[Help] Make antivirus

Make antivirus

Hello all,

I'm a newb' but I want try to create my own antivirus/trojan-antirootkit.

Okay, which program I need ?
How to make that ? I searched but did'nt find :'(

Assuming you are working on Windows...

Anti virus/rootkit detection systems are huge. You need to be able to keep your code organized, clean, efficient, and reusable. In order to monitor processes you need to in Ring 0-so you will also need to know how to program drivers. A lot of malware connects back to a server for updates/to send payments to. For these you need to know how the TCP/IP protocol works. You pretty much have to make a system wide packet sniffer. You need to search harder because there is obviously information on how to do this.
Check this out. Long story short if you have to ask-you aren't good enough.

A fun exercise though.
Make a program that takes each file in your filesystem and computes an md5 or sha1. Then compare that checksum to a database of known malware checksums. You can easily do that in usermode.

Originally Posted by Eddington

In order to monitor processes you need to in Ring 0-so you will also need to know how to program drivers.

Bullshit. Tons of antiviruses don't even use drivers ( Ring 0/1/2 )

Originally Posted by Eddington

For these you need to know how the TCP/IP protocol works.

Only simple knowledge is needed to trace these back. If you had said IRC protocols or something, that'd be a valid point since those are easily traceable over unsecure connections. If your connection is encrypted, knowledge of TCP/IP goes to shit.

Originally Posted by Eddington

Make a program that takes each file in your filesystem and computes an md5 or sha1. Then compare that checksum to a database of
known malware checksums. You can easily do that in usermode.

Well yea, that's the basis of all antiviruses. Heuristic code detection.
Another method they do is
- on WoW64 processes, hook the call gate stub @ fs:[ c0 ] and check for some bad system calls
- on x64 processes, directly hook ntdll functions

Originally Posted by Hitokiri~

Bullshit. Tons of antiviruses don't even use drivers ( Ring 0/1/2 )

I mean... I guess the most popular AVs don't usekernel mode features Norton doesn't support x64 because of KPP-google it.
edit:
Oh wait add Kaspersky to the list that doesn't utilize the kernel.

Originally Posted by Hitokiri~

Only simple knowledge is needed to trace these back.

Recall that the thread starter stated he is a noob. I think its safe to say that analyzing network traffic would be an advanced topic for him.

Originally Posted by Hitokiri~

Bullshit. Tons of antiviruses don't even use drivers ( Ring 0/1/2 )

Only simple knowledge is needed to trace these back. If you had said IRC protocols or something, that'd be a valid point since those are easily traceable over unsecure connections. If your connection is encrypted, knowledge of TCP/IP goes to shit.

Well yea, that's the basis of all antiviruses. Heuristic code detection.
Another method they do is
- on WoW64 processes, hook the call gate stub @ fs:[ c0 ] and check for some bad system calls
- on x64 processes, directly hook ntdll functions

Some antiviruses don't use drivers at all, that's true, but it also means they are INEFFICIENT against kernel mode malware. Since usermode cannot monitor/edit the kernelmode memory, rootkits can slip by the AV that has no drivers and take control of the system...

Originally Posted by ZER0MEM0RY

Some antiviruses don't use drivers at all, that's true, but it also means they are INEFFICIENT against kernel mode malware. Since usermode cannot monitor/edit the kernelmode memory, rootkits can slip by the AV that has no drivers and take control of the system...

That's why there was a big fight against Microsoft and AV companies. I never said that it didn't make said AVs ineffective.

HelpMake antivirus

Post a Reply

Similar Threads

Tags for this Thread