Polymorphic code: Difference between revisions

Revision as of 02:51, 19 July 2006

Revision as of 23:24, 7 August 2006

Line 60:

The code inside "Encrypted" ("lots of encrypted code") could then search the code between Decryption_Code and CryptoKey and remove all the code that alters the variable C. Before the next time the encryption engine is used, it could input new unnecessary codes that alters C, or even exchange the code in the algorithm for new code that does the same thing. Usually the coder uses a zero key for the first generation of the virus, making it easier for him because with this key the code is not encrypted. He then implements an incremental key algorithm or a random one.

Other polymorphism technic is to autoinject nopNOP (0x90No Operation) or other opcodes that don't alter the algorithm.

== See also ==