1

I'm working on an obfuscated binary. I recognized some patterns used to confuse the disassembler, some used to obfuscate function calls, some other for conditional jumps and so on.

The idea was to search these patterns along the binary. The problem is that such patterns are often interleaved with unconditional jumps.

For example this code is used to replace a simple conditional jump:

push    offset loc_123456
push    ebx
push    eax
mov     ebx, [esp+8]
mov     eax, offset loc_654321
cmovz   ebx, eax
mov     [esp+8], ebx
pop     eax
pop     ebx
retn

The problem is that this pattern is often split in two or more parts (because the whole code is split in several blocks that are spread everywhere in the binary and then connected with unconditional jumps), and of course I cannot find it with a simple byte pattern search.

Is there any way to look for all the pieces of code that satisfy a pattern even if they are broken in 2 (or more) pieces and connected with an unconditional jump?

  • What tool are you using? – Ricardo Jul 21 at 20:55
  • @Ricardo Ida, but any suggestion on other tools is accepted – stokdam Jul 22 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.