Anti-Disassembly techniques used by malware

Re:Anti-Disassembly techniques used by malware by seccess on Tuesday December 01, 2015 @04:04PM (#10658753)

An interesting thing worth mentioning here is that many of these techniques work because x86 is a variable length instruction set. A fixed length instruction set (ie, ARM) specifies jump targets as instruction offsets, not byte/word, so you can't jump into the middle of an instruction.

[ Parent | on HN ]

Re:Anti-Disassembly techniques used by malware by ant6n on Tuesday December 01, 2015 @04:13PM (#10658821)

Ah, but Thumb code can use two 16bit values (T32). But If I remember correctly, the first and second such sequence will have disjoint values, so you can't misinterpret the second 16-bit value as the beginning of an instruction. This is, btw, also true for utf-8.

[ Parent | on HN ]

Re:Anti-Disassembly techniques used by malware by anonion on Wednesday December 02, 2015 @01:10AM (#10661303)

With fixed width instruction sets there are similar tricks that trip up IDA's style of analysis. For example, this MIPS code:

        bal 1f
        nop
        .word DATA      /* some data */
     1: lw REG, 0(ra)   /* some destination register */

Despite it being unreachable, it will attempt to disassemble the word after the branch/nop rather than recognizing it as data.

[ Parent | on HN ]