Problem - Kevin Tafuro

Most disassemblers can be fooled by a simple misalignment error—for example,
jumping into the middle of an instruction so that the target of the jump is disassembled
incorrectly. The typical technique of performing an unconditional jump into
another instruction is not very effective with disassemblers that follow the flow of
execution—the jump will be followed, and the bytes between the jump and the jump
target will be ignored. Instead, you can use a conditional jump, followed by the first
byte of a multibyte instruction (0x0F is ideal for this, because it is the first byte of all
two-byte opcodes); this way, a flow-of-execution disassembler will disassemble the
code after the conditional branch.
#define DISASM_MISALIGN asm volatile ( \
" pushl %eax \n" \
" cmpl %eax, %eax \n" \
" jz 0f \n" \
" .byte 0x0F \n" \
"0: \n" \
" popl %eax \n")
This macro compares the eax register to itself, forcing a true condition; the jz
instruction is therefore always followed during execution. A disassembler will either
ignore the jz instruction and interpret the 0x0F byte that follows as an instruction, or
it will follow the jz instruction. If the jz instruction is followed, the disassembler can
still interpret the code incorrectly if the address after the jz instruction is disassembled
before the address to which the jz instruction jumps. For example:
void my_func(void) {
int x;
DISASM_MISALIGN;
for (x = 0; x < 10; x++) printf("%x\n", x);
}
IDA Pro disassembles the code after the jz instruction at address 0804837D before
following the jump itself, resulting in an incorrect disassembly:
08048374 my_func:
08048374 55 push ebp
08048375 89 E5 mov ebp, esp
08048377 83 EC 08 sub esp, 8
0804837A 50 push eax
0804837B 39 C0 cmp eax, eax
0804837D 74 01 jz short near ptr loc_804837F+1
0804837F
0804837F loc_804837F: ; CODE XREF: .text:0804837D#j
0804837F 0F 58 C7 addps xmm0, xmm7
08048382 45 inc ebp
08048383 FC cld
08048383 ; --------------------------------------------------------------------
08048384 00 db 0 ;
08048385 00 db 0 ;
08048386 00 db 0 ;
08048387 00 db 0 ;
690 | Chapter 12: Anti-Tampering
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.