# How does malware enter the computer and take control on a binary or machine code level?

Malware can enter a computer in various ways, but I would like to know how it is able to simply use 0's and 1's and machine code to take over a computer and how it can stay hidden from antivirus software.

• This is needs quite a complex answer, and thus is a large question to answer the two separate parts: How they enter and how they remain hidden, which are two different problems. – Brian Tompsett - 汤莱恩 Jun 27 at 8:17

## 1 Answer

This will not be a fully detailed answer, as to explain everything would encompass the material from several years of Computer Science classes. It will need to touch some material from foundational level through to Master material; but not in full detail. What follows would be a road map, or guide to possible explanations (there being more than one way to compromise a machine and stay hidden).

1. All code executed by a computer is ultimately a sequence of 0's and 1's. Although most computer code (including malware) may be written in various computer languages, ultimately the computer memory will contain a translation of that program into a binary pattern in memory. If a computer processor encounters this binary sequence it will perform those actions instructed by the programmer.
The memory will contain anything that needs storing, which can be both data or instructions (known as von Neuman architecture).
This would be covered in a computer architecture course, for example.

2. The hardware features that offer protection, such a virtual memory page registers, memory page protection in hardware, such a read only, execute only properties and how they are used in operating systems.
This might be in a computer systems or operating systems course.

3. The translation of computer programs into sequences of binary is called compilation. It also covers a degree of language theory and the study of parsing and code generation.
This might be covered in a compiler course.

4. The different kinds of computer languages and the runtime protections they offer, such as exception handling (try ... catch) and the varieties of languages that do not have run time protection (managed and unmanaged code, for example).
This might be in an advanced programming course, or comparative languages course.

5. The mechanism of the computer stack can be integral to understanding how a machine may be compromised. How computer languages use a stack; the call and return mechanism needs to be explained in order to later understand how that can be usurped to gain control of execution.
This might be covered in a compilers or systems course.

6. The layout of computer memory in a virtual memory model of an operating system needs understanding so the relationship between the positions of code and data in an executing computer program is clearly understood.
This would be in a compiler or computer systems course.

7. Buffer Overflow is a very common way of performing compromise payload injection. One would need to understand what a buffer overflow is, why it occurs in existing computer code (based on the above topics).

8. One would then need to understand how a malware payload might be delivered using buffer overflow mechanisms into a vulnerable system.

9. Understanding how malware might remain hidden you would need to understand how we find malware. You would at least need an understanding of computer POST (Power On Self Test), MBR (Master Boot Record), Root Kits, data encryption and the general details of an operating system.

But I have only scratched the surface, but at least I may have given you a study guide.