Self modifying code is a phrase used to describe programs that are able to change themselves. Using self modifying code can make it harder to reverse engineer a program, largely because the ‘actual code may differ from that shown’. That is, the actual code that ends up executing may be different from the code that is first shown during disassembly. Join me as I attempt to relive my youth and create some self modifying code, only this time it will have to work under the memory protection schemes implemented by the 80×86 processors and MS Windows. Continue Reading
General Information
Posts related to general information about malware analysis, or about this blog.
I am a believer of the ‘just because you can do something, doesn’t necessarily mean that you should‘ mentality, and I was reminded of this again this morning when I read ‘Malware Analysis as a function of intelligence and counterintelligence operations.‘.
As I start my first blog, I am grappling with the matter of what to blog about, what not to blog about, what to do, and what not to do; lest my actions potentially say more than I wanted to say. The idea that your actions (or sometimes inaction) can say more than you wish to say, isn’t new to me and is, in fact, something which I would like to blog about later — software/devices (and people for that matter) often leak information which, while not explicitly disclosing information, can sometimes allow for (potentially undesirable) inferences. Passive operating system fingerprinting is an example of this. Continue Reading
Welcome to Malware Musings.
I’m your host, Karl, and this is my blog for sharing thoughts and ideas about malware analysis, reverse engineering, and some of the things that malware gets up to when it thinks we’re not looking.
Thinking about reverse engineering malware and malware analysis can be a tad daunting. After all, it is a bit like finding a list of instructions such as:
- Keep taking a step forward until you get to the end of the path
- Turn left
- Take fifty steps forward
- Turn right
- etc.
and working out that it is actually a list of instructions for popping down to the shop for some milk. Continue Reading