1
$\begingroup$

Several years ago a group of malware authors began using code like this:

for (j = 0; j < length; j++)
  ptr[j] = (ptr[j] ^ VALUEA) - VALUEB;

for encoding, and this to decode

for (j = 0; j < length; j++)
 ptr[j] = (ptr[j] + VALUEB) ^ VALUEA;

I've recently seen this pop up in seemingly legitimate software. This leads me to believe that there is a source for this type of encoding somewhere in the wild. I was wondering if there is a specific name for this type of encoding?

| improve this question | |
$\endgroup$
  • $\begingroup$ Both of these operations are addition. ^ is addition per bit, and + is addition per byte. $\endgroup$ – user27962 Sep 27 '15 at 0:08
  • 2
    $\begingroup$ How about "really bad encryption"? Do VALUEB and VALUEA really never change? $\endgroup$ – mikeazo Sep 27 '15 at 0:59
  • 1
    $\begingroup$ I suspect that malware authors use this as a method to avoid signature-based virus checkers. By cryptographical standards, this is a very weak method; however it may be sufficient to avoid simple-minded checks. $\endgroup$ – poncho Sep 27 '15 at 1:06
  • 1
    $\begingroup$ @mikeazo it is definitely "really bad encryption" but as poncho points out, it is a simple method for defeating basic sig-based detection approaches. the constants typically stay constant between versions of the malware and always stay constant within the binary. $\endgroup$ – tjac Sep 27 '15 at 1:24
  • 1
    $\begingroup$ Obfuscation might fit. $\endgroup$ – CodesInChaos Sep 27 '15 at 10:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.