5

I have recently came across the following sequence of assembly instructions.

call    ds:WSAStartup
push    ecx
push    edi
mov     ecx, 69E65AC4h
mov     edi, 2776452Ah
pop     edi
pop     ecx
jmp     short loc_ABCD

Please help me make sense of these particular 4 instructions below:

mov     ecx, 69E65AC4h
mov     edi, 2776452Ah
pop     edi
pop     ecx

Why would you move direct values into registers, just to over write them with next 2 instructions?

ADDED: In regards to Rolf Rolles and peter ferrie comments bellow. First off, thank you, guys, for your input. I really appreciate it. What puzzles me the most and seems to be relatively interesting is the fact the the executable in question seems to be clean and clear of code obfuscation of any sort. How relevant is such a small amount of obfuscation for AV defeating purposes? I would assume, not too relevant.

I have also came across the post here on RE What is the purpose of 'mov edi, edi'? . RE user QAZ on the accepted answer mentioned something about support of run time hot patching. Could it be something along those lines?

  • Hi. Could you post the hash of the file? I'd like to check out the obfuscation. Thanks. – alexanderh Jun 2 '13 at 7:43
  • @alexanderh. I might not be understanding something here, but how hash of the file could let you check it for obfuscation? Thanks. – PSS Jun 2 '13 at 13:26
  • because I can use the hash to locate the executable. – alexanderh Jun 3 '13 at 1:05
  • With regards to your addendum: no, that code was not inserted for hot-patching purposes. – Rolf Rolles Jun 3 '13 at 2:00
7

Without further information, it looks like deliberate obfuscation: instructions with no ultimate effect inserted into the code to make it harder to read. I doubt that code was generated by a compiler.

  • I thought about it as well. But it is in line after normal "making total" sense instructions. I don't even see it being any useful for obfuscation purposes. 4 instructions inside perfectly easy to ready and follow assembly. Totally weird :) – PSS Jun 2 '13 at 3:39
  • Post some more of the context, then; some more instructions before and after. – Rolf Rolles Jun 2 '13 at 3:40
  • 1
    Updated. Calls WSStartup and then jumps right after. Nothing extraordinary. – PSS Jun 2 '13 at 3:45
  • 1
    It seems definitely to be obfuscation. The compiler is pretty good about eliminating useless code like that (through non-memory-based liveness analysis, one of the oldest and simplest global data flow analyses) so I doubt that code would be generated by a compiler, except perhaps with optimizations disabled (and even then I am skeptical, since the values are not used in any computation). – Rolf Rolles Jun 2 '13 at 7:29
  • 2
    it's used to attempt to defeat AV signatures, by inserting useless instructions that would otherwise allow a match against the call. – peter ferrie Jun 2 '13 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.