2

I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode.

Example:

 CS:0100 E421           IN     AL,21
 CS:0102 B0FF           MOV    AL,FF
 CS:0104 EB02           JMP    0108
 CS:0106 C606E62100     MOV    Byte Ptr [21E6],00
 CS:010B CD20           INT    20

So I have some questions related to this: Can this trick hide imports? hide x references to functions or strings? Are there any way to fix it? (other than stepping through the code) Edit: I'm using x32dbg

2

Yes, this is indeed possible to employ consistently throughout the entire assembly listing, making manual analysis or adjustments a pain.

Disassemblers are often divided into two categories:

  1. linear sweep disassembly - Linear sweep disassembly is more prone to this type of anti-disassembly, as instructions are analyzed linearly throughout the assembly code, top to bottom, which makes jumping over a single byte screw up the remaining disassembly process.
  2. recursive disassembly - Recursive disassembly if often better (although, not immune) at managing such intentional tricks as well as unintentional complex assembly combinations. Generally speaking Recursive disassemblers are considered to yield better results but be more difficult to implement..

If this is something you're encountering often with a given sample, you may want to consider a different disassembly engine, perhaps one with emphasis on disassembly, such as IDA, as opposed to debugging oriented tool like x64dbg.

1

Bytes are just bytes so it's only how you interpret them makes what they are - so yes, you could potentially hide function call or a string is such way.

How you would deal with that in x32dbg. Click on the opcode that you want to fix, and right click and select Binary -> Edit (or press CTRL+E). You would see a dialog where the bytes of the opcode will be shown. You simple replay the bogus bytes with nop (0x90).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.