2

I recently started studying on bypassing AV by finding an AV signature on nc.exe (NetCat) and changing it to see how it works. I have already found the place of signature with splitting method. Then, I should open nc.exe with a hex editor and change the Sig.

But, here is what it look like:

enter image description here

And the file will get corrupted by editing it (adding or removing bytes).

My question is: What should I do for editing in this situations? What should I know for a successful binary editing?

If I get this whole wrong tell me what should I be looking for.


Note: the signature is in .bss and .text section of file

2
  • This would be more on topic at Software Recommendations SE.
    – xvk3
    Dec 11, 2017 at 19:21
  • @Will i think software doesn't matter here, just the concept and the way you do it
    – 0_o
    Dec 12, 2017 at 6:47

1 Answer 1

3

I'd recommend using something such as OllyDbg or IDA PRO rather than just plain HexEditor since just using HexEditor you've got no idea what section of the PE you are editing. For example, you could be editing the .text PE section and editing an essential part of the program rather than .idata or .data section which just store variable data.

So, few methods an AV could use for detection of malware are:

  1. Checksum of the whole file for an well-known piece of malware
  2. Checksum the .text (Can also be named .code) section of the PE as these pages are not flagged with WRITE permissions by default
  3. Checksum of the pattern that's malicious for example OpenProcess with WriteProcessMemory are often used for injecting DLLs or code into other processes. We could just create signature for that part of the code

Bypassing Method 1:

By randomly HexEditting you would manage to avoid AV detection method 1 (see above) but method 2 and 3 would detect the malware still. If you didn't overwrite anything essential for your program to execute.

Bypassing Method 2:

Rewrite a simple instruction or make a JMP to code-cave and put overwritten code there and JMP back to next instruction. So, you would be executing exact same code but different flow and .text section checksum would be different.

Bypassing Method 3:

To be able to bypass method 3 - You would need to add junk code between each call or add a JMP to a code cave and have the instruction set there. So, the code would still be the same but byte signature would be completely different.

Your best to learn about assembly language and learn how to use IDA PRO or OllyDbg and learn about patching programs before you move onto something more complex like bypassing AV.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.