Kaspersky: Duqu Trojan uses 'unknown programming language'

Re:Kaspersky: Duqu Trojan uses 'unknown programming language' by viraptor on Thursday March 08, 2012 @07:45PM (#3682395)

Unless I'm mistaken it looks like a very dynamic language. The screenshot they're showing seems to point at initialisation of a new object, which actually copies function pointers for each of its methods. That's not needed for static languages which would just point to vtables. It looks like it doesn't use real GC though - object's destructor is called right away on a failed allocation. And the destructor is possible to change too...

So something like compiled javascript sans GC really. Or maybe like precompiled python.

Doesn't seem very obfuscated either imho - there's a bunch of static data copied in a series of moves. If someone really wanted to obfuscate those, this looks like a fairly low hanging fruit: grab a list of 5+ mov-s of constants and change them into xor+copy of a memory range to confuse pointer detection.

Can you see any more characteristics in that fragment?

[ Parent | on HN ]

Re:Kaspersky: Duqu Trojan uses 'unknown programming language' by shmageggy on Thursday March 08, 2012 @09:19PM (#3682624)

The characteristics listed in the actual article (posted by computerbob: http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duq...) also support this conclusion.

  -Everything is wrapped into objects
  -Function table is placed directly into the class instance and can be
   modified after construction
  -There is no distinction between utility classes (linked lists, hashes) and
   user-written code
  -Objects communicate using method calls, deferred execution queues and
   event-driven callbacks

[ Parent | on HN ]

Re:Kaspersky: Duqu Trojan uses 'unknown programming language' by LeafStorm on Thursday March 08, 2012 @11:18PM (#3682891)

Reminds me of Smalltalk.

[ Parent | on HN ]

Re:Kaspersky: Duqu Trojan uses 'unknown programming language' by schwa571 on Saturday March 10, 2012 @03:14PM (#3688599)

Smalltalk objects typically don't have a per-object table of function pointers (some dialects do, such as Self).

[ Parent | on HN ]

Re:Kaspersky: Duqu Trojan uses 'unknown programming language' by gphil on Friday March 09, 2012 @01:04PM (#3685188)

And by extension, of Ruby.

[ Parent | on HN ]

Re:Kaspersky: Duqu Trojan uses 'unknown programming language' by buff-a on Friday March 09, 2012 @01:24PM (#3685289)

Sounds like someone said, "Make me a language that is hard to reverse engineer using IDA Pro".

[ Parent | on HN ]