0

Recently I've been working on a project. I've already got a hint for a problem that I had here: (Garbage Assembly Code Generationat at random offsets) however, the accepted answer's solution doesn't seem to be universal as it didn't work when I tried it on different sets of data. (Can't disassemble a piece of code and reassemble it back together with a different assembler expecting the get the original assembly. The project shouldn't have a problem with code generated from different assemblers).

So after gaving up on the reassembly approach I tried modifying the bytearray with the help of disassembly.

I'm currently trying to learn how I can remap the branch instructions after adding bytes into the original assembly. The original code looks like this:

0x42:   0f b7 2c 17                 movzx ebp, word ptr [rdi + rdx]
0x46:   8d 52 02                    lea edx, [rdx + 2]
0x49:   ad                          lodsd eax, dword ptr [rsi]
0x4a:   81 3c 07 57 69 6e 45        cmp dword ptr [rdi + rax], 0x456e6957
0x51:   75 ef                       jne 0x42
|
`--->  [BRANCHES] 0f b7 2c 17  movzx ebp, word ptr [rdi + rdx]

0x53:   8b 74 1f 1c                 mov esi, dword ptr [rdi + rbx + 0x1c]
0x57:   48 01 fe                    add rsi, rdi
0x5a:   8b 34 ae                    mov esi, dword ptr [rsi + rbp*4]
0x5d:   48 01 f7                    add rdi, rsi
0x60:   99                          cdq 
0x61:   75 21                       jne 0x84
|
`--->  [BRANCHES] ff d7  call rdi

After converting the short branch instructions to their near counterparts (part of the obfuscation) I get this:

0x42:   0f b7 2c 17                 movzx ebp, word ptr [rdi + rdx]
0x46:   8d 52 02                    lea edx, [rdx + 2]
0x49:   ad                          lodsd eax, dword ptr [rsi]
0x4a:   81 3c 07 57 69 6e 45        cmp dword ptr [rdi + rax], 0x456e6957
0x51:   0f 85 ef ff ff ff           jne 0x46
|
`--->  [BRANCHES] 8d 52 02  lea edx, [rdx + 2]

0x57:   8b 74 1f 1c                 mov esi, dword ptr [rdi + rbx + 0x1c]
0x5b:   48 01 fe                    add rsi, rdi
0x5e:   8b 34 ae                    mov esi, dword ptr [rsi + rbp*4]
0x61:   48 01 f7                    add rdi, rsi
0x64:   99                          cdq 
0x65:   0f 85 21 00 00 00           jne 0x8c
|
`--->  [INVALID] (No such address) 0x8c 

Obviously, because I converted 2 two-byte jcc instructions to six-byte ones additional 4*2=8 bytes had to be added to the bytearray and that shifted the jcc offsets.

My questions is how can I remap those jcc's back to their original offsets? I tried keeping track of every set of bytes added to the bytearray and adding/subtracting (depends if the jcc is forward or backward jcc) those bytes from the jcc offsets. But seems like there are a lot of possibilities and I am overwhelmed by those. Can anyone point me in the right direction?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.