4 ms·
>If you treat the software as a black box and only study run time behavior, you have no idea if you have tripped a countermeasure that silences the malicious be
by fnordfnordfnord 10y ago
>If you treat the software as a black box and only study run time behavior, you have no idea if you have tripped a countermeasure that silences the malicious behavior; if you study the control flow directly, you can look for such countermeasures.
It would be great to find such a countermeasure, and be able to trigger it reliably, or assert the behavior on a permanent basis. Considering that particular weakness of such countermeasures though, wouldn't the safest [for the attacker] default countermeasure likely be to simply crash the device?
- maxerickson 10y agoCould be. A user that knows about malicious code (which you would have to in order to trigger it to go silent) in a binary just shouldn't use the binary at all though. The broader point is more important: compiled software isn't a black box, treating it like a black box is not the only or best way to analyze it.