0

It is a well known fact that OS-related viruses are commonly written in low level languages like C or C++ which require direct access to the kernel of the CPU , I am just wondering if its possible that viruses can be written in high level languages like Python or Java which does not have as much access to the CPU kernel ???

  • 3
    Direct access to the Kernel of the CPU in C++? That doesn't mean anything you know. – executifs Apr 16 '14 at 15:39
  • 3
    I think you need to challenge a lot of assumptions there about programming languages and kernels. – schroeder Apr 16 '14 at 15:43
  • 2
    You must first undestand the terminology: what is a virus, what is the kernel, how the OS executes programs, what is a program... In some sense, it's possible to write a virus in a plain text, interpreted and executed by the user (like the Delete the program with a little bear as it's icon, send this message to the entire world hoax). – ThoriumBR Apr 29 '15 at 13:49
  • As far as python malware, I remember seeing the library pygame used as keylogger software. – Kolob Canyon Nov 2 '16 at 3:25
11

Yes, malware exists in all sorts of languages. Often, though, some of the most critical fiddly bits of many exploits are written not in C or C++, but rather directly in machine code, carefully assembled often by hand. This may be the only want to get the sizing and alignment correct for what you're trying to do.

The distance from the "metal" is a matter of abstractions and assumptions.

Writing in machine code uses no abstractions and creates no assumptions.

Writing in assembly provides some level of abstraction, but now you're dealing with the assumptions made by the assembler. So code might not be aligned like you want, but the instructions will be predictable.

Writing in C adds another layer of abstraction, but now you're limited to the sorts of assembly code that the C compiler will produce.

Writing in C++ adds quite a lot of abstraction, particularly with respect to memory management and function calls. Now your code might be rearranged a bit, and you may get more code in your binary than you actually wrote. Depending on your target, this is typically not a problem, but many programs (famously the Linux kernel, but also others) avoid C++ because they don't want any unpredictability.

Writing in Python changes things pretty significantly. Now you're not even producing machine code, you're producing instructions for an interpreter. How the code executes depends on the version and build of the interpreter installed, and your assumptions have to be tuned accordingly. You can only use it where a python interpreter is installed, and only in contexts where python can be invoked.

You use the tool for the job. Many exploits involve even Bash code, which is far less capable than Python, but it's simple and it's available. If you really know what you're doing, then this isn't even a question worth putting a lot of thought in to; you use the tool that gets the result you're looking for.

  • Not to mention design flaws in protocols which are responsible for several highly-mediatic issues in recent years and are language-agnostic, or ROP-like exploits that exploit bugs in a program to turn its own code (whatever the language) into malware. – Steve Dodier-Lazaro Apr 29 '15 at 14:15
3

You can write a virus in any language. The condition is the OS vulnerability that is being exploited and the language tools that are available to take advantage of it.

"High-level" languages are not 'further' from the OS kernel, but rather they are more abstracted from the kernel from the programmer's point of view. Even Python can access network sockets, memory addresses, and manipulate buffers.

0

If by "virus" you mean "self replicating code" then of course it can be written in any language.

Once upon a time, I wrote a virus that propagated via Pascal as an educational experiment to show this very point, actually. It consisted of an executable subroutine. What the subroutine did was:

  1. search the local disk for files with an extension of .pas
  2. copy the .pas file to .clean, then open the .pas file for editing
  3. verify that the .pas file had no subroutine called "infect", or exit
  4. find a large subroutine, and add a call to "infect".
  5. add itself to the end, as a subroutine called "infect".

When executed, it copied itself to any .pas file it found locally -- and then if that file went to another location and was infected, it would propagate to additional files.

It was big, noisy, and obvious (that was a feature, actually) and writing in a high level language will probably have many of the same characteristics.

I think if I wanted a worm, I would probably write it in perl. But then, I write everything in perl.

  • Nice example. What abou Visual Basic Script in windows ?:) – NathanWay Apr 29 '15 at 19:28
  • @NathanWay You don't need to look any further than the ILoveYou virus – MikeTGW Jul 2 '16 at 4:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.