Content deleted Content added
m The original author used the word code in describing an analogy, however the analogy is more directly related to mathematics than programming. Replacing the clause paints a clearer picture regarding polymorphism. Removed bad comma. |
Removing link(s) to "Mark Washburn": removed links to deleted article article. (TW) |
||
Line 15:
Emulation may be used to defeat polymorphic obfuscation by letting the malware demangle itself in a virtual environment before utilising other methods, such as traditional signature scanning. Such a virtual environment is sometimes called a [[Sandbox (computer security)|sandbox]]. Polymorphism does not protect the virus against such emulation if the decrypted payload remains the same regardless of variation in the decryption algorithm. [[Metamorphic code]] techniques may be used to complicate detection further, as the virus may execute without ever having identifiable code blocks in memory that remain constant from infection to infection.
The first known polymorphic virus was written by
== Example ==
| |||