flat assembler
Message board for the users of flat assembler.

Index > Projects and Ideas > Writing a disassembler?

Goto page Previous  1, 2
Author
Thread Post new topic Reply to topic
FlierMate11



Joined: 13 Oct 2022
Posts: 94
FlierMate11 12 Mar 2023, 11:09
And also I found that, even though I code in
Code:
mov edx, [0x00403000+esi]
    


When referring to the table, it is still [esi+displacement], regardless the order I put in Assembly as [displacement + esi].

Code:
8b 96 00 30 40 00       mov    edx,DWORD PTR [esi+0x403000]
    
Post 12 Mar 2023, 11:09
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 19254
Location: In your JS exploiting you and your system
revolution 12 Mar 2023, 11:19
Addition is commutative.

Same for multiplication.
Code:
mov eax,[ebx*4] == mov eax,[4*ebx]    
But not the same for this.
Code:
mov eax,[ebx] != mov [ebx],eax    
Post 12 Mar 2023, 11:19
View user's profile Send private message Visit poster's website Reply with quote
FlierMate11



Joined: 13 Oct 2022
Posts: 94
FlierMate11 12 Mar 2023, 11:28
revolution wrote:
Addition is commutative.

Same for multiplication.
Code:
mov eax,[ebx*4] == mov eax,[4*ebx]    
But not the same for this.
Code:
mov eax,[ebx] != mov [ebx],eax    


Noted with thanks! Smile

@revolution, can you help to answer the last question on first page in this thread? Actually I posted it also just now.
Post 12 Mar 2023, 11:28
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 19254
Location: In your JS exploiting you and your system
revolution 12 Mar 2023, 12:23
FlierMate11 wrote:
So when to decide 01 or 03 opcode?
It doesn't matter which you choose. But for a disassembler you don't get to choose, it only comes up for an assembler.

You can use these types of alternate encoding choices to place a signature in the binary output. Some assembler authors have deliberately used this to place watermarks into the outputs.
Post 12 Mar 2023, 12:23
View user's profile Send private message Visit poster's website Reply with quote
FlierMate11



Joined: 13 Oct 2022
Posts: 94
FlierMate11 12 Mar 2023, 12:35
revolution wrote:
FlierMate11 wrote:
So when to decide 01 or 03 opcode?
It doesn't matter which you choose. But for a disassembler you don't get to choose, it only comes up for an assembler.

You can use these types of alternate encoding choices to place a signature in the binary output. Some assembler authors have deliberately used this to place watermarks into the outputs.


It is nice to know this, thanks.
Post 12 Mar 2023, 12:35
View user's profile Send private message Visit poster's website Reply with quote
FlierMate11



Joined: 13 Oct 2022
Posts: 94
FlierMate11 12 Mar 2023, 20:48
(I typed a long text but suddenly all gone after a keypress)

Long story short, I have prepared the template for my future disassembler.

This exedump will hexdump code section in PE file.

Please help test. I test examples compiled by FASMW okay, but when try to read Windows Notepad.exe, my program says "Code section not found", weird.

Maybe offset to section table is wrong for 64-bit PE, should have check the magic 0x20b, hmm..

Never mind, I fixed it in v0.02 new version.


Description: Bug fix - v0.02
Download
Filename: exedump.ASM
Filesize: 11.06 KB
Downloaded: 11 Time(s)

Post 12 Mar 2023, 20:48
View user's profile Send private message Visit poster's website Reply with quote
FlierMate2



Joined: 21 Mar 2023
Posts: 3
FlierMate2 23 Mar 2023, 19:39
Does disassembly sometimes fail if without the human intervention?

Quote:
There are many forms of anti-disassembly, the purpose is to create logic problems that a disassembler or
decompiler don’t handle well and thus allows the disassembly process to break.


I saw this malware sample, in Flare-On challenge 2021, this "Evil" program uses anti-disassembly technique.

Code:
.text:0040650B 33 C0 xor eax, eax
.text:0040650D 8B 00 mov eax, [eax]
.text:0040650F 74 03 jz short loc_406514
.text:00406511 75 8B jnz short loc_40649E
.text:00406513 4D dec ebp
.text:00406514 loc_406514:
.text:00406514 E8 89 41 04 85 call near ptr 8544A6A2h
    

Figure 5: Anti-Disassembly null deference followed by junk jumps

Code:
.text:0040650B 90 nop
.text:0040650C 90 nop
.text:0040650D 90 nop
.text:0040650E 90 nop
.text:0040650F 90 nop
.text:00406510 90 nop
.text:00406511 90 nop
.text:00406512 8B 4D E8 mov ecx, [ebp+Block]
.text:00406515 89 41 04 mov [ecx+4], eax
.text:00406518 85 C0 test eax, eax
.text:0040651A 75 22 jnz short loc_40653E.text:00406553 E8 5A 
    

Figure 6: Anti-Disassembly removed

I wonder why disassembler failed to recognize "8B 4D E8" from "75 8B" and "4D"? (Of course I have plenty to learn before start coding my disassembler Wink

And then there is anti-debugging and anti-virtualization...

Source: https://www.mandiant.com/sites/default/files/2021-10/09-evil.pdf
Post 23 Mar 2023, 19:39
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  
Goto page Previous  1, 2

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2023, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.

Website powered by rwasa.