|
Nice work, particularly for an 18 year old way down there in Madurai (rural I guess from reference to Karuppu Sami in the .h headers).
I just looked over your code and see that you are (1) looking for a known malware hash in your local database ksgmprh.db SQLite file (2) looking for any upx packed exe's (3) looking for any suspicious strings in the executable, but I couldn't find what database of strings you are using for that (and didn't see an obvious reference in your unit-tests.cpp (I thought maybe you had your custom strings in the SQLite database, but didn't see where else you had the known file hashes--maybe you haven't fully implemented the suspicous string database yet?).
I see you are proficient in Python. I might need your help porting the old Unix diction and style c code to Python 2.7 (if I can't compile it locally with MSVC scraps).
|
|
|
|
|
|
I am pleased you were impressed with my "Doxing tool," which is merely my ancient brain, grin. I'm a retired engineer (among other things) and do research in various fields as my interest leads me. I note that it is becoming more difficult to do research since some of the major search engines are using more "artificial intelligence," which is about the level of a Family Feud (a banal television show in the US that rewards people for mentally recalling phrases used in daily life) query-response engine, so effectively impairs my ability to construct and pursue relatively unique queries (except at Google Scholar, which fortunately has not been impaired yet).
Thanks for the specific target in your code where I can look at your internal exe string pursuit (and the explanation of where you are currently in that regard). I forgot to add in my last communication that you might find it useful to calculate the file entropy rather than (or as an additional tactic) simply look for the upx packing signature, since malware compression may use different methods of compression but they all tend to cause a high file entropy (typically malware lacks the magic byte identifier and is high entropy as a general suspicion index).
As far as extracting strings from binary, I expect looking at your own string method (which you kindly point out can be general purpose if the malware search portion is omitted) will be a nice tutorial (I did software development with assembly and C in the early 1980's so find myself having to brush up on technique when I actually jump into development or analysis again).
I did look at Madurai more closely than my guess about which areas were more likely to find Karuppu Sami attractive/familiar. It indeed appears to be a local hub of activity, though there does seem to be some need for more employment to raise the standard of living for everyone there. The layout around the central temple is really cool. I am familiar with the Gita and many of the Upanishads (and enjoyed a cinematic enactment of the Mahābhārata, it being a little too lengthy to read).
After I responded yesterday I decided to analyze the sourceforge binaries for the unix diction and style independently reproduced by Michael Haardt in 2007 and they had the proper dates and contents (in the zips) and the file reputation was good (you can use virustotal and general search to verify) so I went ahead and unpacked them and set up a directory on my Windows machine and tested them on some text. They worked so I am pleased not to have to compile them from Haardt's c source or port to Python (so won't be starting a github project on that for now).
As far as doxing folks, all of the major search engines do point at me if you
follow ancientzygote music trail (but I am indeed ancient and largely irrelevant to this present world, where I fear Vishnu will be replaced by Shiva soon).
|
|
|
|
|
|
No, I have not lived in India for a while. I will try to make this reply brief since I believe codeproject would prefer I just connect a blog here rather than write lengthy articles in this venue. There is an excellent article from 1982 describing the persistent paradox of psychic phenomena from an engineering perspective (Proceedings of the IEEE, Vol 70, No 2, February 1982 by Robert G Jahn). Perhaps that is incidentally relevant to my quick study on India, or I simply have an effective neural search facility in my "meat computer," grin.
Regarding my reference to file entropy, I did not use the Dr. Fu article, but rather one written by Rob VandenBrink, a consultant at Compugen writing for SANS Technology Institute ("Using File Entropy to Identify Ransomwared File").
|
|
|
|
|
VISWESWARAN1998 wrote: Many of the programmers will have either one of the dreams i.e creating an antivirus or creating their own operating system. Well, I had the former dream that creating an anti-virus of my own. After many months of hard work, I finally made an antivirus which meets most of the standard requirements for an anti-virus., It is a portable solution and it has many features included along with it
When I was 18 ... I dreamt of distributed system architectures (and I was good at it  )
I think instead of creating your own wild product, I would suggest to contribute your effort to an existing open-source product, called ClamAV. We use it in Postfix installations, so do a million others.
