[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
re: anti-tamper software
Thanks to all who replied to my request, although it seems I didn't quite
make it clear what I was looking for.
I'm not particularly interested in a strong cryptographic solution, as this
isn't intended to detect intentional tampering - just unintentional, such
as a bad spot on a hard drive or corruption. Turns out that Simtel has
a couple of such packages in /SimTel/msdos/virus - CVIRPROT.ZIP is enough
protection, although STEALTH.ZIP looked intriguing...
I was, however, interested in what Fred Cohen said about there being a generic
attack against such methods when applied to software protection against viruses
(virii?). Is there such a generic attack, besides the obvious of jumping around
the detection code? How about encrypting the executable, adding loader and
decryption code, then decrypting the executable at runtime - would that defeat
such an attack, or all such defenses doomed to failure?
--
Ed Carp, N7EKG [email protected], [email protected]
214/993-3935 voicemail/digital pager
Finger [email protected] for PGP 2.5 public key [email protected]
"Past the wounds of childhood, past the fallen dreams and the broken families,
through the hurt and the loss and the agony only the night ever hears, is a
waiting soul. Patient, permanent, abundant, it opens its infinite heart and
asks only one thing of you ... 'Remember who it is you really are.'"
-- "Losing Your Mind", Karen Alexander and Rick Boyes