News for hackers. Stuff that matters.

anonion

Re:Anti-Disassembly techniques used by malware on Wednesday December 02, 2015 @01:10AM (#10661303)
With fixed width instruction sets there are similar tricks that trip up IDA's style of analysis. For example, this MIPS code:

        bal 1f
        nop
        .word DATA      /* some data */
     1: lw REG, 0(ra)   /* some destination register */
Despite it being unreachable, it will attempt to disassemble the word after the branch/nop rather than recognizing it as data.