5 ms·
> There's fully metamorphic viruses where even the code mutating part is changed. Algorithmically it's equivalent but there's no "static" portion of the virus.
by lawl 6y ago
> There's fully metamorphic viruses where even the code mutating part is changed. Algorithmically it's equivalent but there's no "static" portion of the virus.
Never seen it play out that way. There's always something in practice. See you just talked about randomizing the code. But a windows PE isn't just code. It also has an icon. And yes i've seen AVs detect specific icons.
In theory it's easy to not have anything static, in practice, that's the cat and mouse game you're playing.
- MertsA 6y agoLook into Mistfall. It would infect other executables by splitting them into basic blocks that end with some branching instruction and inserting metamorphic portions of itself in between blocks and fixing up all of the modified addresses. There literally isn't any "static" portion. Here's a mirror of the author's site, he is Russian but there's a ton of English translations and articles that are a great read. http://z0mbie.daemonlab.org/ http://z0mbie.daemonlab.org/
- account42 6y ago> But a windows PE isn't just code. It also has an icon. And yes i've seen AVs detect specific icons. And that's how you get overzealous AVs marking executables because they happen to have PE headers...