Writing a Mutation Engine and Breaking Aimware

Re:Writing a Mutation Engine and Breaking Aimware by stevekemp on Friday April 15, 2022 @07:31AM (#31038976)

That's a really fascinating bit of writing. I remember writing "mutation engines" back in the day for x86 virus coding.

In 1993 the virus group Phalcon/Skism from Canada published a polymorphic engine called Dark Angel's Multiple Encryptor or DAME, the writeup of that is still available:

https://ivanlef0u.fr/repo/madchat/vxdevl/vdat/tuda0011.htm

That inspired me to do similar things, playing around with replacing bits of assembly with functionally equivalent alternatives, and using differing encoding of common instructions.

Of course all of this is very obsolete knowledge these days, which is a shame in some ways.

[ Parent | on HN ]

Re:Writing a Mutation Engine and Breaking Aimware by lifefeed on Friday April 15, 2022 @10:45AM (#31040832)

I read "The Little Black Book of Computer Viruses" back in the 90s and it was an education in assembler. I wrote a little mutation engine too, it did not perform well!

[ Parent | on HN ]

Re:Writing a Mutation Engine and Breaking Aimware by stevekemp on Friday April 15, 2022 @11:24AM (#31041241)

A lot of times things didn't need to perform terribly well, but at the same time I was reminded recently of some of the tricks - removing "ld de, 0" in favour of "xor de,de", etc, which came up in this past post:

https://news.ycombinator.com/item?id=30941097

So maybe I was wrong, this kind of experimentation and knowledge is still useful.

[ Parent | on HN ]