full-disclosure - Inside AV engines?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6e285e810512131805x55dd4d65t@mail.gmail.com>
Date: Wed Dec 14 02:05:42 2005
From: fosforo at gmail.com (Fósforo)
Subject: Inside AV engines?

... or you can try one crypt/packer ($$$) called Morphine -
http://hxdef.czweb.org/
Assuming your company is going to support an exclusive antidetection
tool like that

2005/12/13, Michael Tewner <tewner@....ac.il>:
> Check The Art of Computer Virus Research and Defense (Paperback)
> by Peter Szor. It is one of the foremost books in Virus detection, etc,
> and I found it to be a valuable read...
>
> Examples are in C code, and there's a lot of memory dumping, etc. Check
> slashdot's review if you want.
>
> Jeroen wrote:
> > For penetration testing on Wintel system, I often use netcat.exe and stuff
> > like pwdump. More and more I need to disable anti-virus services before
> > running the tools to avoid alarms and auto-deletion of the applications. It
> > works but it isn't an ideal situation since theoretically a network can be
> > infected while the AV-services are down. Recompiling tools is an option
> > since the source of many tools I use is available. The question is (before I
> > burn useless CPU cycles): can someone help me getting info about the inside
> > of AV engines? Will addition of some rubbish to the code do the trick (->
> > other checksum), do I need to change some core code or is it a mission
> > impossible anyway? Who can help for example getting some useful research
> > papers on the subject of detecting viruses and how to bypass mechanisms
> > used? Any help will be appreciated.
> >
> >
> > Greets,
> >
> > Jeroen
> >
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

--

----------------------------------------------

"O  caminho  do  homem  de  bem  ?  cercado de
todos os lados  pelas  iniq?idades do  ego?smo
e tirania  dos homens maus.  Aben?oados os que,
em  nome da caridade e  boa vontade,  conduzem
os  fracos pelo  vale das  sombras, pois ele ?
o  guardi?o  de seu irm?o e o  que encontra os
filhos perdidos. E eu vou  atacar com vingan?a
e f?ria  os que tentarem  envenenar e destruir
meus irm?os. E quando minha vingan?a se abater
sobre  eles,  saber?o  que  eu sou  o Senhor."

(Ezequiel, 25, 17)