -23,6 +23,13 @@
 
 #ifdef ENV_WINDOWS
 
+//
+// The DLL is flagged by antivirus software, since it contains anti-debugging and anti-hypervisor methods
+// as well as different anti-debugging strings
+// For now, we disable the HyperDbg Hyperevade module
+//
+#    define DISABLE_HYPERDBG_HYPEREVADE TRUE
+
 //
 // Windows defined functions
 //