Polymorphic code: Difference between revisions

Revision as of 15:59, 26 December 2006

Revision as of 14:16, 24 March 2007

Line 1:

In computer terminology, '''polymorphic code''' is code that mutates while keeping the original [[algorithm]] intact. This technique is sometimes used by [[computer virus]]es, [[shellcode]]s and [[computer worm]]s to hide their presence.

Most [[anti-virus software]] and [[intrusion detection system]]s attempt to locate malicious code by searching through computer files and data packets sent over a [[computer network]]. If the security software finds patterns that correspond to known computer viruses or worms, it takes appropriate steps to neutralize the threat. [[Polymorphic]] algorithms make it difficult for such software to locate the offending code as it constantly mutates.

[[Encryption]] is the most commonly used method of achieving polymorphism in code. However, not all of the code can be encrypted as it would be completely unusable. A small portion of it is left unencrypted and is used to jumpstart the encrypted software. Anti-virus software targets this small unencrypted portion of code.