2

I created small C program (x86) with this asm code inside main:

__asm
{
    jmp label       // EB 02
    nop             // 90
    nop             // 90
}
label:

Loaded it in IDA (in static mode, so it will use preferred base address), looked for address of jmp label and subtracted virtual address of code section (can be quickly seen in PE explorer). Then I found file offset in executable and patched it, so EB 02 90 90 code sequence became relative unconditional jump 66 E9 <16bit offset to program entry point>.

Note that I am not trying to do something, I just wanted to see how IDA will respond. IDA recognizes the address:

jmp short start

I put breakpoint on first instruction from entry point, once it got hit I resume. To my surprise IDA seems to loose track of instruction pointer (or jumps to different location) and some weird things happen.

At first I tried relative jump outside code section, IDA behaved the same way and I thought it might be something about checking boundaries of code section. But technically we can execute code outside of code section, all we need to do is just put code bytes in global array, manually mark section that contains initialized data as executable and use relative jumps.

I read that IDA does not handle obfuscated binaries. Has it something to do with it? Can someone explain why IDA refuses to follow control flow in this case? Thanks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.