Anti-Virus Coding Requirement

[maxil122]

Hello,

Please, can someone help me to know what is required to made an Anti-virus:

- Which language is more efficient ?

- What's required like Windows Internals / Coding in low level / Good know in x86 family / File systems (PE) / Reversing / Unpacking... ? It will be helpful if you make it clear.

Thanks.

[Killboy]

I'd go for C++, simply because it allows you to go 64bit without much effort.

It's not as fast as MASM (if you code MASM properly that is, poor MASM code is worse than good VB code in that matter ) but allows you to do most low-level stuff within the language specs, even without inline asm.

Other than that you really need to know what youre doing. All the stuff you quoted is pretty important, especially Windows internals for the integration into the OS (drivers etc.) and knowledge of the PE format.

Besides, you'll have to collect all the malware signatures, so yeah, it's gonna be hard

[maxil122]

Thanks Killboy,

I'd go for C++, simply because it allows you to go 64bit without much effort.

It's not as fast as MASM (if you code MASM properly that is, poor MASM code is worse than good VB code in that matter ) but allows you to do most low-level stuff within the language specs, even without inline asm.

I'm familiar with Win32 ASM (MASM package) , but i have a trouble which assembler i'm going to use. Source codes in MASM are more available than other assemblers. Anyway must to take a look in Fasm. I c it a good assembler.

Other than that you really need to know what youre doing. All the stuff you quoted is pretty important, especially Windows internals for the integration into the OS (drivers etc.) and knowledge of the PE format.

It's crystal clear right now, thanks.

Besides, you'll have to collect all the malware signatures, so yeah, it's gonna be hard

The ClamAV database is free, i can start with this one.

Thanks.

[GamingMasteR]

Take a look into HIP Systems .

[maxil122]

Take a look into HIP Systems.

What does HIP stand for? Host-Based Intrusion Prevention System ? What kind of informations can HIP give us ?

[GamingMasteR]

HIPS can give you info about how to make a self-defence system for the AV, also you can detect/restrict suspected behaviors by malwares .

[maxil122]

Ah i see GamingMasteR, thanks a lot.

[M2R]

Well, this is Ansav (An's Anti Virus by 4nV|e) source code. Build in MASM. It ain't best but it's good for starting to learn how to code AV

Note : Sorry for my bad english

ScAnsav.zip

[maxil122]

Exactly what i'm seeking for ! Thanks so much