Gargoyle is a way of hiding all the executable program code in non-executable memory. It is implemented only for 32-bit Windows (64-bit Windows on Windows, excellent). Performing live memory analysis can be a very expensive operation, if you use Defender Windows. Gargoyles shows that the method to reduce the computational load is a limit on the analysis of only the executable code pages, it is a risky the approach. Through the use of the Windows, asynchronous procedure calls, read / write memory can only be used as an executable memory to perform certain tasks.
In the post, Josh Lospinoso delves into all the rough details of how the method is implemented evasion memory scanning.
