29a-7.016

从29A上收集的病毒源码

GENETIC PROGRAMMING IN VIRUS
----------------------------

I wanna comment here some ideas i have had. They are only ideas...these ideas seems very
beautiful however this seems fiction more than reality.

Evolutionary Systems
--------------------

We can find in the nature some biological systems that can response to a stimulus, learn from
enviroment and training,... however we can find in the nature systems that improve their 
capabilities with evolution of specie.
Evolution works in this manner: descendants are generated from their progenitors. Descendants
are similar to their progenitors, however they have some modifications.Using a natural selection
process only descendants that was addapted better to environment survive. They will have more
descendants and again it will be used a natural selection process.
With these characteristics (natural selection and progenitors generating more descendants) is
anough to generate descendants more poweful with generations.
We can see a analogy to understand this fact better:

We have a environment with valleys,mountains and plains. We have some individuals. A individual
is more powerful than others if he is over a location with more high than others individual's
locations. Descendants will be generated using characteristics of two individuals,their 
progenitors. Descendant's location will be in the middle of the line that links both progeni-
tors's locations.If this middle point has more high than progenitors's locations we have a 
descendant more poweful than progenitors.A selection process will eliminate individuals with
less high.With evolution,we will have individuals placed in higher locations.This method could
be used to find summits for example.

Genetic Programming
-------------------

Genetic programming is based in these terms. We have a set of operations(elements of code
considered as a unit). With these operations we have a first generation of programs. We 
use a selection process to select programs that adapts better. We search that programs 
that solve our problem more nearly posible.For evaluating a program we execute it over 
a set of training inputs,and we see results,and we see what program is nearer to the 
best solution.Then,we eliminate the worse programs. With that programs that survived, 
we generate a new generation of programs with two process,mutation and crossing. With 
mutation we generates descendants from a progenitor, changing a piece of code by other
piece of the set of operations. Crossing is more effective. With crossing we generates
descendants crossing two progenitors: we select randomly a operation of a progenitor and
we change it by other randomly selected operation of the other progenitor.Usually,its used
crossing more frequently and sometimes is used mutation,less frenquently,both combined.

Well,you can search a lot of articles about genetic programming in internet.I have commented
a few what is this for now speaking how genetic programming could be used in the virus world.


Virus
-----

Since i read something about genetic programming i have been thinking how it could be used
in the virus programming. Virus has some similaritys with genetic programming. When a virus
infects a file it is generating a descendant. However, descendant is identical to progenitor.
Yes, a polimorphic or metamorphic virus is different to progenitor, however it works in the
same manner of its progenitor.
To use genetic programming in virus world we must see a virus as a set of operations.This
operations arent xor,call,jmp... Im refering to more high level operations. For example, we
could have a operational element that changes current directory or other element that 
infects .exe files or .hlp or others. A worm element. A payload element,....
These elements of code must works by itself, in any direction of memory. A program will be
composed by these elements.We could name these elements blocks. I think this blocks could
be similar to pieces of code defined in siilex article in 29a #6. Pieces of code that could
be chained to do a complete program.
For example,we have a block with ability of changing current directory. We have too a block 
that infects .exe files with itself and others blocks in its current infected file. And too,
we have a block with antidebbuging trickz and a block with a payload.We will generate randomly
programs with 6 blocks.We could have a lot of posibilities:

1