Re: [Full-disclosure] Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte

From: Eygene A. Ryabinkin (rea_at_rea.mbslab.kiae.ru)
Date: 10/27/05

  • Next message: Martin Schulze: "[Full-disclosure] [SECURITY] [DSA 876-1] New lynx-ssl packages fix arbitrary code execution" 
    Date: Thu, 27 Oct 2005 10:25:48 +0400
To: Debasis Mohanty <mail@hackingspirits.com>

    > Especially in case of EXEs, AFAIK not all EXEs has the same 'MAGIC BYTE'
    > (MZ). MZ only appears in the first two bytes of Win32 executable files.

     Just for the curiosity: if you'll change "MZ" to "ZM" then the 16-bit
    executables (MZ and NE executables) will still run and 32-bit (PE) executables
    will execute their DOS stub part. It will be very interesting to check if
    such files will be detected as executables at all in all mentioned antiviruses
    and what sections PE files will be examined.

     The 'MZ' -> 'ZM' hack is the old feature of MS-DOS loader that still lives in
    WinXP (at least, didn't tested others, but believe that they also carry that
    feature). That's what is called 'interoperability between various versions' ;) 

    -- 
 rea
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
  • Next message: Martin Schulze: "[Full-disclosure] [SECURITY] [DSA 876-1] New lynx-ssl packages fix arbitrary code execution"

    Relevant Pages