5

I have a problem where I have to create a virus signature for the Stoned Virus (Although this could apply to any virus/file).

Let's assume I have a copy of the compiled and decompiled program. I then proceed to identify the most important parts of the virus, that will always be present, in the code. As I understand it I now have to find the corresponding bytes in the compiled virus in order to create a byte signature for that critical part of the virus.

How do I proceed to find the corresponding bytes in the compiled source from the code that I identified in the decompiled version?

Extra:

  • The code is in assembly
  • Simply using a hash signature for the entire file is not an option
  • Currently I only have the assembly code, but I can always compile this
  • I am aware that Stoned would usually be located in the boot sector and not in a file. This is only an academic exercise and would be relevant to any virus.

EDIT:

The purpose of this is to be able to create virus signatures that can be used to scan a file system to find infected files as well as possibly infected files and variations of the virus code. For this reason I cannot simply use a hash of the entire file and I need to use specific parts of the virus. I can identify those parts but I do not know how to find the matching bytes in the machine code for the viral parts I identified.

2
  • Which disassembler are you using? I have not seen a single one that does not have an option to output the original opcodes together with the disassembly. May 22, 2014 at 2:42
  • @VitalyOsipov At least NDISASM outputs the original binary code (including the opcode) of each instruction, together with the disassembly.
    – nrz
    May 22, 2014 at 5:05

1 Answer 1

3

There are a number of ways to do this. Some people new to signature scanning use MD5 hashes of the entire file. This is VERY flawed, due to the switching of registers or even just the timestamp of the file would change the entire signature.

Another method often used is YARA ( http://plusvic.github.io/yara/ ). A good example from their webpage:

rule silent_banker : banker
{
    meta:
        description = "This is just an example"
        thread_level = 3
        in_the_wild = true

    strings:
        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}
        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}
        $c = "UVODFRYSIHLNWPEJXQZAKCBGMT"

    condition:
        $a or $b or $c
}

Here they say that one of the A, B or C bytes should be within the file.

Another method used (however this is more a Heuristic method) is to detect the ways it tries to hide. Eg obfuscation, encryption odd jumps (like pop, ret to jump to addresses).

Another method used often, (although this is less signature based) is IOC, for this see: http://www.openioc.org/

I think you are looking for YARA. Note for writing YARA signatures, good malware/exploits authors randomize everything they can. So try to find the parts that are 'unchangeable'.

3
  • Okay I will look at YARA, How would I reach a hexadecimal line like $a if I have the commands say: MOV ax,bx XOR ax,ax? Do I just put those commands into a hex editor and get the corresponding value?
    – MysteryMan
    May 21, 2014 at 7:55
  • The answer is opcodes. ( mathemainzel.info/files/x86asmref.html ) You can use any respectable disassembler for this.
    – Stolas
    May 21, 2014 at 8:23
  • If you need binary encodings (usually represented as hexadecimal bytes) of x86 assembly for searching, you should take into account that many x86 instructions have 2 or more possible encodings. For example in 32-bit x86 mov ax,bx can be encoded in the following ways: 66 89 d8 (mov r/m16,r16) or 66 8b c3 (mov r16,r/m16).
    – nrz
    May 21, 2014 at 11:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.