4 ms·
So after the program is actually compiled into binary code do the resulting instructions become so simple (and so fundamental to the operation of programs) that
by Uptrenda 11y ago
So after the program is actually compiled into binary code do the resulting instructions become so simple (and so fundamental to the operation of programs) that any attempt to write a heuristics rule to stop this technique would break thousands of programs or are heuristics just so inherently shitty that this technique works? Because I would still think that this line here:
void *exec = VirtualAlloc(0, sizeof c, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
Would be a red flag. I don't know how many programs use that on the Windows side of things but I have almost never seen programs call this function that weren't "crypters."
I am honestly impressed how simple this program is (it's the most elegant crypter I've probably ever seen) but I am still wondering whether heuristics could be made to detect this (without also falsely detecting thousands of other programs?) What do you think OP? Not really my field but curious all the same.
- vortico 11y agoI believe this is how JIT compilation works. So this would trigger a false positive on the Java VM, Javascript V8 interpreter, Spidermonkey, and C# runtime.
- yoklov 11y agoAlso, most emulators of reasonably modern systems. Although JITs in VMs are a few orders of magnitude more common.
- simoncion 11y agoWhy would that be a red flag? From what I can glean from the documentation, both MEM_COMMIT and PAGE_EXECUTE_READWRITE are perfectly reasonable flags to pass to VirtualAlloc, and -again, according to the documentation- VirtualAlloc appears to be a way to (de|re)allocate memory within the region allocated to your process. What's more, every program that uses Boost on Windows calls VirtualAlloc, in several places.
- tbirdz 11y agoVirtualAlloc is roughly equivalent in intent to POSIX's mmap. So anywhere that you'd use mmap in a Linux program, you'd probably use VirtualAlloc in Windows.