A conference talk exploring how modern C++ features (C++17/20/23) are used by malware developers to evade antivirus and EDR detection. Topics covered include compile-time string encryption using constexpr, polymorphic code generation via templates and macros to produce unique binary hashes, dynamic API resolution at runtime, hiding execution flow using virtual tables and std::any, RAII/smart pointer abuse for obfuscated shellcode execution, and fetching encrypted shellcode from external files. Live demos show bypassing Microsoft Defender using these techniques with Metasploit-generated payloads. The talk also briefly covers blue team countermeasures such as kernel callbacks, memory scanning, and behavior analysis.
•54m watch time