Advanced bait detection
by
CoKe/VLAD
Introduction:
Bait files are the files the AV create to get them infected by a virus,
to check out his behaviour, his polymorphism, and last but not least to
debug it. Usually these files are pretty small, and only contain a few
instructions (i.e. Printing a message). As soon as they start infecting
hundreds (maybe thousands) of baits, they'll find out everything about
the virus. So to give them a real hard time doing their jobs, every
virus should in one way or another be able to recognize those files.
There are many possible ways of detecting bait files; most of them are
covered by the article 'Resist!' which you can find in this issue as well.
Since I suppose you don't want to read all that stuff twice, I will just
leave it out of my article.
In this article I will cover another way of detecting bait files:
code-analysis, bait-heuristics to say so, and after checking out tons
of executables, here's what I found out:
---------------------------------------------------------------------------
1 - COM Baits
-------------
Detecting COM baitfiles is a bit difficult, since you really have to
check out the code (in EXE's you can analyse the header aswell, but
the informations below are still true for them). Since bait files are
usually pretty small, best way to do it is to check the first 2048
(or even 4096) bytes for some specific constructions. Below are
listed a few things that mostly happen in bait files. Of course it's
no 100% detection, but if some of these criteria are fulfilled together,
it's better to make your virus ignore that file.
- Check for massive use of INC/DEC structures (there's no point in
increasing a register right after decreasing it :))
i.e. : INC AX
DEC AX
INC BX
DEC BX
etc.
- Check for a huge amount of NOP's (especially after jumps), since in
"normal" COM files, there are few or no NOP's at all.
i.e. : JMP 110
NOP
NOP
NOP
NOP
NOP
etc.
Also check for huge amounts of 00h bytes after jumps.
- Check if the first instructions are a
mov ah, 4Ch
int 21h sequence (same for ret)
or if the first instruction jumps to such a routine.
- Check for zero jumps (E90000h, EB00h etc.); again, in "normal" programs,
usually there are no zero jumps.
- Check for jumps to jumps. Of course this can happen in any COM file, but
if you have a jump to a jump along with tons of NOP's, you can be sure
there are wierd things going on.
- Also check for calls to a ret, as this is meaningless code too.
As I said, on their own, none of these criteria are useful. But combined
they give kinda a bait-heuristic, and it depends on you, how you
consider the matches. A file that matches even 3 of these criteria is
suspicious in my eyes.
---------------------------------------------------------------------------
2 - EXE Baits
-------------
As for EXE baits, the above is still true. In addition to all that, we
have the EXE-header that can help us.
- Most bait files don't have a stack!
To check this out, just compare CS with SS and SP with IP. If they both
match there is no stack, which is quite uncommon for EXE's.
-----------
EXE header structure
---------------------------------------------------------------------------
Offset Description Size
00 Signature 1 word 'MZ' or 'ZM'
02 Last Page Size 1 word
04 File Pages 1 word
06 Items 1 word
*08 Header Paras 1 word
0A MinAlloc 1 word
0C MaxAlloc 1 word
0E SS 1 word<------- Compare CS
10 SP 1 word<------- to SS and
12 Negative checksum 1 word IP to SP!
*14 IP 1 word<-------
*16 CS 1 word<-------
18 Reloc table offset 1 word
( [*] These are needed to calculate the entry point of the EXE. )
---------------------------------------------------------------------------
An EXE file with no stack is definitely to be distrusted!
---------------------------------------------------------------------------
For the further code-analysis, you gotta analyse the code at the
entry point, and _NOT_ the code after the header! This is a bit more
complicated than for the COM's, but once you got the entry point
(file offset of the code at CS/IP), it's the same as for COM files.
Unfortunately you won't find the entry point anywhere in the header.
To get it, you must use the following formula:
((CS + Header Para's) * 16) + IP
(See EXE header structure above)
Example:
mov ax, word ptr cs:[exeheader + 16h] ; This loads the CS
; to AX
add ax, word ptr cs:[exeheader + 08h] ; Add the header
; para's to CS
mov dx, 10h
mul dx ; Multiply by 16
add ax, word ptr cs:[exeheader + 14h] ; Add the IP
This leaves the entry point in AX. Now all you need to do is to set the
filepointer to the calculated address, and there you go...
Final words:
By respecting the ideas mentioned in 'Resist!', and adopting some of these
techniques, you can be pretty sure to give the AV a hard time, unless you
want your latest virus in any AV software 2 days after it was released! :)
See also : Anti-Bait Techniques by Sepultura