I was recently analyzing the sources of ZeuS, ZeroAccess, Carberp and other professional malware and there was one thing which I found weird:

The authors did not use the standard library std::-functions very frequently when they could have. I mean stuff like std::fstream / std::string / std::cout (for debugging).

My question is why? A lot of tasks could be accomplished easier if they would use these functions. I don't think efficiency was their concern since the speed boost wouldn't be worth the time spend.

Source example here

  • Were they using C equivalents to these, or trying to avoid strings and stream handling, or what? Input/Output is a heavily language-dependent thing, so maybe they were just more comfortable with C. – David Jun 4 '17 at 18:07
  • github.com/Visgean/Zeus/tree/translation/source/client , I suggest you have a look at the sources because I don't really know how to describe that. They stick to C style and WINAPI functions but I don't understand why. – PePePlusPlus Jun 4 '17 at 23:41
  • rephrased the question because it was a little hard to decypher – schroeder Oct 20 '17 at 15:36
  • Using c++ just adds overhead to the malware and results in bloated malware. Also there is no guarantee C++ libraries are available on a PC. – fpmurphy Oct 20 '17 at 17:19

When writing a malware, you should make as few assumptions as possible on the libraries existing on the target (victim) machine. As the sources you show in comment are for Windows, all you can safely assume is that the functions for WINAPI calls will be available, because any additional dependency on redistributable bits for any C or C++ system may be present or not: many Window machines have no installed development tools, and they only have the libraries (DLL) that were required by other software.

That means that to be able to use functions from the C++ (or even C) library, the developper should statically link the used standard library resulting in a heavy application, when a malware should be tiny in order not to sched light on it because of its size.

That's a possible reason why the developpers of Zeus make an intensive usage of WINAPI calls and avoid calls to the C standard library, not speaking of the C++ one which would add a new layer and some overhead in size.

|improve this answer|||||
  • I thought that the standart library is pretty much ALWAYS included. Wikipedia seems to back me up : "In the C++ programming language, the C++ Standard Library is a collection of classes and functions, which are written in the core language and part of the C++ ISO Standard itself." – PePePlusPlus Nov 19 '17 at 15:57
  • @PePePlusPlus: If a C (resp. C++) developpement environment is installed, then the standard requires the C (resp C++) library to be also installed. But many Windows box contain no C++ dev. environment, so the libraries may not be present. – Serge Ballesta Nov 19 '17 at 18:24
  • The std library can be used on any program and it will run without requiring any pre-installing any library, software or DLL – Michael Haephrati Aug 14 '19 at 2:09
  • @MichaelHaephrati: Of course if it is statically linked... – Serge Ballesta Aug 15 '19 at 8:02

It is due to the needs to run the process silently. What happen when you try to run an executable with missing dll ? an error messages or an install shield will be trigger. The coder do not want this because the main objective is to run on more machines as possible. By using "std" library the coder avoid some dependencies issues and he will be sure that the software will run on every machine.

|improve this answer|||||
  • 2
    But the OP says "use the standard library std::-functions as infrequently as possible". More likely they were a C programmer at heart but happened to need to write it in C++ for some reason. – TripeHound Sep 20 '17 at 14:06
  • oups my bads lolz sry ... I have missed a good moment to shut my mouth up lol cheers :) – frank Sep 20 '17 at 14:36
  • you can delete this if you misread the question ... – schroeder Oct 20 '17 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.