Polymorphic code: Difference between revisions

Revision as of 16:48, 10 May 2006

Revision as of 07:31, 15 July 2006

Line 58:

some_random_number

The code inside "Encrypted" ("lots of encrypted code") could then search the code between Decryption_Code and CryptoKey and remove all the code that alters the variable C. Before the next time the encryption engine is used, it could input new unnecessary codes that alters C, or even exchange the code in the algorithm into new code that does the same thing. Usually the coder use a zero key for the first generation of the virus, this make esasier to him becouse with this key the code is not crypted, then he implements a incremental key algorithm or a random one.

Other polymorphism technic is to autoinject nop (0x90) or other opcodes that dont alter the algorithm.

== See also ==