2

I'm studying a reverse engineering course and here is an example about obfuscation indirect addresses:

enter image description here

The course says:

  1. The original code moves the content of the CH register to DL and the output will be 'I'.
  2. In the obfuscated code, the "BL" value, which is "70", will be moved to DL by the "MOV DL, BL" instruction.
  3. However, since "ADD CS:[SI], AH" is used, the contents of AH will be added to "BL". Therefore, BL value will be 72.
  4. Since the instruction will make a jump to the following 2 instructions, the CH contents will be moved to DL and the output will be 'I' in place of 'H'.

I don't understand points 3 and 4. Will the last byte at the L1 line be incremented by 2? What really happens?

1 Answer 1

2

Point 3 describes the self-modification of the "MOV DL,BL" instruction, that will become "MOV BL,DL". However, the "Therefore" part is wrong. DL is not defined, it might not hold 72 afterwards. The "LEA" line should say "L1+1", otherwise the wrong part of the instruction is modified.

Point 4 is wrong because point 3 is wrong. It's trying to describe which register will be used after the self-modification. The intention is that CH is no longer being moved, and CL would be used instead, but the faulty obfuscation does not involve CL, so the point is lost.

1
  • 1
    Thanks Peter, I think I understand the principle Too bad the example is wrong
    – nerios
    Feb 18, 2023 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.