antivirus 等誤判也太嚴重了吧…

Home » 逆向工程 » antivirus 等誤判也太嚴重了吧…
2016-07-19 逆向工程, 防毒軟體 尚無留言

一支乾淨的程式也能錯判成那個樣子?

Avira(小紅傘)也是如此. 簡直是 “亂鐘仔”……

這些防毒軟體真是反應過頭了, 尤其是卡巴斯基和 Avira,

卡巴斯基太強勢, 像個暴君; Avira 則太神經質, 像個已結婚的女人.

相對來說 Avast 就好多了.

sample-gui-error-vir

程式很簡單, 不過就用個 window 秀一句 “Hello World!”.

sampel-gui

反譯如下:

Graph view:

sample-gui-2

Text view:

; Format      : Portable executable for 80386 (PE)
; Imagebase   : 400000
; Section 1. (virtual address 00001000)
; Virtual size                  : 00000026 (     38.)
; Section size in file          : 00000200 (    512.)
; Offset to raw data for section: 00000400
; Flags 60000020: Text Executable Readable
; Alignment     : default

                .686p
                .mmx
                .model flat

; ===========================================================================

; Segment type: Pure code
; Segment permissions: Read/Execute
_text           segment para public 'CODE' use32
                assume cs:_text
                ;org 401000h
                assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing

; =============== S U B R O U T I N E =======================================


                public start
start           proc near
                push    0               ; uType
                push    offset Caption  ; "Hello World!"
                push    offset Caption  ; "Hello World!"
                push    0               ; hWnd
                call    MessageBoxA     ; Call Procedure
                push    0
                call    $+5             ; Call Procedure
                jmp     ds:ExitProcess  ; Indirect Near Jump
start           endp

LEAVE A COMMENT

  ×  6  =  forty two

這個網站採用 Akismet 服務減少垃圾留言。進一步了解 Akismet 如何處理網站訪客的留言資料