I have a problem where I have to create a virus signature for the Stoned Virus (Although this could apply to any virus/file).
Let's assume I have a copy of the compiled and decompiled program. I then proceed to identify the most important parts of the virus, that will always be present, in the code. As I understand it I now have to find the corresponding bytes in the compiled virus in order to create a byte signature for that critical part of the virus.
How do I proceed to find the corresponding bytes in the compiled source from the code that I identified in the decompiled version?
Extra:
- The code is in assembly
- Simply using a hash signature for the entire file is not an option
- Currently I only have the assembly code, but I can always compile this
- I am aware that Stoned would usually be located in the boot sector and not in a file. This is only an academic exercise and would be relevant to any virus.
EDIT:
The purpose of this is to be able to create virus signatures that can be used to scan a file system to find infected files as well as possibly infected files and variations of the virus code. For this reason I cannot simply use a hash of the entire file and I need to use specific parts of the virus. I can identify those parts but I do not know how to find the matching bytes in the machine code for the viral parts I identified.