Statistics

Members: 1925
News: 293
Web Links: 1
Visitors: 3825251

Who's Online

We have 1 guest online
Damn Vulnerable LinuxDamn Vulnerable Linux (DVL) is a Linux-based (modified Damn Small Linux) tool for IT-Security & IT-Anti- Security and Attack & Defense. [CLICK HERE FOR MORE INFOS! ]

Featured Conference Video

T16-Recon2006-Joe_Stewart-OllyBonE.gif OllyBone - Semi-Automatic Unpacking on IA-32. View the conference video here!
Home arrow Articles - Black Hat Methods arrow Virus Analysis arrow Introductory Primer To Polymorphism
Introductory Primer To Polymorphism
User Rating: / 0
PoorBest 
Written by Opic   
Side Story
VX Reversing II, Sasser.B

The well known worm Sasser has been one of the viruses which has received more attention in the press in the latest months. It’s author, an 18 years old student from Germany, after causing lots of troubles to many home users and small enterprises faces up to several years of prison. Sasser is not a well programmed virus, it’s success is entirely due to the exploit it implements, which was announced by Microsoft in one of their security bulletins. In this paper, we will reverse Sasser.B - the second of its variants - showing how it works and also how to clean your computer after infection. Warning: disconnect your computer from the network while working with Sasser, you are left as the only responsible of your mistakes.

Read More >>



Much of the problem the new programmer has in learning polymorphism is the jargon associated with it, and so I have done my best in this article to define all the jargon I am using. Please understand that this is NOT a complete guide to polymorphism but is simply meant to be a primer to initiate new coders ideas on how to write self-modifying/replicating code. As the title suggests this tutorial should be approached as a introduction to the ideas, concepts and techniques involved in the writing of a polymorphic virus. If you have a great deal of experience in writing polymorphic viruses/engines then you may not learn much from article. It is, rather, geared towards newer virus writers who have not yet implemented polymorphism into their viruses yet, but wish to. That being said lets first define what polymorphism is. Polymorphism: ”‘having many or various forms, stages”’ (VDAT 1.5) By this definition polymorphic viruses are viruses that change forms. But there is a problem with this definition as it implies (even though it is ”‘technically”’ true) that a virus which only partially changes form would be polymorphic; for example viruses the use XOR encryption with a randomly generated key (a long time ”‘de facto”’ for virus writers) would be considered a polymorphic virus. And it is, in a sense, as a virus of this sort encrypts itself differently in each infection. The problem with this type of polymorphism is that it is utterly ineffective. But perhaps we should back peddle a bit and exonerate what we hope to gain from polymorphism, why it is effective and why ”‘minimal polymorphism”’ such as the above example is ineffective.
Download: pdf Introductory Primer To Polymorphism