1
$\begingroup$

Several years ago a group of malware authors began using code like this:

for (j = 0; j < length; j++)
  ptr[j] = (ptr[j] ^ VALUEA) - VALUEB;

for encoding, and this to decode

for (j = 0; j < length; j++)
 ptr[j] = (ptr[j] + VALUEB) ^ VALUEA;

I've recently seen this pop up in seemingly legitimate software. This leads me to believe that there is a source for this type of encoding somewhere in the wild. I was wondering if there is a specific name for this type of encoding?

Improve this question
$\endgroup$
6
  • $\begingroup$ Both of these operations are addition. ^ is addition per bit, and + is addition per byte. $\endgroup$
    – user27962
    Sep 27, 2015 at 0:08
  • 2
    $\begingroup$ How about "really bad encryption"? Do VALUEB and VALUEA really never change? $\endgroup$
    – mikeazo
    Sep 27, 2015 at 0:59
  • 1
    $\begingroup$ I suspect that malware authors use this as a method to avoid signature-based virus checkers. By cryptographical standards, this is a very weak method; however it may be sufficient to avoid simple-minded checks. $\endgroup$
    – poncho
    Sep 27, 2015 at 1:06
  • 1
    $\begingroup$ @mikeazo it is definitely "really bad encryption" but as poncho points out, it is a simple method for defeating basic sig-based detection approaches. the constants typically stay constant between versions of the malware and always stay constant within the binary. $\endgroup$
    – tjac
    Sep 27, 2015 at 1:24
  • 1
    $\begingroup$ Obfuscation might fit. $\endgroup$
    – CodesInChaos
    Sep 27, 2015 at 10:06

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.