文件特征码（国外英文资料）.doc

文件特征码（国外英文资料） Now kill soft upgrade, their performance is getting stronger and stronger, killing strength and breadth are greatly improved, more perfect of heuristic anti-virus, make free kill work more and more difficult. Kill soft progress in our little black also do not want to be left behind, we must strive to master the latest free kill skill and trend, at the same time not forget our foundation. And the traditional feature codes kill, and the kill is still in use. So if you want to make our killing Trojan files, modify the file signature is a kind of commonly used methods, today with signature modification technology for everyone to do a summary, to support and care and group of friends, and also to avoid killing beginners is going to learn from friends, my ability is limited, wrong please point out that our common learning progress... One. What is the feature code? We literally mean a string of characters with certain characteristics or characteristics... This string of characters is the basis of the virus. , however, is a professional program is running, in memory to accomplish a specific action, there should be special instructions, a program at runtime, the instruction of the same memory address is the same of the same program, a contiguous address this instruction is the same (), so I capture this address, you can judge it whether this program. Multiple character codes can be extracted in order to prevent the virus from being killed. Thats what we call a compound feature. A. feature codes are mainly divided into: document characteristics, in-memory features, and behavioral feature codes (active feature codes such as ruistar). In the same time, there is a single feature and composite character code. A single feature code is that a few lines of code in a program are used as identification tokens. If you make a change, you can save it. Compound feature code: a code in a program is identified by antivirus software. There is one thing that cannot be done witho