64 Bit Malware Codes

Question 1

Majority of malware codes today are 32 bit. True or False ?

Answer 1

True

Question 2

Which are most common families of malware for 64 bit code?

Answer 2

1. Browser Helper Objects (BHO)

2. Device Drivers (Rootkits)

Question 3

Where does 32 bit program run on 64 bit systems?

Answer 3

Windows On Windows 64 sub system (WoW64 sub system)

Question 4

Where does the 32 bit registry copy is located in 64 bit systems?

Answer 4

WoW6432Node

Question 5

Name few key differences in 32 bit and 64 bit malware code analysis?

Answer 5

1. All general purpose register have size of 64 bit
2. New Eight registers introduced r8-r15
3. RSP is use to access variable and arguments instead of EBP
4. New addressing mode called as “RIP-relative addressing”
5. Several instruction have letter ‘q’ appended (‘q’ for quadword)

Question 6

Write Access method for r8 for 8 bit, 16 bit, 32 bit, 64 bit?

Answer 6

• > 8 bit : R8B
• > 16 bit : R8W
• > 32 bit : R8W
• > 64 bit : R8

Question 7

In 64 Bit version of code arguments are saved in registers and stack, which calling convention it implies to ?

Answer 7

Fast Call