View Single Post
  #3  
Old 04-22-2004, 19:29
Zigmund Zigmund is offline
Friend
 
Join Date: May 2002
Posts: 24
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 2
Thanks Rcvd at 3 Times in 3 Posts
Zigmund Reputation: 0
nice example... ;)

As you said 'IDA can correctly handle this most of the time'...
That's the main goal of obfuscation - prevent disassembling... But IDA in use of skilled reverser can give very good results in suche way (example you gave)...

Simpliest way (as for me) is to change outputed .asm listing of compilled program and parse it. Hardest and more professional methods : write you own translator and write VirtualMachine.

I'll describe JUNKs technique (one of the sipliest):

we have some asm listing:
--
$L8547:
mov eax, 1
Junk1
test eax, eax
je $L8548
Junk2
mov ecx, DWORD PTR [ebp-64]
mov dl, BYTE PTR [ecx+3]
or dl, 128
--
and Junk1(2) are macroses like:

Junk1 macro
local @@y
jmp @@y
db 0BCh
@@y:
endm

Junk2 macro
local @@1, @@2
push offset @@1
ret
db 069h
@@1:
push offset @@2
ret
db 0E8h
@@2:
endm

db 069h, E8h, BCh... etc - opcodes of long instructions

MOst of times IDA displays real JUNK in disasm

Any other methods? Or tools?!
Reply With Quote