Obfuscating asm code

[Simon 'corecode' Schubert]

Jonathon McKitrick wrote:
: Obfuscation is not easy.  The best stuff I've seen was a combination of 
: intra-command jumps (all over, every second command or such) with 

So here you mean something like:
mov eax,ebx
jmp .next
dw 0xc705
.next
......
Right?  So then disassembling sees the 'dw' value as an instruction, and
garbles the rest of the disassembly, right?
i'd use conditional jumps so that an intellegent disassembler can't 
deduce the execution flow.  but basically that's how i ment it.

: self-modifying code (close-reach for pipeline tricks and out of pipeline 

1.  You have to modify the binary to allowing writing to the executable area,
right?
No, you can mmap() pages with executable rights.

2.  Won't pipeline tricks run differently on different CPUs?
Yes, but some basics will work the same on (almost?) all 386+.

: range) and doubly used commands (depending on how it was jumped to).  If 

So the same series of bytes does 2 different things depending on where you
jump into it?  Ouch.
Right, like above, just instruction flows that run parallel interweaved. 
 Happy hacking :)

: this stuff is all over the binary it can be a really tedious work to 
: figure out how it works.  Oh and sprinkle the code with function calls 
: that never return (breaking common execution flow) and with 

This is harder to follow than call/ret or jmps?
Sure is.  Call/ret = it will come here again.  Jmps = it will jump 
there.  call *%ebx && there roll back two half stack frames (obviously 
you won't use real ebp frames), jump somewhere else, hop back to where 
you started just with a changed overflow flag so that the conditional 
jump will route differently...  Maybe use irets or even SIGSEGV/SIGBUS 
handlers on purpose...  Creativity!

What are you doing anyways?

cheers
  simon
--
Serve - BSD     +++  RENT this banner advert  +++    ASCII Ribbon   /"\
Work - Mac      +++  space for low $$$ NOW!1  +++      Campaign     \ /
Party Enjoy Relax   |   http://dragonflybsd.org      Against  HTML   \
Dude 2c 2 the max   !   http://golden-apple.biz       Mail + News   / \