Full Disclosure mailing list archives
Re: Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte
From: "Eygene A. Ryabinkin" <rea () rea mbslab kiae ru>
Date: Thu, 27 Oct 2005 10:25:48 +0400
Especially in case of EXEs, AFAIK not all EXEs has the same 'MAGIC BYTE' (MZ). MZ only appears in the first two bytes of Win32 executable files.
Just for the curiosity: if you'll change "MZ" to "ZM" then the 16-bit executables (MZ and NE executables) will still run and 32-bit (PE) executables will execute their DOS stub part. It will be very interesting to check if such files will be detected as executables at all in all mentioned antiviruses and what sections PE files will be examined. The 'MZ' -> 'ZM' hack is the old feature of MS-DOS loader that still lives in WinXP (at least, didn't tested others, but believe that they also carry that feature). That's what is called 'interoperability between various versions' ;) -- rea _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through forged magic byte Andrey Bayora (Oct 24)
- Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through forged magic byte trains (Oct 25)
- RE: Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte Debasis Mohanty (Oct 25)
- Message not available
- Re: Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte Eygene A. Ryabinkin (Oct 27)
- <Possible follow-ups>
- Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through forged magic byte Williams, James K (Oct 27)
- Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through forged magic byte x (Oct 27)