Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am talking about crypters used to encrypt files like viruses and keyloggers for the sole purpose of bypassing antivirus detection. How do they work?

share|improve this question

2 Answers 2

up vote 11 down vote accepted

In some circles, "crypter" and "packer" are synonymous to mean binaries or programs which are self-checking and/or self-modifying. Crypters may, more specifically, mean self-modification that includes encryption and/or code scrambling (see more below).

I suggest that you read Chris Eagle's The IDA Pro Book for an introductory understanding of packers and their disassembly of components and architecture.

Daniel Reynaud's work on packers and self-modifying code is also very fascinating. He makes some distinction between integrity checking, blind writes, code scrambling, and encryption of PE files in this blog post about visualizing packers and self-modifying programs. His crude system of checking for these various technique implementations in packers using dynamic binary instrumentation (not the best way of going about this, but it can be very fast compared to other methods) is available at http://tartetatintools.googlecode.com

share|improve this answer
    
Thanks! Nice resources indeed. –  lbwtz2 Nov 14 '10 at 14:57

You could give some of the encoders in the metasploit framework a look. In particular the Polymorphic XOR Additive Feedback Encoder ( Shikata Ga Nai ) might be worth a look, as it is dicussed in the Metasploit Unleashed documentation in regards to bypassing antivirus detection.

share|improve this answer
    
Thank you for the seuggestion! –  lbwtz2 Nov 14 '10 at 14:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.