|
Detecting simple virii is probably simple, whereas detecting complex virii is probably complex. For simple virii detection, you could probably implement a simple byte-sequence scanner. You would have a database of sequences of bytes that you are pretty sure only exist in known virii, and then search for them in files. Using a form of regular expression would be a bit more powerful (one that works well with binary sequences).
Again, complex polymorphic virii will be difficult, if not impossible to detect using these methods (possibly through regex, depending on how polymorphic the piece is).
Developing a heuristic scanner is probably very difficult. I don't think any virus scanner is solely dependent on heuristic analysis anyway.
By the way, there are many uses for platform-independent virus scanners though. Automatic scanning of email attachments is one good example.
This post has been edited by perfectly.insane: 4 Jul, 2008 - 10:14 AM
|