0

So let's say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions. Now, as far as I have seen, they always contain relative offsets as address and don't contain absolute addresses of the destination.

Now, can the relative offset between functions or instructions change if the binary is compiled again with the same compiler? How about with another compiler?

Do you guys think using a call instruction as part of a signature is good?

  • If you are speaking of aligned assembly, then why not. If this is not the case, it is already difficult to identify call instructions into the mess, so it won't work. – perror Feb 6 at 16:34
  • @perror why would the alignment change by recompiling the same program? and why would alignment affect the offsets between functions in the text section? – OneAndOnly Feb 6 at 16:40
  • If instructions are not aligned, then disassembly is quite tedious. Because, you cannot tell if the instructions found by the disassembler are the ones that get really executed by the program. So, you might end up by making a signature based on some misconceptions issued from a broken analysis which may lead to an unpredictable behavior. Therefore, getting a signature on unaligned instruction sets might lead to an untrustable result. – perror Feb 6 at 19:26
0

If there are code changes, it will most likely change between versions.

I would suggest you look at the implementation of FLIRT, in particular here, where they explain how they face this issue.

| improve this answer | |
  • but what about not changing the code and just recompiling the code again with the same or different compiler, or running the code in a different computer, will the offsets between functions change? – OneAndOnly Feb 6 at 16:37
  • Recompiling the code with the same compiler at the same machine will probably yield the same results, but I believe it's not promised. Running the code on a different computer should not change it. Different compiler will most likely yield different results regarding distances between functions. – macro_controller Feb 6 at 17:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.