Writing a Mutation Engine and Breaking Aimware (opens in new tab)

(back.engineering)

34 pointsdisk03y ago4 comments

4 comments

That's a really fascinating bit of writing. I remember writing "mutation engines" back in the day for x86 virus coding.

In 1993 the virus group Phalcon/Skism from Canada published a polymorphic engine called Dark Angel's Multiple Encryptor or DAME, the writeup of that is still available:

https://ivanlef0u.fr/repo/madchat/vxdevl/vdat/tuda0011.htm

That inspired me to do similar things, playing around with replacing bits of assembly with functionally equivalent alternatives, and using differing encoding of common instructions.

Of course all of this is very obsolete knowledge these days, which is a shame in some ways.

lifefeed3y ago

I read "The Little Black Book of Computer Viruses" back in the 90s and it was an education in assembler. I wrote a little mutation engine too, it did not perform well!

stevekemp3y ago

A lot of times things didn't need to perform terribly well, but at the same time I was reminded recently of some of the tricks - removing "ld de, 0" in favour of "xor de,de", etc, which came up in this past post:

https://news.ycombinator.com/item?id=30941097

So maybe I was wrong, this kind of experimentation and knowledge is still useful.

Computeiful3y ago

The performance hit is quite unacceptable in games such as CSGO. I cannot really think of any competitive game where the performance hit is justifiable.

j / k navigate · click thread line to collapse

4 comments

stevekemp3y ago

That's a really fascinating bit of writing. I remember writing "mutation engines" back in the day for x86 virus coding.

In 1993 the virus group Phalcon/Skism from Canada published a polymorphic engine called Dark Angel's Multiple Encryptor or DAME, the writeup of that is still available:

https://ivanlef0u.fr/repo/madchat/vxdevl/vdat/tuda0011.htm

That inspired me to do similar things, playing around with replacing bits of assembly with functionally equivalent alternatives, and using differing encoding of common instructions.

Of course all of this is very obsolete knowledge these days, which is a shame in some ways.

lifefeed3y ago

I read "The Little Black Book of Computer Viruses" back in the 90s and it was an education in assembler. I wrote a little mutation engine too, it did not perform well!

stevekemp3y ago

https://news.ycombinator.com/item?id=30941097

So maybe I was wrong, this kind of experimentation and knowledge is still useful.

Computeiful3y ago

The performance hit is quite unacceptable in games such as CSGO. I cannot really think of any competitive game where the performance hit is justifiable.

j / k navigate · click thread line to collapse