Tell me more ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.
up vote 5 down vote favorite
2

C# and Python can't compete with C and Assembly when writing such tools is the need. I left C many years back and I don't think I will be able to cope up so fast.

Is it possible to write Anti-Virus and Intrusion-Detection tools using C# or Python? If yes, what things to learn along side and where I can find good resources on this?

share|improve this question
I think antiviruses must access the full memory isn't? – user2567 Jan 2 '11 at 11:46

4 Answers

up vote 1 down vote accepted

It is possible, but you may run into a few problems. For starters, are you going to use signiture based detections as the method of detecting malicious files? How will you update these? Modern AV applications have literally 1000s of these signitures used for detections that are updated daily.

Also, I'd imagine the actual process of scanning each file and checking it against each file on the system would take a long time. Most AV applications nowadays use whitelisting or hueristic based scanning to reduce scan times. Your application may also be limited to 'On Demand Scanning' (user manually kicks off a scan) with no support for 'On Access Scanning' (scanning a file immediately once it is invoked).

Finally, things like boot sector scanning and detection of rootkits may not be possible.

share|improve this answer
Actually I mean to write simple removal tools for a handful of similar malwares. – RPK Jan 2 '11 at 21:55
That's a little easier - provided you know the behaviour and characteristics of the malware you're dealing with in order to detect it effectively. – Jimmy C Jan 3 '11 at 12:16
up vote 4 down vote

Antivirus programs just iterate though a filesystem and do pattern matching. You could write an antivirus program in any programming language that can do both of these things.

share|improve this answer
Ya, but for pattern matching I need to identify whether the file is encrypted or not. – RPK Jan 2 '11 at 9:02
1  
It's impossible to say conclusively whether a file is encrypted or not. – dan_waterworth Jan 2 '11 at 9:04
5  
And further, those anti-virus programs that do live monitoring (eg scanning an EXE when it is run) have to poke very low into the OS to grab the file and scan it before it is actually loaded into memory and executed. This requires some pretty low level stuff, and I suspect that things like c# [interpreted, high level, and some distance away from the guts of the OS] will struggle. Not neccessarily impossible, but certainly difficult. – quickly_now Jan 2 '11 at 9:05
2  
@quickly_now: C# is not interpreted, it is compliled to an intermediate language (IL) that is then JIT compiled to native at load time (this is how Java now works -- initially the JVM intermediate language was interpreted). However the requirement for a runtime system never designed for kernel use blocks its use for live monitoring as you say. – Richard Jan 2 '11 at 9:49
1  
@dan_waterworth - just take Perl programs for example. They look encrypted most of the time ;-) – Rook Jan 2 '11 at 20:10
show 4 more comments
up vote 2 down vote

Yes although most AV programs make use of filesystem filter drivers for which you are going to have to use C. Writing the drivers can be a lot of fun though if you try it.

File System Filter Drivers

share|improve this answer
up vote 1 down vote

First of all you need to understand how the viruses behave. The programming of the anti-virus GUI is not a complex task and can be written using any language, but getting the definitions of hundreds of thousands of virus' is a very big task. And, as it was already mentioned, you should write a smart and fast pattern matching

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.