3 ms·
If the decompressor is included in the compressed file and it's malicious, the file can hardly be called known good.
by yorwba 1y ago
If the decompressor is included in the compressed file and it's malicious, the file can hardly be called known good.
- tecleandor 1y agoBut also I guess the logic of the decompressor could output different files in different occasions, for example, if it detects a victim, making it difficult to verify.
- viraptor 1y agoIf it can "detect a victim", then the sandbox is faulty. The decompressor shouldn't see any system details. Only the input and output streams.