Re: Comment on the MtE wars (PC)

Thread View: comp.virus

1 messages

[T] Back to Threads [V] Tree View [G] Group Articles

1 total messages Started by Kevin Marcus Mon, 09 Nov 1992 23:25

#3109

Author: Kevin Marcus
Date: Mon, 09 Nov 1992 23:25

14 lines
1069 bytes

Hmm.  MtE detection is difficult, but there are a few things that one
can look out for in order to help you get a staart if you are writing
an MtE detector, without having "big labs" and stuff.
 
One, as someone kindly pointed out at one time, I forgot where I saw
it, but the MtE can only generate certain code.  It can't generate a
variety of instructions, and any program which begins with these
instructions cannot possibly be infected.
 
Two, the MtE always has certain markers.  For example, the end of the
decrypting algorythm always ends with JNZ.
 
If you have a disasssembler, or even debug, you can spend a few hours
and figure out how to take care of a variety of infections.

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads