0

So let's say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions. Now, as far as I have seen, they always contain relative offsets as address and don't contain absolute addresses of the destination.

Now, can the relative offset between functions or instructions change if the binary is compiled again with the same compiler? How about with another compiler?

Do you guys think using a call instruction as part of a signature is good?

Improve this question
3
  • If you are speaking of aligned assembly, then why not. If this is not the case, it is already difficult to identify call instructions into the mess, so it won't work.
    – perror
    Feb 6, 2020 at 16:34
  • @perror why would the alignment change by recompiling the same program? and why would alignment affect the offsets between functions in the text section?
    – OneAndOnly
    Feb 6, 2020 at 16:40
  • If instructions are not aligned, then disassembly is quite tedious. Because, you cannot tell if the instructions found by the disassembler are the ones that get really executed by the program. So, you might end up by making a signature based on some misconceptions issued from a broken analysis which may lead to an unpredictable behavior. Therefore, getting a signature on unaligned instruction sets might lead to an untrustable result.
    – perror
    Feb 6, 2020 at 19:26

1 Answer 1

Reset to default
0

If there are code changes, it will most likely change between versions.

I would suggest you look at the implementation of FLIRT, in particular here, where they explain how they face this issue.

Improve this answer
2
  • but what about not changing the code and just recompiling the code again with the same or different compiler, or running the code in a different computer, will the offsets between functions change?
    – OneAndOnly
    Feb 6, 2020 at 16:37
  • Recompiling the code with the same compiler at the same machine will probably yield the same results, but I believe it's not promised. Running the code on a different computer should not change it. Different compiler will most likely yield different results regarding distances between functions.
    – macro_controller
    Feb 6, 2020 at 17:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.