UNDERCODE COMMUNITY
2.69K subscribers
1.24K photos
31 videos
2.65K files
80.9K links
๐Ÿฆ‘ Undercode Cyber World!
@UndercodeCommunity


1๏ธโƒฃ World first platform which Collect & Analyzes every New hacking method.
+ AI Pratice
@Undercode_Testing

2๏ธโƒฃ Cyber & Tech NEWS:
@Undercode_News

3๏ธโƒฃ CVE @Daily_CVE

โœจ Web & Services:
โ†’ Undercode.help
Download Telegram
Forwarded from UNDERCODE TESTING
Forwarded from UNDERCODE TESTING
๐Ÿฆ‘๐Ÿ’ก๐Œ๐š๐ฅ๐ฐ๐š๐ซ๐ž ๐€๐ง๐š๐ฅ๐ฒ๐ฌ๐ข๐ฌ ๐“๐ข๐ฉ: ๐’๐ฉ๐จ๐ญ๐ญ๐ข๐ง๐  ๐€๐ง๐ญ๐ข-๐ƒ๐ข๐ฌ๐š๐ฌ๐ฌ๐ž๐ฆ๐›๐ฅ๐ฒ ๐“๐ซ๐ข๐œ๐ค๐ฌ ๐Ÿ’ก

While analyzing malware, a common anti-disassembly technique to watch for is the use of a ๐œ๐จ๐ง๐๐ข๐ญ๐ข๐จ๐ง๐š๐ฅ ๐ฃ๐ฎ๐ฆ๐ฉ ๐ฐ๐ข๐ญ๐ก ๐š ๐œ๐จ๐ง๐ฌ๐ญ๐š๐ง๐ญ ๐œ๐จ๐ง๐๐ข๐ญ๐ข๐จ๐ง.

Take the snippet below as an example:

The code starts with ๐’™๐’๐’“ ๐’†๐’‚๐’™, ๐’†๐’‚๐’™, which clears the ๐‘ฌ๐‘จ๐‘ฟ register and, as a result, sets the zero flag (๐’๐‘ญ).

Immediately after, a conditional jump (๐’‹๐’›) checks the state of the zero flag.

Since ๐’™๐’๐’“ ๐’†๐’‚๐’™, ๐’†๐’‚๐’™ guarantees ZF will ๐’‚๐’๐’˜๐’‚๐’š๐’” be set, the jump is effectively unconditional. However, to automated tools or disassemblers, it may appear as conditional, complicating static analysis.

๐Ÿ” ๐‘พ๐’‰๐’š ๐’…๐’๐’†๐’” ๐’•๐’‰๐’Š๐’” ๐’Ž๐’‚๐’•๐’•๐’†๐’“?

Malware authors use this technique to:

โ— Obfuscate control flow.
โ— Confuse disassembly tools.
โ— Make reverse engineering more time-consuming.

Ref: AIT ICHOU Mustapha
@UndercodeCommunity
โ– โ–‚ โ–„ U๐•Ÿ๐”ปโ’บ๐ซฤ†๐”ฌ๐““โ“” โ–„ โ–‚ โ–