While this does not really answer your question, I think a really interesting paper to read is Reflections on Trusting Trust by Ken Thompson. It raises a fascinating point that even if your source code is free of defects (viruses, trojans, etc.), you might still be producing defective executables if your compiler is defective. And even if you rebuild the compiler from clean source code, you can still have the same problem.
Unless you're building your computer from the ground up with your own microchips, hand-assembling your own BIOS, writing your own operating system, compiler, and software, you have to draw the line somewhere and trust that the hardware and software upon which you're building your systems are correct.
If you really want to learn, and are willing to put in the time, your time is probably better spent on google to find then participate in a greyhat community. this topic is highly complex.
if your question is as simple as "what's an easy way to recognize a virus from its source code", well, it probably won't be easy, because there's infinite ways to go about it.
It was started to help hackers and phreakers share information. It is still very popular with hackers today and is considered by many to be controversial in nature.
... And yes, it is important for programmers to understand how hacking and code breaking works, so they can do the best they can to circumvent it in their programs.
发布评论
评论（6）
虽然这并不能真正回答您的问题，但我认为阅读一篇非常有趣的论文是 肯·汤普森对信任信任的反思。它提出了一个有趣的观点：即使您的源代码没有缺陷（病毒、木马等），如果您的编译器有缺陷，您仍然可能会生成有缺陷的可执行文件。即使您从干净的源代码重建编译器，您仍然可能遇到相同的问题。
除非您使用自己的微芯片从头开始构建计算机，手工组装自己的 BIOS，编写自己的操作系统、编译器和软件，否则您必须在某个地方划清界限并信任您构建系统所依据的硬件和软件是正确的。
While this does not really answer your question, I think a really interesting paper to read is Reflections on Trusting Trust by Ken Thompson. It raises a fascinating point that even if your source code is free of defects (viruses, trojans, etc.), you might still be producing defective executables if your compiler is defective. And even if you rebuild the compiler from clean source code, you can still have the same problem.
Unless you're building your computer from the ground up with your own microchips, hand-assembling your own BIOS, writing your own operating system, compiler, and software, you have to draw the line somewhere and trust that the hardware and software upon which you're building your systems are correct.
您可以检查传入数据包上的邪恶位... http://en.wikipedia.org/wiki/邪恶_位
You could check for the Evil Bit on incoming packets... http://en.wikipedia.org/wiki/Evil_bit
如果你想识别恶意软件，你必须知道它是如何工作的。这意味着研究恶意软件并获得生成恶意软件的技能。
我不会在此处提供链接。但它们很容易找到。
If you want to recognize malware, you must know how it works. This means researching malware and aquirering the skill to produce malware.
I won't provide links here. They are easily found though.
如果你真的想学习，并且愿意投入时间，你的时间可能最好花在谷歌上寻找然后参与灰帽社区。这个话题非常复杂。
如果您的问题就像“从源代码识别病毒的简单方法是什么”一样简单，那么这可能并不容易，因为有无数种方法可以解决这个问题。
If you really want to learn, and are willing to put in the time, your time is probably better spent on google to find then participate in a greyhat community. this topic is highly complex.
if your question is as simple as "what's an easy way to recognize a virus from its source code", well, it probably won't be easy, because there's infinite ways to go about it.
您会问“大多数恶意软件想要做什么？”。
这类信息的一个很好的来源是The Hacker Quarterly，它非常主流，您可以在以下位置找到它：您当地的书店，或者您可以在线订阅，我们会将其邮寄给您。
它的成立是为了帮助黑客和网络攻击者共享信息。如今它仍然很受黑客欢迎，并且许多人认为它本质上是有争议的。
本期内容包括：
还有 Wikipedia 上关于黑客的一系列精彩文章 和
...是的，对于程序员来说，了解黑客攻击和代码破解的工作原理非常重要，这样他们就可以尽最大努力在程序中规避它。
You ask "What is it that most malware will want to do?".
An excellent source for this sort of information is The Hacker Quarterly, which is so mainstream, you may find it at your local bookstore, or you can subscribe online to get it mailed to you.
It was started to help hackers and phreakers share information. It is still very popular with hackers today and is considered by many to be controversial in nature.
Contents of the Current Issue include:
There is also an excellent series of articles on Hacking at Wikipedia and on Computer Viruses.
... And yes, it is important for programmers to understand how hacking and code breaking works, so they can do the best they can to circumvent it in their programs.
恶意代码和无意的安全错误之间没有区别。
您可能会问“我怎样才能编写一个没有错误且无法被利用的有用程序”。
正如我们在计算机科学中学到的那样，甚至不可能编写调试器来捕获无限循环，更不用说智能恶意了。
我对具有安全意识的应用程序的建议是进行广泛的代码审查和使用商用静态分析软件。
There is no difference between malicious code and an unintentional security bug.
You might as well be asking "How can I write a useful program that has no bugs and is impossible to exploit".
As we all learn in CS its impossible to even write debuggers to catch infinite loops let alone intelligent malevolence.
My advice for security conscious applications is an ex(p|t)ensive code review and use of commercially available static analysis software.