31–37 of 37 posts
> It suggests that whoever coded this part of DuQu was conservative, precise, and wanted 100 percent assurance that the code would work the way they wanted it to work. That limits possible authors to all programmers in the world.
Earlier quoted context omitted.
We do now know however that one compiler flag is all it takes to throw off professional, full-time reverse-engineers. That's got to be valuable to someone.
Well, to be fair, according to the article it was two compiler flags.
this was blindingly obvious to anyone that does anything with compilers and reverse engineering. there are some really big clues: the access to C functions from win32 is direct, with no visible FFI. the generated code has a lot of qualities shared with C code, in terms of control flow and stack usage, and it had a lot in common with the MS C compiler based on how it uses the stack. that it deceived kaspersky this lon…
Earlier quoted context omitted.
Seems legit to me. I've been writing C++ for years and never had to write a constructor...
Then I must say you're either not writing very good code, or you're writing C and calling it C++.
All the code I write is unpredictable when compiled. Such is the life.