anonion
Re:Anti-Disassembly techniques used by malware
on Wednesday December 02, 2015 @01:10AM (#10661303)
With fixed width instruction sets there are similar tricks that trip up IDA's style of analysis. For example, this MIPS code:
bal 1f
nop
.word DATA /* some data */
1: lw REG, 0(ra) /* some destination register */
Despite it being unreachable, it will attempt to disassemble the word after the branch/nop rather than recognizing it as data.