Polymorphic code: Difference between revisions

Revision as of 23:39, 18 July 2006

Revision as of 02:51, 19 July 2006

Line 11:

== Example ==

An algorithm that uses, for example, the variables A and B but not the variable C could stay intact even if you added lots of codescode that changed the contentcontents inof the variable C.

The original algorithm:

Line 33:

some_random_number

The same algorithm, but with lots of unnecessary C-altering codescode:

Start:

Line 58:

some_random_number

The code inside "Encrypted" ("lots of encrypted code") could then search the code between Decryption_Code and CryptoKey and remove all the code that alters the variable C. Before the next time the encryption engine is used, it could input new unnecessary codes that alters C, or even exchange the code in the algorithm intofor new code that does the same thing. Usually the coder useuses a zero key for the first generation of the virus, thismaking makeit esasiereasier tofor him because with this key the code is not crypted,encrypted. He then he implements aan incremental key algorithm or a random one.

Other polymorphism technic is to autoinject nop (0x90) or other opcodes that dontdon't alter the algorithm.

== See also ==