Editing Polymorphic code (section)

{{Short description|Self-modifying program code designed to defeat anti-virus programs or reverse engineering}}
{{distinguish|Polymorphism (computer science)}}
{{refimprove|date=November 2010}}
In computing, '''polymorphic code''' is code that uses a [[polymorphic engine]] to mutate while keeping the original [[algorithm]] intact - that is, the ''code'' changes itself every time it runs, but the ''function'' of the code (its [[semantics]]) stays the same. For example, the simple math expressions 3+1 and 6-2 both achieve the same result, yet run with different [[machine code]] in a [[Central processing unit|CPU]]. This technique is sometimes used by [[computer virus]]es, [[shellcode]]s and [[computer worm]]s to hide their presence.<ref name="rugha">{{cite thesis |last=Raghunathan |first=Srinivasan |date=2007 |title=Protecting anti-virus software under viral attacks |type=M.Sc. |publisher=Arizona State University |citeseerx=10.1.1.93.796}}</ref>

[[Encryption]] is the most common method to hide code. With encryption, the main body of the code (also called its [[Payload (computing)|payload]]) is encrypted and will appear meaningless. For the code to function as before, a decryption function is added to the code. When the code is ''executed'', this function reads the payload and decrypts it before executing it in turn.

Encryption alone is not polymorphism. To gain polymorphic behavior, the encryptor/decryptor pair is mutated with each copy of the code. This allows different versions of some code which all function the same.<ref name="wongstamp">{{cite journal |last1=Wong |first1=Wing |last2=Stamp |first2=M. |title=Hunting for Metamorphic Engines |journal=Journal in Computer Virology |volume=2 |issue= 3|pages=211–229 |date=2006 |doi=10.1007/s11416-006-0028-7 |citeseerx=10.1.1.108.3878|s2cid=8116065 }}</ref>