How to create a virus signature from decompiled source

Question

I have a problem where I have to create a virus signature for the Stoned Virus (Although this could apply to any virus/file).

Let's assume I have a copy of the compiled and decompiled program. I then proceed to identify the most important parts of the virus, that will always be present, in the code. As I understand it I now have to find the corresponding bytes in the compiled virus in order to create a byte signature for that critical part of the virus.

How do I proceed to find the corresponding bytes in the compiled source from the code that I identified in the decompiled version?

Extra:

• The code is in assembly
• Simply using a hash signature for the entire file is not an option
• Currently I only have the assembly code, but I can always compile this
• I am aware that Stoned would usually be located in the boot sector and not in a file. This is only an academic exercise and would be relevant to any virus.

EDIT:

The purpose of this is to be able to create virus signatures that can be used to scan a file system to find infected files as well as possibly infected files and variations of the virus code. For this reason I cannot simply use a hash of the entire file and I need to use specific parts of the virus. I can identify those parts but I do not know how to find the matching bytes in the machine code for the viral parts I identified.

Answer 1

There are a number of ways to do this. Some people new to signature scanning use MD5 hashes of the entire file. This is VERY flawed, due to the switching of registers or even just the timestamp of the file would change the entire signature.

Another method often used is YARA ( http://plusvic.github.io/yara/ ). A good example from their webpage:

rule silent_banker : banker
{
    meta:
        description = "This is just an example"
        thread_level = 3
        in_the_wild = true

    strings:
        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}
        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}
        $c = "UVODFRYSIHLNWPEJXQZAKCBGMT"

    condition:
        $a or $b or $c
}

Here they say that one of the A, B or C bytes should be within the file.

Another method used (however this is more a Heuristic method) is to detect the ways it tries to hide. Eg obfuscation, encryption odd jumps (like pop, ret to jump to addresses).

Another method used often, (although this is less signature based) is IOC, for this see: http://www.openioc.org/

I think you are looking for YARA. Note for writing YARA signatures, good malware/exploits authors randomize everything they can. So try to find the parts that are 'unchangeable'.