0

I've wondered whether a virus, originally written for 32-bit executable, can infect 64-bit executable successfully?

All 32-bit instructions are valid 64-bit instructions, right? So, only the ABI may break things?

How should a 32-bit virus be adjusted (if neccessary) to target 64-bit executable?

I'm interested in answers for Windows or Linux family of operating systems, i.e., virusses written with the purpose of infecting PE or ELF binaries.

Improve this question
2
  • If the job of the 32 bit virus is to infect 64 bit binaries, what makes you think it can't?
    – multithr3at3d
    Commented Apr 15, 2017 at 15:50
  • @korockinout13 - I mean the 32-bit virus was written for 32-bit binaries.
    – Shuzheng
    Commented Apr 15, 2017 at 16:08

1 Answer 1

Reset to default
1

It depends on what vulnerability is exploited by the virus. Some vulnerabilities are highly specific and would only work on a specific version of the library, even within the same architecture. Others are more general and can only be used against a wide range of versions and can be easily portable between architectures and even operating systems. For example, browser exploits (JavaScript or browser plugins) often runs cross platform, so it's often used to then select and deliver a platform-specific exploit.

Improve this answer
2
  • Can you give an example of 32 bit exploit that doesn't work on 64 bit?
    – Shuzheng
    Commented Apr 16, 2017 at 6:46
  • buffer overflow or stack overflow exploit often requires different payload to work on different architectures, they don't work as-is between architecture. This is usually the result of different calling conventions, which means the payload has to overwrite different locations to achieve the same effect.
    – Lie Ryan
    Commented Apr 16, 2017 at 7:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .