I have a problem where I have to create a virus signature for the Stoned Virus (Although this could apply to any virus/file).
Let's assume I have a copy of the compiled and decompiled program. I then proceed to identify the most important parts of the virus, that will always be present, in the code. As I understand it I now have to find the corresponding bytes in the compiled virus in order to create a byte signature for that critical part of the virus.
How do I proceed to find the corresponding bytes in the compiled source from the code that I identified in the decompiled version?
- The code is in assembly
- Simply using a hash signature for the entire file is not an option
- Currently I only have the assembly code, but I can always compile this
- I am aware that Stoned would usually be located in the boot sector and not in a file. This is only an academic exercise and would be relevant to any virus.
The purpose of this is to be able to create virus signatures that can be used to scan a file system to find infected files as well as possibly infected files and variations of the virus code. For this reason I cannot simply use a hash of the entire file and I need to use specific parts of the virus. I can identify those parts but I do not know how to find the matching bytes in the machine code for the viral parts I identified.