How to implement an Antivirus for Symbian OS ?

[Apricot]

As a software designer of a security company I am going to design an Antivirus for Symbian OS. There are some points that I'm not sure about:
1/ To develop a file system hook plugins, do I need Carbide OEM Edition or a more affordable edition is enough ?
2/ A very important issue: what do I need to debug a Symbian executable, e.g. malware executables ( *.exe, *.dll, *.app, etc ) which AREN'T built with Debug Symbols ?
3/ Is there really NO solution to the above problems on Symbian OS prior to v9.0 ?

[mateen_maldar]

not sure about:
1/ To develop a file system hook plugins, do I need Carbide OEM Edition or a more affordable edition is enough

You can use any of the avalible IDE but OEM will have all privilages like making deamon, plugin and fsy etc..?

2/ A very important issue: what do I need to debug a Symbian executable, e.g. malware executables ( *.exe, *.dll, *.app, etc ) which AREN'T built with Debug Symbols ?

U can use ondevice debug to do target debugging..

3/ Is there really NO solution to the above problems on Symbian OS prior to v9.0 ?

There exists a solution writing your own fsy for writing antivirus scanning..

Regards,
Mateen Maldar

[Apricot]

There exists a solution writing your own fsy for writing antivirus scanning..

Regards,
Mateen Maldar

Well, according to this thread http://http://live.sdnhost.com/forum...=124&tstart=15, I can't un-mount C: and re-mount it, so the AntiVirus can't protect C:, which is very bad.

[Apricot]

How do we debug a Symbian executable, e.g. malware executables ( *.exe, *.dll, *.app, etc ) which AREN'T built with Debug Symbols on Symbian OS prior to v9.0 ? I tried gdb but that didn't seem to work.

[wizard_hu_]

1/ To develop a file system hook plugins, do I need Carbide OEM Edition or a more affordable edition is enough ?

The IDE just helps with comfort-services such as on-target debugging, etc. The capabilities are not coming from the IDE you use.

2/ A very important issue: what do I need to debug a Symbian executable, e.g. malware executables ( *.exe, *.dll, *.app, etc ) which AREN'T built with Debug Symbols ?

Debugging and tracking/analysing are different things.
Debug: you are searching for programming errors in a known code. Presence of debug symbols are making this more comfortable, since you do not have to stare at a strange assembly code (which is really running), instead you can track happenings in your known, C++ source code.
Virus scanners obviously do not rely on debug symbols, they are analysing the program on the machine-language level and/or search for binary patterns of known viruses.

3/ Is there really NO solution to the above problems on Symbian OS prior to v9.0 ?

These things do not depend on the OS version, and they are not problems at all.

[shrosenzwe]

First step is, get developer certificate with All Files capability. You need it for antivirus, and you won't get it that easy. Trust me. Nokia never granted me MultimediaDD (SE did, after a week of emailing back and forth, and calling people in SE that are pushing for joint ventures), and my company is a symbian platinum partner. MultimediaDD is 2 levels of trust below All Files. Getting it will probably be harder then actually writing the application. If you get it, it means that Nokia trusts you enough to put all of nokia phones at your mercy.

But, you don't have to wait for all files. You can start writing your code in emulator, you don't need certificates to get capabilities in emulator, you can just grant them yourself.

[koshu]

Probably the best way to implement a AV scanner in Platform security enabled OS versions would be to hookup with SIS installer framework.
And as the above poster stated, good luck on getting AllFiles capabilities.

If I had to guess I'd think Nokia will make a deal with one company to provide AV scanner to ensure that viruses won't leak in from scanners.

[Paul.Todd]

Actually, for an FSY you need TCB, you also need to be a Symbian Platinum partner (DevKit licencee) and a Pro Member.

An FSY is the incorrect solution anyway, you need to use a file server extension (pxt).

Practically speaking, virus's are going to be very hard to write. Spyware/adware however is a lot easier.

[Apricot]

The IDE just helps with comfort-services such as on-target debugging, etc. The capabilities are not coming from the IDE you use.Debugging and tracking/analysing are different things.
Debug: you are searching for programming errors in a known code. Presence of debug symbols are making this more comfortable, since you do not have to stare at a strange assembly code (which is really running), instead you can track happenings in your known, C++ source code.
Virus scanners obviously do not rely on debug symbols, they are analysing the program on the machine-language level and/or search for binary patterns of known viruses.These things do not depend on the OS version, and they are not problems at all.

Thank you for your reply.
Please excuse me for not expressing my points clearly enough. When I asked about debuging malware executables , I meant the how our malware analysts debug malware executables. Of course our software engineers have to debug the AV on-device but that's point 1 I mentioned and it is solved :)
So we really can't debug malware executables on Symbian OS prior to v9.0 ?

[wizard_hu_]

how our malware analysts debug malware executables.
[...]
So we really can't debug malware executables on Symbian OS prior to v9.0 ?

I have absolutely no idea about the instruction set, and debugger support of an ARM CPU. However on lower version Symbian OS releases you have more control over the whole device, so I think it should be possible to debug code if you really want.
On the other hand, you can use disassembled code for static analysis, CPU emulators, and if someone decides to build a business on this, she/he can establish some partnership with the device manufacturers, and get R&D or other customized builds.

[jimgilmour1]

Practically speaking, virus's are going to be very hard to write. Spyware/adware however is a lot easier.

Paul Makes a good point here. I got a virus from a program which aggregates web pages. These aggregated pages have java script spyware which the program did not detect and passed onto my E61 device. The result was that the pointer moves around standby icons when the device is idle.

The E61 kept saying popups have been blocked and of course you quite often got sent to the wrong page!.

Basically I deleted the App sis and the data files (aggregate web page files).
and cleared the browser cache the spyware and popups disappeared.

So how would virus checker find this problems how could you find java script applets from pages using c++?. The major problems is blocking unauthorized access to 3G network ports from expensive downloads of pop up pages.


Good Luck
Jim

[Paul.Todd]

Hey Jim,

Was this a Symbian Signed application?