🚀 go-pugleaf

Doren Rosenthal
3737 Sequoia
San Luis Obispo, CA USA 93401
 
To: Vesselin Vladimirov Bontchev, Virus Test Center, University of Hamburg
 
In response to your questions posted on this forum about my Virus 
Simulator MtE Supplement.
 
     > 1) Does is simulate perfectly the behavior of the MtE?
 
YES.  Although  safe  and controlled, these dummy  sample  programs  behave 
identically to those produced MtE mutation engine viruses.
 
     >I.e.,   are  the  dummy  files  generated  by  it  the  same  as   if
     >generated  by  the MtE? If not, then it is not good as  a  simulator,  
     >because the simulation is not
     >perfect enough.
 
YES. The dummy simulations are the same as those encrypted by the 
MtE mutation engine.
 
     >2) If the answer of the above question is "yes", then it means that it
     >uses the MtE itself to encrypt the dummy files - because using
     >anything else would mean imperfect simulation. If it uses the MtE, do
     >you include the MtE itself in the generated dummies?
 
YES.  At  the hart of the simulations is an actual  MtE  mutation 
engine.
 
     >3) If the answer of the above question is "no", then the simulation is
     >again not good enough, since the only way a scanner could detect the
     >unencrypted replicants of an MtE-based virus is to scan for a scan
     >signature of the unencrypted body of MtE. If the answer of the above
     >question is "yes", then it is pretty easy to extract the MtE from the
     >unencrypted dummies... Therefore, you are distributing malicious
     >software...
 
I  disagree. Although these are real MtE viruses, steps have been taken  to 
insure  they  will  only  infect  the  dummy  test  programs  provided  and 
modifications or reverse engineering has been discouraged.
 
     >Conclusion: regardless how you answer to the above questions, either
     >the simulator is useless, or you are distributing malicious
     >software... Hmm, I was able to draw this conclusion even without
     >having to look at the simulator... Pretty good, isn't it?... :-)
 
I'm  disappointed  that  you would pass yourself off as  a  fair  and  open 
scientist  and researcher open to new ideas. Then ask what would appear  to 
be  legitimate questions and without giving my response a fair  hearing  or 
even  examining  the  Virus  Simulator  MtE  Supplement  yourself,  draw  a 
conclusion and announce your findings in a public forum. 
 
I also do not appreciate being accused of distributing malicious  software. 
If you have evidence of this you should present it before posting  anything 
else on this forum or use the forum for a public apology.
 
     >Leaving the ethical problems aside, do you try all kinds of flags
     >(i.e., the contents of the AX register before calling the MtE)?
     >Because, if you don't, you'll be able to generate only a small subset
     >of the code that can be generated with the MtE...
 
The  Virus Simulator MtE Supplement exercises as may flags and  options  as 
possible.
 
Doren Rosenthal