flat assembler
Message board for the users of flat assembler.
![]() Goto page Previous 1, 2, 3, 4 Next |
Author |
|
revolution
Azu, why you misquote vid?
|
|||
![]() |
|
revolution
Hey, good find, vid is a naughty boy!
|
|||
![]() |
|
revolution
Azu wrote:
|
|||
![]() |
|
Azu
revolution wrote:
![]() Or is there some fundamental weakness that an infinite amount of ways can be derived from? |
|||
![]() |
|
revolution
It's the fundamental thing. There are so many things that a VM would have to do to counter all possibilities that it just becomes too complex to solve in any practical way.
Last edited by revolution on 18 Feb 2009, 12:24; edited 1 time in total |
|||
![]() |
|
Azu
Ah, damn.
I still think it makes it easier though. Even if it will never be perfect. It's going to detect at least some that wouldn't have otherwise been detected, right? As long as this isn't used in exclusion to other types of detection I mean. Last edited by Azu on 18 Feb 2009, 12:24; edited 1 time in total |
|||
![]() |
|
vid
Now I am not sure how exactly do you think VMs help viruses. How?
BTW, detection whether you run in VM is quite easily detectable by the VM host ![]() |
|||
![]() |
|
revolution
vid wrote: Now I am not sure how exactly do you think VMs help viruses. How? |
|||
![]() |
|
vid
I wasn't talking about host remaining hidden from guest, I was talking about host being able to detect when guest is trying tell whether it runs in VM. That is "one level less".
Any timing method is prone to be detected simply by guest doing too many VM-breaks in short time (it has to be done like this in order to prevent cache misses which would look like time consumed by VM break, and to multiply tiny time taken by host to handle virtualization to something mesureable). Quote: simulate contiguous real time what exactly do you mean by this? |
|||
![]() |
|
revolution
vid wrote:
|
|||
![]() |
|
vid
Quote: In a VM there are small but detectable "jumps" in real time. In "heavyweight" VMs maybe yes. Before going on in debate, I quess I will need answer to my question "Now I am not sure how exactly do you think VMs help viruses. How?" because I don't know which scenario are we talking about (virus as a host, AV as host, or what?) |
|||
![]() |
|
revolution
The basic scenario is: Virus in a VM says "I'm in a VM so don't do a bad thing". Then later virus in a real machine says "I'm running for real, do the wild thing".
And the virus doesn't care what the host VM is, AV scanner, VPC, VMWare, Bochs, whatever, any VM will mean no bad behaviour. |
|||
![]() |
|
vid
And that should be as a defense against AV which will be a VM host?
Making AV as a VM host sounds VERY hypothetical to me. Will the AV have custom lightweight VM host, or will it work as a part of something existing, like VMware or XEN? |
|||
![]() |
|
revolution
Sure, many AVs have VM capabilities. Mostly software based, like Bochs. No great feat really. Debug your favourite AV and you will see it happening.
|
|||
![]() |
|
Azu
revolution wrote:
|
|||
![]() |
|
revolution
There are many interactions that a VM has a hard time to emulate completely. Too complex to explain here, there are many websites around explaining various methods of detection. Some methods are VERY hard to counteract, others quite easily, but all require some compromises in the VM and make it a lot more complex.
|
|||
![]() |
|
bitRAKE
I was thinking more about using the VM for testing/improving the virus. It isn't a big chore to run a small network on a single PC with various guests. Any smart virus writer would try to increase the surface area of the virus - not the depth/complexity (no need to detect the VM).
(vid, if you want to share your fantasies in private - send me some pics sweety.) |
|||
![]() |
|
Azu
bitRAKE wrote: I was thinking more about using the VM for testing/improving the virus. It isn't a big chore to run a small network on a single PC with various guests. Any smart virus writer would try to increase the surface area of the virus - not the depth/complexity (no need to detect the VM). |
|||
![]() |
|
Borsuc
Azu wrote: If you mean things like WINE.. then no. ![]() _________________ Previously known as The_Grey_Beast |
|||
![]() |
|
Goto page Previous 1, 2, 3, 4 Next < Last Thread | Next Thread > |
Forum Rules:
|
Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.
Website powered by rwasa.