I've wondered whether a virus, originally written for 32-bit executable, can infect 64-bit executable successfully?

All 32-bit instructions are valid 64-bit instructions, right? So, only the ABI may break things?

How should a 32-bit virus be adjusted (if neccessary) to target 64-bit executable?

I'm interested in answers for Windows or Linux family of operating systems, i.e., virusses written with the purpose of infecting PE or ELF binaries.

  • If the job of the 32 bit virus is to infect 64 bit binaries, what makes you think it can't? Apr 15 '17 at 15:50
  • @korockinout13 - I mean the 32-bit virus was written for 32-bit binaries.
    – Shuzheng
    Apr 15 '17 at 16:08

It depends on what vulnerability is exploited by the virus. Some vulnerabilities are highly specific and would only work on a specific version of the library, even within the same architecture. Others are more general and can only be used against a wide range of versions and can be easily portable between architectures and even operating systems. For example, browser exploits (JavaScript or browser plugins) often runs cross platform, so it's often used to then select and deliver a platform-specific exploit.

  • Can you give an example of 32 bit exploit that doesn't work on 64 bit?
    – Shuzheng
    Apr 16 '17 at 6:46
  • buffer overflow or stack overflow exploit often requires different payload to work on different architectures, they don't work as-is between architecture. This is usually the result of different calling conventions, which means the payload has to overwrite different locations to achieve the same effect.
    – Lie Ryan
    Apr 16 '17 at 7:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.