4 ms·
It's a custom bytecode, so it's definitely harder than just throwing it into a disassembler - you have to understand the VM it runs in, and depending on how it'
by meibo 6y ago
It's a custom bytecode, so it's definitely harder than just throwing it into a disassembler - you have to understand the VM it runs in, and depending on how it's implemented, that can be a whole other skill set - especially since AppleScript bytecode seems to be mostly undocumented.
If you're an experienced security researcher, you'll get there of course, but definitely not a thing you press F5 at in IDA and go "ah yes, that's how it works".
- hamandcheese 6y agoShouldn’t malware be detectable even if the binary is entirely a black box? In other words, I would expect certain patterns of system calls to be flagged as malware, regardless of the program. I’m curious what additional information is derived from static analysis of a program that helps identify it as malware.
- nameless912 6y agoI'd guess that the applescript isn't calling syscalls directly, there's probably a translation layer in the middle that is also compiled and the "linkage" is only clear if you understand the bytecode format/runtime.