Business & Presentations/Business and Presentations - Volume 1 (1995)(Sideface)(NL).iso/virus/tbav603/tbgensig.doc

Text File | 1993-06-14 | 21KB | 661 lines

 Thunderbyte signature compiler. (C) Copyright 1993 Thunderbyte B.V.


                               Table of Contents


    1. INTRODUCTION...................................... 2
        1.1. Purpose of TbGenSig......................... 2
        1.2. General information......................... 2

    2. DEFINING SIGNATURES............................... 2
        2.1. Format of the UserSig.Dat file.............. 2
        2.2. Adding a published signature................ 3
        2.3. Defining a signature with TbScan............ 3

    3. ADVANCED FEATURES................................. 5
        3.1. Keywords.................................... 5
            3.1.1. Item keywords......................... 5
            3.1.2. Message keywords...................... 6
            3.1.3. Position keywords..................... 6
        3.2. Wildcards................................... 8
            3.2.1. Position wildcards.................... 8
                3.2.1.1. Skip............................ 8
                3.2.1.2. Variable........................ 8
            3.2.2. Opcode wildcards...................... 8
                3.2.2.1. Low opcode...................... 8
                3.2.2.2. High opcode..................... 8
        3.3. Example..................................... 9






























                                     Page i



























































                                     Page 1

 Thunderbyte signature compiler. (C) Copyright 1993 Thunderbyte B.V.


1.  INTRODUCTION


  1.1.  Purpose of TbGenSig

    TbGenSig is a signature file compiler. Since TBAV is distributed
    with an up to date, ready-to-use signature file, you don't really
    need the signature file compiler.

    However, you need the signature file compiler if you want to define
    your own virus signatures. You can used either published signatures
    or define your own ones if you are familiar with the structure of
    software.

    In both cases, you only need to do this in emergency situations,
    like the unfortunate event that your machine or even company is
    attacked by an yet unknown and thus not recognized virus. It is
    recommended to send a few samples of the virus to some virus
    experts anyway, in order to make scanners to recognize the virus in
    the next versions of the scanners.

    It isn't possible to explain the whole subject of virus hunting in
    one manual, so this document assumes that you have enough
    expenrience and knowledge to make your own signatures.


  1.2.  General information

    TbGenSig searches for a file name UserSig.Dat in the current
    directory. This file should contain the signatures you want to add
    to the TBAV signature file TbScan.Sig. TbGenSig checks the contents
    of the UserSig.Dat file and applies it to the TbScan.Sig file.

    If you want to delete or modify your signatures, just edit or
    delete the UserSig.Dat file and run TbGenSig again.

    TbGenSig will list all signatures in the TbScan.Sig file on the
    screen when running.


2.  DEFINING SIGNATURES


  2.1.  Format of the UserSig.Dat file

    You can create and edit the UserSig.Dat file with every DOS text
    editor able to output unformatted text.

    All lines starting with ';' are comment lines. TbGenSig ignores
    these lines.

    Lines starting with '%' will be displayed in the upper TbGenSig



                                     Page 2

 Thunderbyte signature compiler. (C) Copyright 1993 Thunderbyte B.V.


    window.

    In the first line the name of a virus is expected. The second line
    contains one or more keywords. The third line contains the
    signature itself. This combination of three lines is named a
    signature record.

    An signature record should look like this:

        Test virus
        exe com inf
        abcd21436587abcd

    It is allowed to use spaces in the signature for your own
    convenience. TbGenSig will ignore those spaces.


  2.2.  Adding a published signature

    If you want to add a signature that has been published, do the
    following.

    -   Edit or create the UserSig.Dat file. Convert the published
        signature to an acceptable format for TbGenSig.

    -   Use keywords COM EXE BOOT INF

        You would get:

                New virus
                exe com boot inf
                1234abcd5678efab

    -   Execute TbGenSig.


  2.3.  Defining a signature with TbScan

    This chapter is intended for advanced users who own a TBAV.KEY
    file or a Thunderbyte add-on card.

    Although the TbScan.Sig file is updated frequently, new viruses are
    created each day, outpacing the regular upgrading service of this
    data file. It is therefore possible that one day your system gets
    infected by a recently created virus that has not yet been listed
    in the signature file.  TbScan will not always detect the virus
    in such cases, not even with the heuristic analysis.  If you are
    convinced that your system must have been infected without TbScan
    confirming this, this chapter will supply you with a valuable tool
    to detect undocumented viruses with. We offer you step-by-step
    assistance here in creating an emergency signature that can be
    (temporarily) added to your copy of TbScan.Sig



                                     Page 3

 Thunderbyte signature compiler. (C) Copyright 1993 Thunderbyte B.V.


    -   Collect some infected files and copy them into a temporary
        directory.

    -   Boot from a clean write-protected diskette. Do NOT execute ANY
        program from the infected system, even though you expect this
        program to be clean.

    -   Execute TbScan from your write-protected TbScan diskette with
        the 'extract' option set. Make sure that the temporary directory
        where you put the infected files will be TbScan's target
        directory. With its 'extract' option set, TbScan will NOT scan
        the files but, instead, display the first instructions that are
        found at the entry-point of the infected programs.  Please note
        that we highly recommend you to simultaneously set the
        'session' option of TbScan to generate a log file.

    -   Compare the 'signatures' extracted by TbScan. You should see
        something like this:

                NOVIRUS1.COM    2E67BCDEAB129090909090ABCD123490CD
                NOVIRUS2.COM    N/A
                VIRUS1.COM      1234ABCD5678EFAB909090ABCD123478FF
                VIRUS2.COM      1234ABCD5678EFAB901234ABCD123478FF
                VIRUS3.COM      1234ABCD5678EFAB9A5678ABCD123478FF

        If the 'signatures' are completely different, the files are
        probably not infected, else they have been infected by a
        polymorphic virus that requires an AVR module to detect it.

    -   There might be some differences in the 'signatures'. You can
        use the question mark wildcard ('?') in this case.

        A signature to detect the 'virus' in the example above could be:

                1234ABCD5678EFAB ?3 ABCD123478FF

        The '?3' means that there are three bytes on that position that
        should be skipped.

    -   Add the signature to the data file UserSig.Dat file. Give the
        virus a name in the first line of its entry. Specify the
        following keywords: COM, EXE, INF, ATE keywords in the second
        line.  Enter the signature on the third.

        You would get:

                New virus
                exe com ate inf
                1234abcd5678efab?3abcd123478ff

    -   Execute TbGenSig. Make sure the resulting TbScan.Sig file is in
        the TbScan directory.



                                     Page 4

 Thunderbyte signature compiler. (C) Copyright 1993 Thunderbyte B.V.


    -   Run TbScan a