News for hackers. Stuff that matters.

A comment on Anti-Disassembly techniques used by malware.

Re:Anti-Disassembly techniques used by malware by jacquesm on Tuesday December 01, 2015 @03:43PM (#10658586)
Many of these techniques were pioneered by games programmers. The idea was that games should be played, not cheated and the same reverse assembly tricks apply and so the same counter-measures apply as well. One game that I'm familiar with had a never ending Matroshka like structure where each pass through a decryption routine would yield just another pile of gibberish and another chunk of code.

The game took a couple of seconds to start up due to this and it needed tremendous patience to get to the end. I gave up after the 50th or so level of trash, never figured out how many there were, for all I know it would have been the next one, or there may have been a few hundred more. One particularly depressing thing was that at level 40+ or so a message appeared at the beginning of the hexdump: "Does your mother know you're doing this?"...

[ Parent | on HN ]
Re:Anti-Disassembly techniques used by malware by keyle on Tuesday December 01, 2015 @04:49PM (#10659085)
I love cruel easter eggs like that. It worked didn't it.
[ Parent | on HN ]
Re:Anti-Disassembly techniques used by malware by jacquesm on Tuesday December 01, 2015 @05:07PM (#10659239)
Yep :)
[ Parent | on HN ]
Re:Anti-Disassembly techniques used by malware by christoph on Tuesday December 01, 2015 @04:52PM (#10659119)
I have a guess, but after reading that, I would very much appreciate knowing what the game was?
[ Parent | on HN ]
Re:Anti-Disassembly techniques used by malware by jacquesm on Tuesday December 01, 2015 @05:07PM (#10659242)
More fun if you find out for yourself but I'll give you a hint: BBC Micro.
[ Parent | on HN ]
Re:Anti-Disassembly techniques used by malware by AlphaSite on Tuesday December 01, 2015 @05:36PM (#10659415)
Elite?
[ Parent | on HN ]
Re:Anti-Disassembly techniques used by malware by jacquesm on Tuesday December 01, 2015 @06:30PM (#10659724)
I will neither confirm nor deny that :)
[ Parent | on HN ]
Re:Anti-Disassembly techniques used by malware by AimHere on Wednesday December 02, 2015 @02:41AM (#10661542)
The Sinclair Spectrum port of Elite did something like this in the tape loader where, while loading off an audio cassette, it would load a new tape loader code and jump into that, and the load a bit more of the game, before grabbing yet another loader, and so on; it was a pretty effective way of stopping people getting to the game code without extra hardware.
[ Parent | on HN ]
Re:Anti-Disassembly techniques used by malware by ksk on Tuesday December 01, 2015 @06:26PM (#10659697)
Hmm why not just dump the mapped memory when it started up? Or did it do this even after loading?
[ Parent | on HN ]
Re:Anti-Disassembly techniques used by malware by jacquesm on Tuesday December 01, 2015 @06:51PM (#10659826)
After loading.
[ Parent | on HN ]
Re:Anti-Disassembly techniques used by malware by userbinator on Tuesday December 01, 2015 @11:47PM (#10661030)
You may find this interesting - automated ways to unwrap these multilayered packers:

http://marionjy.loria.fr/wp-content/uploads/2015/10/codisasm...

50 levels is pretty low compared to what modern packers have; according to those slides, 100+ is not uncommon, hence the need to automate the process.

[ Parent | on HN ]
Re:Anti-Disassembly techniques used by malware by jacquesm on Wednesday December 02, 2015 @12:17AM (#10661135)
That's a really neat thing they did there. These arms races are always interesting.
[ Parent | on HN ]
Re:Anti-Disassembly techniques used by malware by rasz_pl on Wednesday December 02, 2015 @04:28AM (#10661889)
StarForce (drm) also used VM. Good cracking groups ripped it out, bad/sloppy crackers emulated expected inputs. Emulation was often not enough because VM was a blackbox and you newer knew if you emulated everything VM would expect. This resulted in cracked game breaking few hours deep into the storyline when some late level triggered another hidden check.
[ Parent | on HN ]