3 ms·

One of the more interesting use cases I have seen for niche compiled languages is malware development. When the binary is a sort of martian to the AV scanning e

One of the more interesting use cases I have seen for niche compiled languages is malware development. When the binary is a sort of martian to the AV scanning engines, it flies under those radars. There's even old languages dug up for this purpose. Most pascal I have seen lately is malware samples.

Matthias247 5y ago
Given the languages all produce native instructions which then do the same job, is there really a huge difference for malware scanners? They for sure wouldn't look at debug symbols, and hope malware authors were kind enough to include them.
- woodruffw 4y ago
  Weird ABIs can certainly screw up automated malware analysis, but (AFAICT) Hare doesn't have a particularly weird ABI (I believe they're aiming for low-overhead interoperability with C, which precludes completely alien ABIs like Go's). That being said: automated malware analysis is of dubious efficacy and flexibility to begin with, so who knows.
iforgotpassword 4y ago
Oh the woes with that. Try maintaining a legacy VB6 app. The cobol of the 90s. If you never worked in this field, you won't believe how many VB6 apps are still out in the wild, sometimes the glue keeping everything together for a multi million dollar company. Write any trivial program in vb6 and upload it to virus total. Red alert left and right. Even Windows Defender of all things goes off for anything a little more involved. Sometimes only a couple of days after you did the initial scan. Signing the binary helps, but is no silver bullet, and sometimes companies still can't be arsed. There's an endless thread in the last remaining forum about vb6 where people try to figure out what increases chances of detection, and it mostly reads like cargo culting.
- jamal-kumar 4y ago
  Given how much malware was written targeting the fact that you could embed it in something like a spreadsheet with full access to windows API stuff it was doomed to suffer eventually like that. The entire security model was non-existent and it just opened up such a can of worms. The funny thing is how unlikely it is someone will get hit with working malware written in vb6 today because of AV engines and how easy it is to slip under the radar just doing it in go or whatever

Matthias247 5y ago

Given the languages all produce native instructions which then do the same job, is there really a huge difference for malware scanners? They for sure wouldn't look at debug symbols, and hope malware authors were kind enough to include them.

woodruffw 4y ago
Weird ABIs can certainly screw up automated malware analysis, but (AFAICT) Hare doesn't have a particularly weird ABI (I believe they're aiming for low-overhead interoperability with C, which precludes completely alien ABIs like Go's). That being said: automated malware analysis is of dubious efficacy and flexibility to begin with, so who knows.

iforgotpassword 4y ago

Oh the woes with that. Try maintaining a legacy VB6 app. The cobol of the 90s. If you never worked in this field, you won't believe how many VB6 apps are still out in the wild, sometimes the glue keeping everything together for a multi million dollar company. Write any trivial program in vb6 and upload it to virus total. Red alert left and right. Even Windows Defender of all things goes off for anything a little more involved. Sometimes only a couple of days after you did the initial scan. Signing the binary helps, but is no silver bullet, and sometimes companies still can't be arsed. There's an endless thread in the last remaining forum about vb6 where people try to figure out what increases chances of detection, and it mostly reads like cargo culting.

jamal-kumar 4y ago
Given how much malware was written targeting the fact that you could embed it in something like a spreadsheet with full access to windows API stuff it was doomed to suffer eventually like that. The entire security model was non-existent and it just opened up such a can of worms. The funny thing is how unlikely it is someone will get hit with working malware written in vb6 today because of AV engines and how easy it is to slip under the radar just doing it in go or whatever