METAMORPHIC CODE

In computer virus terms, 'metamorphic code' is code that can reprogram itself. Often, it does this by translating its own code into a temporary representation, edit the temporary representation of itself, and then write itself back to normal code again.[1] This procedure is done with the virus itself, and thus also the metamorphic engine ''itself'' undergoes changes. This is used by some viruses when they are about to infect new files, and the result is that the "children" will never look like their parents. The computer viruses that use this technique do this in order to avoid the pattern recognition of anti-virus software: the actual algorithm does not change, but everything else might.
Metamorphic code is more effective than polymorphic code. This is because most anti-virus software will try to search for known virus-code even during the execution of the code.
'Metamorphic code' can also mean that a virus is capable of infecting executables from two or more different operating systems (such as Windows and GNU/Linux) or even different computer architectures. Often, the virus does this by carrying several viruses with itself. The beginning of the virus is then coded so that it translates to correct machine-code for all of the platforms that it is supposed to execute in [2]. It is possible in theory for a metamorphic virus to rewrite the temporary representation of itself into another set of instructions, intended for another computer architecture. The API would also have to be changed.

Contents

See also

Metamorphic viruses

See also

★ Self-modifying code

★ Strange loop

★ Polymorphic code

★ Timeline of notable computer viruses and worms

Metamorphic viruses

★ Simile

★ ZMist