Bugtraqmailing list archives
Re: [Full-disclosure] (TOOL) TAPiON (Polymorphic Decryptor Generator) Engine
From: Piotr Bania <bania.piotr () gmail com>
Date: Fri, 09 Sep 2005 22:19:25 +0200
Re,>...>If you want some indepth on polymorphis I recomend you the 29a papers:>http://vx.netlux.org/29a/I'm not a master in this branch however let me citate one of thearitcles found on the server you sent me (i also recomend you to read it):
----- CUT --------------------------------------------------------------" There exists a system of division of polymorphic viruses into levelsaccording to complexity of code in decryptors of those viruses. Such asystem was introduced by Dr. Alan Solomon and then enhanced by VesselinBontchev. Level 1: Viruses having a set of decryptors with constant code,choosing one while infecting. Such viruses are called "semi-polymorphic"or "oligomor phic".
Examples: "Cheeba", "Slovakia", "Whale".Level 2: Virus decryptor contains one or several constantinstructions, the rest of it is changeable. Level 3: decryptor contains unused functions - "junk" like NOP,CLI, STI,etc Level 4: decryptor uses interchangeable instructions and changestheir order (instructions mixing). Decryption algorithm remains unchanged. Level 5: all the above mentioned techniques are used, decryptionalgorithm is changeable, repeated encryption of virus code and evenpartial encryption of the decryptor code is possible. "
----- CUT --------------------------------------------------------------So appending to this source i got a level 3 or level 4, unless you fullyunderstand the source. I'm not saying it is perfect, is was written in 5days.
Hope this helps you.best regards,Piotr Bania----------------------------------------------------------------------Piotr Bania - <bania.piotr () gmail com> - 0xCD, 0x19Fingerprint: 413E 51C7 912E 3D4E A62A BFA4 1FF6 689F BE43 AC33http://pb.specialised.info - Key ID: 0xBE43AC33-------------------------------------------------------------------- " Dinanzi a me non fuor cose create se non etterne, e io etterno duro. Lasciate ogne speranza, voi ch'intrate " - Dante, Inferno Canto III
Current thread:
- Re: [Full-disclosure] (TOOL) TAPiON (Polymorphic Decryptor Generator) EnginePiotr Bania (Sep 12)
- Re[2]: [Full-disclosure] (TOOL) TAPiON (Polymorphic Decryptor Generator) EngineAlejandro Barrera (Sep 12)