Bugtraq mailing list archives
Re: [Full-disclosure] Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte
From: "Andrey Bayora" <andrey () securityelf org>
Date: Thu, 27 Oct 2005 09:14:52 +0200
I checked the "ZM" variant and got the same results as for "MZ" one. Thus, I think that they indeed, detected as executables, but only AV vendor can tell for sure. Generally, there are many variants for this issue, as many various "magic byte" variants exist. In my case - I force AV to look at the TEXT file as to EXECUTABLE, but it's possible that other "pairs" then txt<->exe exist as well. Regards, Andrey Bayora. ----- Original Message ----- From: "Eygene A. Ryabinkin" <rea () rea mbslab kiae ru> To: "Debasis Mohanty" <mail () hackingspirits com> Cc: "'Andrey Bayora'" <andrey () securityelf org>; <full-disclosure () lists grok org uk>; <bugtraq () securityfocus com> Sent: Thursday, October 27, 2005 8:25 AM Subject: Re: [Full-disclosure] Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte
Especially in case of EXEs, AFAIK not all EXEs has the same 'MAGIC BYTE' (MZ). MZ only appears in the first two bytes of Win32 executable files.Just for the curiosity: if you'll change "MZ" to "ZM" then the 16-bit executables (MZ and NE executables) will still run and 32-bit (PE)
executables
will execute their DOS stub part. It will be very interesting to check if such files will be detected as executables at all in all mentioned
antiviruses
and what sections PE files will be examined. The 'MZ' -> 'ZM' hack is the old feature of MS-DOS loader that still
lives in
WinXP (at least, didn't tested others, but believe that they also carry
that
feature). That's what is called 'interoperability between various
versions' ;)
-- rea
Current thread:
- Re: [Full-disclosure] Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte Andrey Bayora (Oct 26)
- Re: [Full-disclosure] Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte Bipin Gautam (Oct 29)
- <Possible follow-ups>
- RE: [Full-disclosure] Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte Debasis Mohanty (Oct 26)
- Re: [Full-disclosure] Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte Eygene A. Ryabinkin (Oct 29)
- Re: [Full-disclosure] Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte Andrey Bayora (Oct 29)
- Re: [Full-disclosure] Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte Eygene A. Ryabinkin (Oct 29)