Episode
064 - MS-DOS Malware Chose Me
- Published
- May 21, 2023
- Duration seconds
- 4094
- Processing state
processed- Canonical source
- https://unnamedre.com/episode/64
Actions
POST https://stenobird.com/v1/public/podcasts/unnamed-reverse-engineering-podcast-752753/episodes/064-ms-dos-malware-chose-me/transcription-requests
Idempotently request low-priority transcript generation for this episode.GET https://stenobird.com/podcast/unnamed-reverse-engineering-podcast-752753/064-ms-dos-malware-chose-me.md
Read the agent-friendly Markdown representation of this episode resource.
Summary
A deep dive into the fascinating world of 16-bit MS-DOS malware reverse engineering. The episode explores the technical legacy of early viruses and the creative, often artistic, methods used by authors to evade detection.
Topics
- Reverse Engineering
- MS-DOS
- Malware Analysis
- Assembly Language
- Polymorphic Code
- Embedded Security
- 16-bit Computing
- Cybersecurity History
Highlights
- Main idea: The technical lineage connecting 16-bit DOS exploits to modern BIOS and embedded security vulnerabilities
- Technical insight: How polymorphic engines use functional entropy to generate unique decryptors and evade signature-based detection
- Practical takeaway: The importance of studying assembly-level primitives to understand low-level memory manipulation and boot sector manipulation
- Failure mode: The limitations of modern antivirus when faced with highly variable, generation-based malware patterns
- Creative insight: The intersection of malware development and the demoscene, where malicious code often utilizes advanced graphics routines
Chapters
1:00Introduction to 16-bit Malware Research: Nika introduces their background in hardware security and their ongoing research into MS-DOS era malware.6:00The Legacy of the BIOS: A discussion on the connections between legacy 16-bit samples and modern exploit development in embedded systems.11:00Assembly and the Art of the Virus: Exploring the prevalence of assembly language in early malware and the tools used for reverse engineering.21:00The Impact of Malware Research: Reflecting on how studying historical malware informs modern security perspectives and research processes.26:00Creative Destruction and Polymorphism: Analyzing the use of functional entropy and polymorphic techniques to bypass antivirus byte signatures.47:00Graphics and Boot Kits: Discussing the use of VGA mode 13h and graphics routines within 16-bit boot kits and the demoscene.52:00Modern Detection and Tools: A look at how modern Windows Defender handles legacy threats and a discussion on favorite RE tools.