code behavior

Metamorphic code

In computer virus terms, metamorphic code is code that can reprogram itself. Often, it does this by translating its own code into a temporary representation, edit the temporary representation of itself, and then write itself back to normal code again. This procedure is done with the virus itself, and thus also the metamorphic engine itself undergoes changes. This is used by some viruses when they are about to infect new files, and the result is that the "children" will never look like their "parents". The computer viruses that use this technique do this in order to avoid the pattern recognition of anti-virus software: the actual algorithm does not change, but everything else might.

The main difference between metamorphic and polymorphic viruses is the fact that a polymorphic virus ciphers its original code to avoid pattern recognition, and a metamorphic virus changes its code to an equivalent one (i.e. the codes do essentially the same thing). This modification can be achieved using techniques like inserting NOP instructions, swapping registers, changing flow control with jumps or reordering independent instructions. Metamorphic code is usually more effective than polymorphic code. This is because the anti-virus, in order to detect it, will need to use some kind of emulation to analyze the code behavior.

Metamorphic code can also mean that a virus is capable of infecting executables from two or more different operating systems (such as Windows and GNU/Linux) or even different computer architectures. Often, the virus does this by carrying several viruses with itself. The beginning of the virus is then coded so that it translates to correct machine-code for all of the platforms that it is supposed to execute in It is possible in theory for a metamorphic virus to rewrite the temporary representation of itself into another set of instructions, intended for another computer architecture. The API would also have to be changed.

See also

Metamorphic viruses

External links

Hunting for Metamorphic

Search another word or see code behavioron Dictionary | Thesaurus |Spanish
Copyright © 2014, LLC. All rights reserved.
  • Please Login or Sign Up to use the Recent Searches feature