3 ms·
Mostly-off-topic: The `bisect-binary` project listed in the introduction is almost the _exact_ program I made while I was a devious high school student trying
by namuol 9y ago
Mostly-off-topic:
The `bisect-binary` project listed in the introduction is almost the _exact_ program I made while I was a devious high school student trying to circumvent weak (i.e. most widely-used-) antivirus software by locating a few "key" bytes in the binary that the AV used to fingerprint a virus.
I would zero out half the file, scan the file with AV, then recursively repeat the same for any zero'd regions of files that AV didn't consider a virus. Essentially a search of the file for the smallest set of bytes that needed to be changed for AV to fail detection.
Usually this would result in only a small number of bytes that needed to be slightly tweaked.
Pretty unproductive "hobby", but I must admit it was really fun. :)
- maweki 9y agoThis sounds fun. How did you handle the case where on a bisect both halves didn't trigger the AV on their own?
- namuol 9y agoThis was pretty rare for the most popular AVs, but if it didn't work I would try manually zeroing different sections until I found something. I was surprised how easy it was to make a virus undetected, and that they didn't routinely change their fingerprint algorithm as a defense against this attack.