Question

4.

The following code fragments show a sequence of virus instructions and a metamorphic version of the virus. Briefly describe the effect produced by the metamorphic code.

Answer 1

Metamorphic virus :

• The metamorphic virus changes with each infection.
• Virus is a computer program or part of code that is loaded onto the user computer without user knowledge and executes against the user's wishes. Virus can also duplicate the data in the user's computer.
• It may change the program's actions as well as their appearance.

Code fragments:

Original Code	Metamorphic Code
mov eax, 5	mov eax, 5
add eax, ebx	push ecx
call [eax]	pop ecx
	add eax, ebx
	swap eax, ebx
	swap ebx, eax
	call [eax]
	nop

Effect produced by metamorphic version:-

The effect produced by metamorphic version is as follows,

• It changes the original code to interrupt the signature but it does not affect the semantics of the original code.
• In the above table, the semantics of the original code is not affected. But, it interrupts the signature of the original code by changing the behavior, which is highlighted in the metamorphic code.
• The useless instruction in the metamorphic code are the second, third, fifth, sixth and eighth.

Note: Could you please consider my effort on this work and give up vote. Thank you :)