🚀 go-pugleaf

as194@cleveland.Freenet.Edu (Doren Rosenthal) writes:

>               Virus Simulator MtE Supplement Available

[stuff deleted]

>      Virus  Simulator  (introduced earlier) and this  new  Virus 
>      Simulator  MtE Supplement are not intended to  replace  the 
>      comprehensive   collection   of  real  virus   samples   as 
>      maintained  by Rosenthal Engineering and  other  anti-virus 
>      product   developers  for  testing.  Virus  Simulator   MtE 
>      Supplement  produces safe and controlled dummy  test  files 
>      that  enable users to verify that they have  installed  and 
>      are  using  their MtE virus detecting  programs  correctly, 
>      additionally  affording  an  opportunity  for  a   practice 
>      training drill under safe and controlled conditions. 

I've had some very strong objections against your virus simulator in
the past. I have not seen yet your MtE simulator, but I have the
following questions about it:

1) Does is simulate perfectly the behavior of the MtE? I.e., are the
dummy files generated by it the same as if generated by the MtE? If
not, then it is not good as a simulator, because the simulation is not
perfect enough.

2) If the answer of the above question is "yes", then it means that it
uses the MtE itself to encrypt the dummy files - because using
anything else would mean imperfect simulation. If it uses the MtE, do
you include the MtE itself in the generated dummies?

3) If the answer of the above question is "no", then the simulation is
again not good enough, since the only way a scanner could detect the
unencrypted replicants of an MtE-based virus is to scan for a scan
signature of the unencrypted body of MtE. If the answer of the above
question is "yes", then it is pretty easy to extract the MtE from the
unencrypted dummies... Therefore, you are distributing malicious
software...

Conclusion: regardless how you answer to the above questions, either
the simulator is useless, or you are distributing malicious
software... Hmm, I was able to draw this conclusion even without
having to look at the simulator... Pretty good, isn't it?... :-)

Leaving the ethical problems aside, do you try all kinds of flags
(i.e., the contents of the AX register before calling the MtE)?
Because, if you don't, you'll be able to generate only a small subset
of the code that can be generated with the MtE...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany