RE: [Full-Disclosure] MyDoom download info

From: Steve Wray (steve.wray_at_paradise.net.nz)
Date: 01/31/04

  • Next message: first last: "RE: [Full-Disclosure] MyDoom download info" 
    To: "'first last'" <randnut@hotmail.com>, full-disclosure@lists.netsys.com
Date: Sat, 31 Jan 2004 13:04:30 +1300

    > From: full-disclosure-admin@lists.netsys.com
    > [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of
    > first last
    [snip]
    > >
    > >IIRC there are viruses that are encrypted and are almost impossible
    > >to disassemble?
    > >
    > >Would that be true?
    > >
    >
    > Sobig.F was packed with tElock. It's a PE file protector. It
    > "encrypts" the program's code and data, and tries to detect debuggers
    before
    [snip]
    > to successfully unpack the program. All they really needed to
    > do was dump it from memory while it was running and they could've
    analyzed
    > it immediately with any disassembler.

    Forgive me, I am no assembly hacker nor much of a programmer,
    but would it be possible for a program to 'react' in some way
    were one to try to dump it from memory?

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: first last: "RE: [Full-Disclosure] MyDoom download info"

    Relevant Pages

    • Re: [Lit.] Buffer overruns
      ... >>of physical memory. ... But that doesn't seem to be what the other posters mean by "overcommit" ... their requests don't ...
      (sci.crypt)
    • Re: Great SWT Program
      ... the keyboard, even when intermittently using the numpad, arrow keys, ... memory for where the keys are, and having the keyboard in my bottom ...
      (comp.lang.java.programmer)
    • Re: intelligent disassembly
      ... and going through the upper memory to scan for AA55's and 55AA's. ... locations to program devices and call the BIOS or video BIOS. ... I know this contradicts my previous offer to disassemble the ... The program outputs as German with some English. ...
      (comp.os.msdos.programmer)
    • Re: Question on the load list (kinda long, delete if you want to ignore gory details)
      ... fully relocated program in memory. ... either one or two XTLST entries for a single CDE and the latter case ... This was a long time ago, so my memory could certainly be wrong. ...
      (bit.listserv.ibm-main)
    • Re: free()
      ... It's because malloc returns void * that you _don't_ need to cast it! ... valid object *or* has a value of NULL. ... may be outcome of accessing freed memory) and to explain this i need ...
      (comp.lang.c)