Looks like some obfuscation technique was applied to this piece of code (none of start opcodes were identified properly):
Is it possible to produce manually more readable assembly?
-
@Robert, the section is identified as a code (you can see on screen .text), but neither automatic nor manual reinterpretation ain't successful =(– AseNCommented Feb 4 at 19:07
Add a comment
|
1 Answer
It's difficult to say for sure without the sample, but I suspect that the code has been encrypted/scrambled, and is decrypted on load, most likely by some function which runs before the entrypoint (e.g. a pointer in .init_array or similar).
answered Feb 5 at 20:57
