11th Working Conference on Reverse Engineering (WCRE 2004)
Imposing Order on Program Statements to Assist Anti-Virus Scanners
Delft, The Netherlands
November 08-November 12
ISBN: 0-7695-2243-2
A metamorphic virus applies semantics preserving transformations on itself to create a different variant before propagation. Metamorphic computer viruses thwart current anti-virus technologies that use signatures — a fixed sequence of bytes from a sample of a virus — since two variants of a metamorphic virus may not share the same signature. A method to impose an order on the statements and components of expressions of a program is presented. The method, called a "zeroing transformation," reduces the number of possible variants of a program created by reordering statement, reshaping expression, and renaming variable. On a collection of C program used for evaluation, the zeroing transformation reduced the space of program variants due to statement reordering from 10^183 to 10^20. Further reduction can be expected by undoing other transformations. Anti-virus technologies may be improved by extracting signatures from zero form of a virus, and not the original version.