Anti-Disassembly Techniques

Anti-Disassembly Technique Gallery

  Linear sweep (objdump --disassemble):
  ─────────────────────────────────────────────────────────────────────────
  Start at the first byte of the code section.
  Decode each instruction. Advance by instruction.length.
  Repeat until end of section.
  
  Problem: if a jump goes over a data byte embedded in the code section,
  the linear sweep decodes that data byte as an instruction — wrong output.
  
  Recursive descent (IDA Pro, Ghidra):
  ─────────────────────────────────────────────────────────────────────────
  Start at known entry points (EP, exported functions).
  Decode instruction. If it's a branch, add both targets to the work queue.
  If it's a call, add the call target. If it's a ret, stop this branch.
  
  Problem: if a conditional branch target can't be determined statically,
  the recursion doesn't follow. If a branch is obfuscated (JMP [EAX]),
  the disassembler doesn't know where EAX points → that code is never decoded.
  
  Anti-disassembly exploits one or both of these assumptions.

; anti_disasm.asm — Anti-disassembly techniques in x64 assembly
; NASM syntax

section .text
global anti_disasm_demo

; ── Technique 1: Junk byte after unconditional jump ──────────────────
; The CPU executes: JMP → skip the garbage byte → land at real code.
; Linear sweep: executes garbage byte as part of the next instruction.
; Recursive descent (IDA): follows the JMP to the correct target,
;   but the byte sequence between JMP and target is still SHOWN as code.
;   Some disassemblers handle this; older IDA versions get confused.
anti_disasm_demo:
    jmp .real_instruction
    db  0xE8          ; garbage byte (0xE8 = CALL opcode → confuses decoder)
.real_instruction:
    xor eax, eax
    ret

; ── Technique 2: Fake conditional jump with always-true predicate ────
; The conditional branch ALWAYS takes the same path, but the disassembler
; must analyze BOTH paths. The not-taken path starts with confusing bytes.
trick_2:
    xor  ecx, ecx       ; ecx = 0
    test ecx, ecx       ; ZF = 1 (always, since ecx is always 0 here)
    jz   .always_taken  ; always taken (ZF=1 → jump)
    ; bytes here are never executed but disassembler decodes them as code:
    db  0xFF, 0xE4      ; JMP RSP — confuses some disassemblers
    db  0x90            ; NOP (but the previous instruction ate 2+ bytes wrong)
.always_taken:
    mov eax, 1
    ret

; ── Technique 3: Self-referencing pointer trick ───────────────────────
; Embed a pointer to a nearby address. Disassembler decodes the pointer
; as instructions — 8 bytes (a 64-bit address) looks like 2-3 instructions.
; CPU never executes those bytes because a JMP skips over them.
trick_3:
    jmp  .after_pointer
    dq   trick_3       ; 8-byte pointer (= 8 bytes of "code" the disassembler sees)
.after_pointer:
    nop
    ret

; ── Technique 4: Overlapping instructions ─────────────────────────────
; A single byte can be the END of one instruction AND the START of another.
; The CPU uses one interpretation; the disassembler uses another.
;
; Example:
;   EB 02        JMP +2   (short jump, skips 2 bytes → lands at +4)
;   E8 F8        (garbage — the E8 starts a CALL decode that's wrong)
;   (landing at +4): XOR eax, eax → real instruction
;
; The F8 byte at offset 3 is decoded by a linear disassembler as the
; start of an INSTRUCTION. The CPU skips to offset 4 via the JMP.
; The "instruction" at offset 2 (E8 F8 90 xx) is fake.
trick_4:
    db  0xEB, 0x02  ; JMP +2 (lands at trick_4+4)
    db  0xE8, 0xF8  ; garbage: will decode as CALL 0xFFFFFFFB (fake call)
    ; CPU lands here (offset +4 from start of trick_4):
    xor eax, eax
    inc eax
    ret

Return Address Manipulation

; ── Technique 5: Return address manipulation ─────────────────────────
; Pop the return address from the stack, modify it, push back, and RET.
; Disassembler sees RET → thinks function ends here.
; CPU pops the modified address → continues executing at a different location.
; 
; Commonly used to hide where execution goes after a function returns:
;   CALL fake_ret_func  ; disassembler sees this as a normal call
;   [execution after ret → actually lands at modified_target, not here]

fake_ret_func:
    pop  rax            ; pop return address (would be next_instruction below)
    add  rax, 0x10      ; advance by 16 bytes (skip past data/confusing bytes)
    push rax            ; push modified return address
    ret                 ; "return" to (call_site + 16), not (call_site + 5)

; ── Technique 6: Indirect JMP via computed address ────────────────────
; IDA/Ghidra cannot determine where JMP RAX goes statically.
; They mark the target as "unknown" and stop recursive descent there.
; All code reachable only from this jump is invisible to static analysis.

indirect_jmp_demo:
    lea  rax, [rel .real_target]   ; load address of real target
    xor  rax, 0x1234               ; XOR with constant
    xor  rax, 0x1234               ; XOR again → cancels out (rax = real_target)
    jmp  rax                        ; IDA sees: JMP RAX (unknown target)
.real_target:
    mov  eax, 42
    ret

Questions & Answers