3 ms·

Opcode sequences. Regular expressions may be applied to any formal language, not just ones based on human-readable alphabets.

• eurasiantiger 5y ago
  That kinda makes sense, thanks. However, wouldn’t this kind of heuristic be extremely simple to counter by obfuscating the machine code, e.g. by inserting complex noops and using threaded subroutines which individually look innocuous? Or, are this kind of techniques looking at known syscall patterns or something like that, and ignoring the general program flow? To me, regex doesn’t seem applicable to static analysis of machine code, but what do I know :)
  • dannyw 5y ago
    antiviruses are composed of multiple systems and techniques. Regexp is just one.
    • eurasiantiger 5y ago
      That also makes sense. Got any further reading?