Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
We are thinking to develop a new Antivirus program. The main concern is to create a virus signature database. I want to ask what is the best possible way to add viruses signature in our database to make it a strong DB. kindly guide us the best possible way.
Note: Its will in MD5
MD5-based anti-malware works decently against static-infections that never change. If it changes even by a little bit, you're screwed. However, MD5 is also vulnerable to collisions, so you're going to have a fair share of false positives.
I wouldn't rely on this method at all. SHA-256 would probably be better for this task. However, that leads to the next problem...
A bigger problem is that viruses can merge themselves onto an existing, non-malicious executable and make it malicious. The author can inject it into various places in the program and make the hash completely different every time.
Not only that, but by changing the code just a little bit, you can completely avoid detection because you'll have a new hash every time. You'll have to add a hash for every possible change to every file, which just isn't practical at all.
Even if you could do this, how would you know that the file was malicious? Did you compare the hash to the one listed on the website? Well, with md5, it's possible to fake it by causing a collision.
If you want to go down the hash route, even if you found a hash algorithm that didn't have any possible collisions, then you would literally need a gigantic white list of valid hashes for all known legitimate programs. And then you would compare them against what they are.
Even if you had a good hashing algorithm, it's just not practical, or even possible.
This is far too broad to answer here.
It's very difficult to create anti-virus software. Even though this post is off-topic, I'm responding in the hopes that you will not go down this dark path, as it'll only offer a false sense of security.
Mark Buffalo has already provided an good answer on things to consider. However, I'd like to expand on his answer with few solutions, ofcourse it's extremely broad question so by all means this isn't remotely close to an "best" solution. It's just things to consider.
I'll be making many assumptions based on this question and they will be:
"Viruses" can merge with existing executables There are soo many ways on how to do bind executables.
Let's say we have "notepad.exe" as the legit program and "virus.exe" which is the malware. Virus.exe could write itself into the RAT (Resource Address Table) of notepad.exe and replace the OEP (Original Entry Point) with it's custom loader which will execute the malware code then run notepad.exe.
You can defeat this by reading the RAT and doing an .text PE signature.
Keep in mind this can be defeated by metamorphic and polymorphism which the code is changed on each execution resulting in unique hash for the .text but is much harder to perform. Read through some of z0mbie's code on how it's executed and so on.
z0mbie - Sample malware code etc
You could only defeat this by extreme measures which I'm unaware of been automated, is things which execute in an squence which are malware related. For example, let's pretend DeleteFileW( L"C:\SomeImportantFile.exe" ); so, let's say the code is as follows:
MOV EAX, 0x12345
PUSH EAX
CALL Kernel32.DeleteFileW
Now in terms of efficency it will be slow but you could signature the PUSH EAX, CALL as it will always be same bytes and in your code read what values is held at 0x12345 as this memory address will likely be different.
Changing their source, or even recompiling the virus will defeat you From the above you'll able to get around this.
To cover other points which have not been talked about:
I do believe this question is more of an question for https://reverseengineering.stackexchange.com/ However, I believe it's too indepth to answer.
