In my seminar I worked on a new kind of malware i.e the packed malware. Packing is the latest obfuscation technique used by the malware authors for evading antiviruses. I am attaching a copy of my report with all the interesting work in this field.

Click here to download the report.

For any further query please contact me at tarun.still.single@gmail.com or tarun@cse.iitb.ac.in

What is PeLib?
PeLib is an open source C++ library with the purpose to ease the access and modification of PE (Portable executable) files. This is done through a multitude of classes which represent all important PE header and directory structures and which provide the necessary functions to read, modify and write these structures. As this library is fully ISO C++ compliant it should compile with all popular compilers for the Windows platform. For people who don't use C++ in their projects a dynamic link library is provided which encapsulates all of PeLib's functionality so that projects using programming languages as diverse as Win32 assembler, C# or Delphi can still benefit from PeLib's power

Here is the way to use this library on linux... There is a need for this article because in the documentation it was not specified how to use it. Although using it is very easy but for a beginner like me it was little difficult.

I was not able to use alpha 9 so I have used its alpha 6 version.
now download the tarball and extract it.
go to source folder then rename the file makefile.g++ to Makefile then in terminal rum make.
It will show some error in the terminal note the file names giving error. Then open those files and add #include < string.h> and then again run make this will work.

Now to test the PeLib go to examples folder in tar ball and then go to oon folder

there again rename makefile.g++ to Makefile and run make in terminal .

It will create oon.exe if every thing was correct.

The Blackdoor that I have just captured is a very priliminary virus. It is very easy to dissect it using General Techniques more about it later

Just found some good tutorials on reverse engineering and now have found the virus. Now this the time to reverse the virus without its source code. My first step toward
analyzing virus. Though this will be an offline analysis but will be a great help for me as performing live analysis.Will be here soon with the result of analysis.

Are the concepts of compiler code optimization will work on breaking obfuscation while trying to detect virus concealed by obfuscation to hide its signature.

To conceal a virus from premium antivirus products a virus author must know how to obfusticate its code that its free from detection. As I am trying to detect virus it would be imperative for me to learn the obfustiaction techniques.

I have read some papers on how to detect worms. All were saying matching patterns etc. For matching patterns I need to learn to deassemble the code and for that purpose I will be using IDA pro. Today I will learn to work with the deassembler. This is kind of fun to get into real buisness of hacking not any idotic pop-up window the real hacking starts now..:)