TransWikia.com

Remapping Branch Instructions After Obfuscation

Reverse Engineering Asked by rustam Shirinov on March 7, 2021

Recently I’ve been working on a project. I’ve already got a hint for a problem that I had here: (Garbage Assembly Code Generationat at random offsets)
however, the accepted answer’s solution doesn’t seem to be universal as it didn’t work when I tried it on different sets of data. (Can’t disassemble a piece of code and reassemble it back together with a different assembler expecting the get the original assembly. The project shouldn’t have a problem with code generated from different assemblers).

So after gaving up on the reassembly approach I tried modifying the bytearray with the help of disassembly.

I’m currently trying to learn how I can remap the branch instructions after adding bytes into the original assembly. The original code looks like this:

0x42:   0f b7 2c 17                 movzx ebp, word ptr [rdi + rdx]
0x46:   8d 52 02                    lea edx, [rdx + 2]
0x49:   ad                          lodsd eax, dword ptr [rsi]
0x4a:   81 3c 07 57 69 6e 45        cmp dword ptr [rdi + rax], 0x456e6957
0x51:   75 ef                       jne 0x42
|
`--->  [BRANCHES] 0f b7 2c 17  movzx ebp, word ptr [rdi + rdx]

0x53:   8b 74 1f 1c                 mov esi, dword ptr [rdi + rbx + 0x1c]
0x57:   48 01 fe                    add rsi, rdi
0x5a:   8b 34 ae                    mov esi, dword ptr [rsi + rbp*4]
0x5d:   48 01 f7                    add rdi, rsi
0x60:   99                          cdq 
0x61:   75 21                       jne 0x84
|
`--->  [BRANCHES] ff d7  call rdi

After converting the short branch instructions to their near counterparts (part of the obfuscation) I get this:

0x42:   0f b7 2c 17                 movzx ebp, word ptr [rdi + rdx]
0x46:   8d 52 02                    lea edx, [rdx + 2]
0x49:   ad                          lodsd eax, dword ptr [rsi]
0x4a:   81 3c 07 57 69 6e 45        cmp dword ptr [rdi + rax], 0x456e6957
0x51:   0f 85 ef ff ff ff           jne 0x46
|
`--->  [BRANCHES] 8d 52 02  lea edx, [rdx + 2]

0x57:   8b 74 1f 1c                 mov esi, dword ptr [rdi + rbx + 0x1c]
0x5b:   48 01 fe                    add rsi, rdi
0x5e:   8b 34 ae                    mov esi, dword ptr [rsi + rbp*4]
0x61:   48 01 f7                    add rdi, rsi
0x64:   99                          cdq 
0x65:   0f 85 21 00 00 00           jne 0x8c
|
`--->  [INVALID] (No such address) 0x8c 

Obviously, because I converted 2 two-byte jcc instructions to six-byte ones additional 4*2=8 bytes had to be added to the bytearray and that shifted the jcc offsets.

My questions is how can I remap those jcc’s back to their original offsets? I tried keeping track of every set of bytes added to the bytearray and adding/subtracting (depends if the jcc is forward or backward jcc) those bytes from the jcc offsets. But seems like there are a lot of possibilities and I am overwhelmed by those. Can anyone point me in the right direction?

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP