Problem - Kevin Tafuro

ine the instruction making the reference, in this case push edx at address 08048366,
to realize that the return address is being overwritten.
A disassembler that does not follow the control flow will be not be affected by the
false return trick, as the following output from objdump demonstrates:
8048357: 51 push %ecx
8048359: 52 push %edx
8048358: 53 push %ebx
804835a: 89 e3 mov %esp,%ebx
804835c: 89 ec mov %ebp,%esp
804835e: 5d pop %ebp
804835f: 59 pop %ecx
8048360: 8D 15 69 83 04 08 lea 0x8048369,%edx
8048366: 52 push %edx
8048367: c3 ret
8048368: 0f 51 55 89 sqrtps 0xffffff89(%ebp),%xmm2
804836c: e5 89 in $0x89,%eax
804836e: dc 5a 5b fcompl 0x5b(%edx)
8048371: 59 pop %ecx
8048372: c9 leave
8048373: c3 ret
The false return at address 08048367 does not affect the subsequent disassembly,
although the misalignment trick at address 08048368 does cause the next three
instructions to be disassembled incorrectly. This provides an example of how two
simple techniques can be combined to create an inaccurate disassembly in different
types of disassemblers.
12.17 Using Self-Modifying Code
Problem
You want to hide portions of your binary using self-modifying code without rewriting
existing code in assembler.
Solution
The most effective use of self-modifying code is to overwrite a section of vital code
with another section of vital code, such that both vital sections do not exist at the
same time. This can be time-consuming and costly to develop; a more expedient
technique can be achieved with C macros that decrypt garbage bytes in the code section
to proper executable code at runtime. The process involves encrypting the protected
code after the binary has been compiled, then decrypting it only after it has
been executed.
The code presented in this recipe applies to FreeBSD, Linux, NetBSD, OpenBSD,
and Solaris. The concepts apply to Unix and Windows in general.
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Using Self-Modifying Code | 693