Beauty cannot be defined by abscissas and ordinates; neither are circles and ellipses created by their geometrical formulas.
Carl von Clausewitz
Source
|
|
|
|
|
Sir, I know about ClamAV it is not too much for windows, It primarily concentrates on *nix operating systems. Yes,there is Windows specific ClamWin but is it not drawing too much of attention. Another free products will perform very well than that!
I don't know what to do so I made my project as open-source. I made a mistake, I've have concentrated only on how the project can be implemented and totally forgetting what I am going to do for the resources.
But the project is not dead yet! I dont know why I can't move away from this. I thought I would start my career by creating an AV company of my own at-least I expect to get job in some other AV company
|
|
|
|
|
I don't know what did you make or is it any good, but I admire hard work.
Making your own program(s) is good attitude for a 18 years old student.
Just keep on practicing and some day some people will pay you for it. 
|
|
|
|
|
Thank you sir for your kind encouragement!
|
|
|
|
|
Anyone using it? I've just updated my Fossil Q and am...underwhelmed.
Actually it made me feel crazy old because the fonts in the watch face widgets are so small as to be unreadable.
I want to like it so much. I really do.
cheers
Chris Maunder
|
|
|
|
|
Chris Maunder wrote: feel crazy old
You have a fossil! What did you expect?
Skipper: We'll fix it.
Alex: Fix it? How you gonna fix this?
Skipper: Grit, spit and a whole lotta duct tape.
|
|
|
|
|
Yeah - I walked into that one, didn't I
cheers
Chris Maunder
|
|
|
|
|
Your mistake was picking the wearable technology version.
What you really wanted was the hidden version, Android Where 2.0
| Ravings en masse^ |
|---|
| "The difference between genius and stupidity is that genius has its limits." - Albert Einstein | | "If you are searching for perfection in others, then you seek disappointment. If you are seek perfection in yourself, then you will find failure." - Balboos HaGadol Mar 2010 |
|
|
|
|
|
If a man has a foot fetish and cheats on his wife, does that mean he got off on the wrong foot?
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
|
|
|
|
|
And if his wife finds out, he may need athlete's feet!
If you have an important point to make, don't try to be subtle or clever. Use a pile driver. Hit the point once. Then come back and hit it again. Then hit it a third time - a tremendous whack.
--Winston Churchill
|
|
|
|
|
Software Zen: delete this;
|
|
|
|
|
I think you nailed it.
/ravi
|
|
|
|
|
I dunno, after seeing his pun my eyes need time to heel.
"the debugger doesn't tell me anything because this code compiles just fine" - random QA comment
"Facebook is where you tell lies to your friends. Twitter is where you tell the truth to strangers." - chriselst
"I don't drink any more... then again, I don't drink any less." - Mike Mullikins uncle
|
|
|
|
|
Ha ha! After all these years, I guess the shoe's on the other foot now!
/ravi
|
|
|
|
|
Have you no sole?
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
|
|
|
|
|
I know... that socks, doesn't it? 
/ravi
|
|
|
|
|
It means he'll have to sleep in the yard, with the dog.
I wanna be a eunuchs developer! Pass me a bread knife!
|
|
|
|
|
If his Mrs. finds out, perhaps she'll be angry ankle him. Heel run - but where toe? Her finding out will certainly be her cuticle him
| Ravings en masse^ |
|---|
| "The difference between genius and stupidity is that genius has its limits." - Albert Einstein | | "If you are searching for perfection in others, then you seek disappointment. If you are seek perfection in yourself, then you will find failure." - Balboos HaGadol Mar 2010 |
|
|
|
|
|
Required XKCD[^]
What do you get when you cross a joke with a rhetorical question?
The metaphorical solid rear-end expulsions have impacted the metaphorical motorized bladed rotating air movement mechanism.
Do questions with multiple question marks annoy you???
|
|
|
|
|
All's I can say is that she had the prettiest feet I've ever come across. ![Badger | [badger,badger,badger,badger...]](https://codeproject.global.ssl.fastly.net/script/Forums/Images/badger.gif)
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
you analyzed our languages and cultures which I have not even revealed a single info anywhere here. I doubt that you lived in India for a while.
