Hi Alice🎀
Do you want to look inside of the mirror (or at least monitor) and get into the looking glass?

In this post I want to give you some information about "what's inside your pc", assembler. Not just assembler, but to reverse viruses and tell you what's assembler for in viruses 🦠

The practical article with an analysis will be ready later, because the administrator is really busy right now.

Why do we need assembler when writing viruses?

Antiviruses can detect a virus if it's encrypted by normal shellcodes, or dll queries and so on. 

For this reason for good virus crypting often in the code itself .

For this, assembler is a must, because it is very difficult to make a good polymorphic/metomorphic virus with high-level tools. 

Attackers can use polymorphic engines like this one link or libraries like this one for C++ link , though.
It is more profitable for attackers to write their own, because antivirus systems can detect polymorphic engines or libraries.

Generally, analysis methods often rely on a combination of signatures and heuristic rules. 

In case you didn't know, a signature is a pattern or hash that can uniquely identify a file by machine code, strings or sensitive instructions
A large database stores existing signature patterns and compares them with the signature obtained by the virus file and thus calculates our malware.
But for this reason it is difficult to recognize a brand new malicious code because its signature is not yet generated.💊
Heuristic rules are determined by virus experts after analyzing the molvaria. In general, they first need to study the code instructions, check the data changes in memory and record the system events to understand each pattern. This makes it more difficult to work with completely new code.

You also sometimes use assembler to infect systems, for example linux systems where the infection is a bit harder than in window🧪.

For this I know an interesting project you can see: article link, repository link .
It targets ELF files in the current directory . It uses a Reverse Text Segment (Infection technique) .

Its idea is that the virus can make room for its code by expanding the text segment in reverse order. 

Many people don't know "where to get viruses for their research".
Here is a thread on github where there are 31 viruses written in assembler or using asm link
Another interesting thing about viruses is working with crypto-cryptors. Here's a good example of Python encryption and decryption link , also a good tool to decrypt ransomware in C++ link

Now about the reverse itself.

I won't go too deep into that in other posts. Here I'll just give you some material for learning 

When we do a static reverse analysis we try to extract the code concepts and the algorithms of a virus from asm. You can use tools like IDA Pro , SoftIce , Ollydbg , Ghidra etc.
There is also a thread on github with good tools for this written in assembler link and in C link
Here's some good assembly language material and a reverse repository.

I'll attach the repository below✨

For example: assembler reverse with parsing code, training and using neurons for detecting viruses and so on, I suggest you take a look at the

❣️

Just a reminder, I am doing research with virus analysis, but I have a lot of other things to do, as well as a post about torus will be published later 🫥

Thank you for reading ❤️

And remember, if the Dodo bird offers you a thimble, you do not want to offend her🐧✨
#virus #revers #ransomware #malware #polymorphic #anitivirus #linux