Reverse Engineering Asked by rustam Shirinov on March 7, 2021
Recently I’ve been working on a project. I’ve already got a hint for a problem that I had here: (Garbage Assembly Code Generationat at random offsets)
however, the accepted answer’s solution doesn’t seem to be universal as it didn’t work when I tried it on different sets of data. (Can’t disassemble a piece of code and reassemble it back together with a different assembler expecting the get the original assembly. The project shouldn’t have a problem with code generated from different assemblers).
So after gaving up on the reassembly approach I tried modifying the bytearray with the help of disassembly.
I’m currently trying to learn how I can remap the branch instructions after adding bytes into the original assembly. The original code looks like this:
0x42: 0f b7 2c 17 movzx ebp, word ptr [rdi + rdx]
0x46: 8d 52 02 lea edx, [rdx + 2]
0x49: ad lodsd eax, dword ptr [rsi]
0x4a: 81 3c 07 57 69 6e 45 cmp dword ptr [rdi + rax], 0x456e6957
0x51: 75 ef jne 0x42
|
`---> [BRANCHES] 0f b7 2c 17 movzx ebp, word ptr [rdi + rdx]
0x53: 8b 74 1f 1c mov esi, dword ptr [rdi + rbx + 0x1c]
0x57: 48 01 fe add rsi, rdi
0x5a: 8b 34 ae mov esi, dword ptr [rsi + rbp*4]
0x5d: 48 01 f7 add rdi, rsi
0x60: 99 cdq
0x61: 75 21 jne 0x84
|
`---> [BRANCHES] ff d7 call rdi
After converting the short branch instructions to their near counterparts (part of the obfuscation) I get this:
0x42: 0f b7 2c 17 movzx ebp, word ptr [rdi + rdx]
0x46: 8d 52 02 lea edx, [rdx + 2]
0x49: ad lodsd eax, dword ptr [rsi]
0x4a: 81 3c 07 57 69 6e 45 cmp dword ptr [rdi + rax], 0x456e6957
0x51: 0f 85 ef ff ff ff jne 0x46
|
`---> [BRANCHES] 8d 52 02 lea edx, [rdx + 2]
0x57: 8b 74 1f 1c mov esi, dword ptr [rdi + rbx + 0x1c]
0x5b: 48 01 fe add rsi, rdi
0x5e: 8b 34 ae mov esi, dword ptr [rsi + rbp*4]
0x61: 48 01 f7 add rdi, rsi
0x64: 99 cdq
0x65: 0f 85 21 00 00 00 jne 0x8c
|
`---> [INVALID] (No such address) 0x8c
Obviously, because I converted 2 two-byte jcc instructions to six-byte ones additional 4*2=8 bytes had to be added to the bytearray and that shifted the jcc offsets.
My questions is how can I remap those jcc’s back to their original offsets? I tried keeping track of every set of bytes added to the bytearray and adding/subtracting (depends if the jcc is forward or backward jcc) those bytes from the jcc offsets. But seems like there are a lot of possibilities and I am overwhelmed by those. Can anyone point me in the right direction?
Get help from others!
Recent Questions
Recent Answers
© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP