Timeline for Is It Possible for a Universally-Executable Virus to be Written in Binary?
Current License: CC BY-SA 4.0
20 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 10, 2019 at 17:07 | comment | added | Patricia Shanahan | @Yakk Having written compilers, I am reasonably familiar with the concepts of program and executable. The question seems to me to be asking for the virus to be a single executable "in binary code". | |
| Nov 10, 2019 at 15:12 | comment | added | Yakk | @PatriciaShanahan A program is not an executable. A virus is a program. A program can be an executable, but this answer assumes that all programs are single executables. I understand why someone might think that, but this question does not demand "a single executable". Now the second paragraph is completely off base (in the question), but that is another thing. | |
| Nov 10, 2019 at 14:53 | comment | added | Patricia Shanahan | @Yakk It is certainly possible to write a family of viruses with versions for different computer types. That is not what the question asked for. | |
| Nov 9, 2019 at 17:21 | comment | added | Yakk | Man, this is just wrong. A failure of imagination? I can write a virus that infects an x86 computer. When it finds a different architecture, it simply transmits different execution code to it, and the other computer runs it fine. When reexposed to an x86, it would emit the original executable code. The executable is just an expression of a program; the program (the virus) can emit different executables at different times. After all, it is getting from one computer to another, in that transmission it doesn't have to stay the same. And to be extremely clear, this exists in the wild. | |
| Nov 7, 2019 at 13:05 | comment | added | Chronocidal | @Ryan_L Considering that "Polyglot" is a common challenge on Code Golf, I'm sure there is probably a way to trick the computer into ignoring "junk" data and running the "valid code" - but you're right that it wouldn't be truly universal, just for the specific systems it was targeted at. | |
| Oct 4, 2019 at 17:09 | comment | added | potestasity | @Ryan_L Your answer makes no mentions of ELFs, PEs, loaders, binary formats etc. You just strongly imply you couldn't make a string that decodes as valid instructions on two different architectures, which is wrong. Your comment about reading the paper more carefully is somewhat ironic; if you had read it, you'd have stumbled upon phrases such as: "We stress that, in our approach, we are generating platform-independent programs that have semantically identical outputs by construction." | |
| Oct 4, 2019 at 16:03 | comment | added | Ryan_L | @potestasity Read the paper more carefully. They explicitly state that, while the program will run on the 3 architectures listed, it will have different run-time behavior. This is conceptually no different than the fact that any string can be encrypted into any other string. This means that it's not a solution for the question. The program may be a virus on x86, but it'll be something else on MIPS./ | |
| Oct 4, 2019 at 15:14 | comment | added | DrMcCleod | @Renan I wonder if they tried setting the instruction set flag to 0x00 to see if it the application still ran. I'll try it later on my x86-64 box. Anyway, I would say that was close enough for sci-fi. | |
| Oct 4, 2019 at 14:55 | comment | added | The Square-Cube Law | @DrMcCleod I know that paper. That's a non-solution. Check section 6.3 page 10. "Note that the Figure shows a complete ELF file generated from our PI generator. In order to run on each architecture, we changed the one-byte ELF header of a CPUtype field to the appropriate value." So, not the same binary for every architecture. | |
| Oct 4, 2019 at 14:50 | comment | added | DrMcCleod | @Renan users.ece.cmu.edu/~sangkilc/papers/ccs10-cha.pdf | |
| Oct 4, 2019 at 14:43 | comment | added | The Square-Cube Law | @DrMcCleod provide me with a binary that will run just the same on x86 and ARM and we'll talk. | |
| Oct 4, 2019 at 14:40 | comment | added | DrMcCleod | @Renan Except that it is wrong. | |
| Oct 4, 2019 at 13:38 | comment | added | potestasity | At best, this answer could be true by chance, but doesn't seem to seriously consider the problem, as evidenced by the examples. Here[1] is a paper about writing platform-independent program, where the authors produce binaries that run on x86, MIPS and ARM. The way this answer poses the issue (e.g. the last sentence) is naive. [1] users.ece.cmu.edu/~sangkilc/papers/ccs10-cha.pdf | |
| Oct 3, 2019 at 16:11 | comment | added | Aetherfox | @Ryan_L The attacking computer should expect some response from the target computer that indicates success. (This will be the first task for the new virus once in place) If it times out before getting a response, we can assume the first line never ran because we we targeted the wrong architecture. The attacking virus guesses a new type of hardware, injects it, and waits again for a response. Note that the virus doesn't need to be able to run the code it injects. | |
| Oct 3, 2019 at 15:43 | comment | added | Ryan_L | @Aetherfox That's not a solution. How does it even start? I mean, the first line of code must be written for some specific architecture; what happens if the target happens to use something else? The first line never runs, and now it never dumps any of those packages. | |
| Oct 3, 2019 at 13:25 | comment | added | Aetherfox | I agree with your answer generally, but given enough knowhow, it is possible to write a virus that can infect everything known. The virus would have to have many 'packages' that it can dump on to the system once it knows the system it is trying to spread to. Each iteration carries a MIPS version and an x86 version. Stupidest case it can complete the x86 injection. If that fails, it attempts the MIPS injection, etc, until one sticks and reports back success. Then it loads on the other packages so that it can continue to spread to different machines. | |
| Sep 24, 2019 at 13:34 | vote | accept | overlord | ||
| Sep 24, 2019 at 8:48 | comment | added | Starfish Prime | Even beyond the instruction set there are little things like endianness which mean that two different machines can't even agree on what a number looks like. | |
| Sep 24, 2019 at 1:00 | comment | added | The Square-Cube Law | This is the only correct answer so far. | |
| Sep 24, 2019 at 0:36 | history | answered | Ryan_L | CC BY-SA 4.0 |