Advanced Code Evolution Techniques and Computer Virus Generator Kits

• By Peter Szor
• Mar 25, 2005

This chapter is from the book

Art of Computer Virus Research and Defense, The

" In mathematics you don't understand things. You just get used to them."

—John von Neumann

In this chapter you will learn about the advanced self-protection techniques computer virus writers have developed over the years to fight back against scanners. In particular, you will learn about encrypted, oligomorphic, polymorphic¹, and advanced metamorphic computer viruses². Finally, we will look at computer virus generator kits³ that use similar techniques to create different-looking virus variants.

7.1 Introduction

We will examine the various ways in which virus writers have challenged our scanning products over the last decade. Although most of these techniques are used to obfuscate file-infector viruses, we can surely expect similar techniques to appear in future computer worms.

Over the years, code evolution has come a long way in binary viruses. If someone were to trace the development result of viruses, it might appear that almost everything possible has already been done, and problems are not escalating. However, there are still computing distribution models that have not yet been seen in viruses.