So, You Want to Build an Anti Virus Engine
summary
A small antivirus stack is built: Clock engine plus a Delphi bytecode loader and rule generator that implement an Android “crime” scoring system borrowed from criminal law — eight principles, a five‑stage order theory and exponential stage weights — with thresholds computed from summed proportional evidence. The loader simulates CPU registers with register objects to trace values across functions, recovers native API call sequences through parent‑function backtracing to defeat obfuscation, and successfully detects behaviors in both non‑obfuscated and obfuscated samples using a seven‑step rule pipeline.
AI-written summary · about
chapters (7)
- 0:00Introduction to talk
- 0:29Malware scoring system overview
- 1:35Criminal law inspired scoring
- 10:11Delphi bytecode loader design
- 18:35Malware analysis with Quark Engine
- 25:21Detection rule generation strategy
- 28:56Future works and closing
related talks
45m"Advanced Malware Threat: handling obfuscated code using..."
28mAVLeak: Fingerprinting Antivirus Emulators for Advanced Malware Evasion
51mFull System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware
29mA Day in the Life of a Mobile Malware Reverse Engineer
26mOne Packer to Rule Them All
53mAndroid: He protec, but he also attac
41mAndroid malware forensics
26mWhen Models Write Malware: Defending Against On-demand Exploits