@Kas Ob. Great news!!!
I try all your suggestions, either alone and combine in the 32 bit release only. Here are the results.
1) Including DEP directive. ( Did NOT trigger Windows defender )
I included {$DYNAMICBASE ON} in my DPR as follows:
{$R *.res}
{$R 'D:\Projetos2k10\Projects V\DHS\SQL explorer II\src\resource\cKwel_versioninfo.RES'}
{$DYNAMICBASE ON} // Enable DEP, works also when using {$SetPEOptFlags $40}
begin
// try
{$IFDEF DEBUG}ReportMemoryLeaksOnShutdown:= true;{$ENDIF}
Application.Initialize;
Application.MainFormOnTaskbar := True;
Application.Title := 'cKwel - Query Tool';
Application.CreateForm(TdmSkinController, dmSkinController);
Application.CreateForm(TdmImages, dmImages);
Application.CreateForm(TdmLookAndFeel, dmLookAndFeel);
Application.CreateForm(TdmEditRepository, dmEditRepository);
Application.CreateForm(TfrmMain, frmMain);
Application.Run;
// except
// end;
end.
2) Changing /modifying icon TRIGGERS Windows defender
3) Encapsulate all the content of the main in dpr with try..except did NOT trigger Windows defender:
{$R *.res}
{$R 'D:\Projetos2k10\Projects V\DHS\SQL explorer II\src\resource\cKwel_versioninfo.RES'}
{.DYNAMICBASE ON}
begin
// Enable SEH by setting all code between try..except.
try
{$IFDEF DEBUG}ReportMemoryLeaksOnShutdown:= true;{$ENDIF}
Application.Initialize;
Application.MainFormOnTaskbar := True;
Application.Title := 'cKwel - Query Tool';
Application.CreateForm(TdmSkinController, dmSkinController);
Application.CreateForm(TdmImages, dmImages);
Application.CreateForm(TdmLookAndFeel, dmLookAndFeel);
Application.CreateForm(TdmEditRepository, dmEditRepository);
Application.CreateForm(TfrmMain, frmMain);
Application.Run;
except
// No code is required here
end;
end.
4) Fill the EXE description, version name copyright TRIGGERS windows defender.
I don't know if the combination should produce some valid results, but any combination that includes 1 or 3 works. For example 2 and 4 will TRIGGER windows defender while 1, 2 and 4 WON'T trigger it.
Cool!
Hope this thread will help others!
This link is also usefull:
https://security.stackexchange.com/questions/18556/how-do-aslr-and-dep-work
It might be a good idea to set DEP and ASLR by default.