🚀 go-pugleaf

tck@fold.ucsd.edu (Kevin Marcus) writes:

> One, as someone kindly pointed out at one time, I forgot where I saw
> it, but the MtE can only generate certain code.  It can't generate a
> variety of instructions, and any program which begins with these
> instructions cannot possibly be infected.

This is essentially what Frans Veldman says in the documentation of
TbScan, but it has to be understood correctly; not followed blindly.
First of all the problem for detecting reliably all MtE-based viruses
(or at least all replicants of the known MtE-based viruses) consists
of two separate and equally difficult problems:

1) Detect all files that contain the MtE-based virus as infected.

2) Do NOT detect any file that DOESN'T contain any MtE-based virus as
infected. In other words - avoid the false positives.

It is possible to do some statistical analysis to see what
instructions are usually present in the MtE-generated decryptor, but
you are running the risk to miss some infected samples. It is also
possible to raise an alert any time you see one of the possible
instructions in the decryptor that actually to the encryption - they
are not that many and the variety of addressing modes uses is also not
that great. But then, you are running the risk to cause a lot of false
positives... The really smart trick is to combine both ideas in a
sensible way and to detect all viruses without any false positives.
Currently very few scanners have achieved this.

> Two, the MtE always has certain markers.  For example, the end of the
> decrypting algorythm always ends with JNZ.

Yes, and it seems that all MtE detecting programs are using this. But
it is pretty slim as a clue; you need much more to achieve reliably
MtE detection...

> If you have a disasssembler, or even debug, you can spend a few hours
> and figure out how to take care of a variety of infections.

And you'll end up with yet another unreliable MtE detector... :-)

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany