4 ms·
Shouldn’t malware be detectable even if the binary is entirely a black box? In other words, I would expect certain patterns of system calls to be flagged as mal
by hamandcheese 6y ago
Shouldn’t malware be detectable even if the binary is entirely a black box? In other words, I would expect certain patterns of system calls to be flagged as malware, regardless of the program.
I’m curious what additional information is derived from static analysis of a program that helps identify it as malware.
- nameless912 6y agoI'd guess that the applescript isn't calling syscalls directly, there's probably a translation layer in the middle that is also compiled and the "linkage" is only clear if you understand the bytecode format/runtime.