full-disclosure - Unpacking of malware, like Sasser

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

This website is powered by Openwall GNU/*/Linux security-enhanced OS

[<prev] [next>] [<thread-prev] [month] [year] [list]

From: gem at rellim.com (Gary E. Miller)
Subject: Unpacking of malware, like Sasser

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Yo Dennis!

On Sun, 2 May 2004, Dennis Rand wrote:

> There has not been so much talk as i could find on discovering how to
> unpack a malware program like sasser and other viruses and worms,

The old ways still work no matter the file packer.

Load the virus up in your favorite debugger
Run the program just until it is finished unpacking itself.
Save the memory image as a core file.
Run you favorite reverse-assembler in the core file.

Depending on the skill level of you, the virus writer snd the packer writer
this could be a snap or a real PITA.

RGDS
GARY
- ---------------------------------------------------------------------------
Gary E. Miller Rellim 20340 Empire Blvd, Suite E-3, Bend, OR 97701
	gem@...lim.com  Tel:+1(541)382-8588 Fax: +1(541)382-8676

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQFAlVDf8KZibdeR3qURAifhAKCDFZ/4x6ahOu9AajRDxnYEYLqfywCeN/KS
64y8Cgwz4/nJ3jjzuYsvHeI=
=LeIY
-----END PGP SIGNATURE-----