Playing Hide-and-Seek with Virus Scanners

Abstract

This chapter tries to bridge the gap between a fundamental topic in Computer Science, namely how computer processors execute programs, and a topic in information security, namely computer viruses.

It starts by introducing the concept of a fetch-decode-execute loop, and the implication of Harvard versus von Neumann architectures. By adopting a step-by-step approach and some very simple programs, the goal is show there is no magic involved: even complex, modern computer processors are based on fairly simple principles which everyone can understand. Using this background, the chapter explores a technical mechanism used by computer viruses to evade detection by virus scanners.

Specifically, the ability for a program to modify itself during execution (so-called self-modifying code) allows polymorphic viruses to hide their intentions from a scanner seeking to detect them.