full-disclosure - Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20051027062548.GK14349@rea.mbslab.kiae.ru>
Date: Thu Oct 27 13:12:19 2005
From: rea at rea.mbslab.kiae.ru (Eygene A. Ryabinkin)
Subject: Multiple Vendor Anti-Virus Software
	DetectionEvasion Vulnerability through forged magic byte

> Especially in case of EXEs, AFAIK not all EXEs has the same 'MAGIC BYTE'
> (MZ). MZ only appears in the first two bytes of Win32 executable files.

 Just for the curiosity: if you'll change "MZ" to "ZM" then the 16-bit
executables (MZ and NE executables) will still run and 32-bit (PE) executables
will execute their DOS stub part. It will be very interesting to check if
such files will be detected as executables at all in all mentioned antiviruses
and what sections PE files will be examined.

 The 'MZ' -> 'ZM' hack is the old feature of MS-DOS loader that still lives in
WinXP (at least, didn't tested others, but believe that they also carry that
feature). That's what is called 'interoperability between various versions' ;)
-- 
 rea