Garbage code insertion

Garbage code insertion is a cheap way of making code look complicated. A code is simply injected with a code or a sequence of code that actually does nothing. In the following code snippet, try to identify all of the garbage codes:

    mov eax, [esi]
pushad
popad
xor eax, ffff0000h
nop
call loc_004017f
shr eax, 4
add ebx, 34h
sub ebx, 34h
push eax
ror eax, 5
and eax, 0ffffh
pop eax
jmp loc_0040180
loc_004017f:
ret

Removing the garbage codes should reduce it down to this code:

    mov eax, [esi]
xor eax, ffff0000h
shr eax, 4
jmp loc_0040180

A lot of malware employs this technique to quickly generate variants of its own code. It may increase the size of code, but as a result, it makes it undetectable by signature-based anti-malware software.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.119.111.9