Technique Search Instance

HTTP 200 OK
Allow: GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 86,
    "key": "dynamically-computed-target-address",
    "unprotect_id": "U0208",
    "name": "Dynamically Computed Target Address",
    "description": "Dynamically computed target addresses is an anti-disassembling technique that involves using dynamically computed addresses as the targets of branch instructions in a program. This can make it difficult for a disassembler to accurately reconstruct the original instructions of the program, as the disassembler will not be able to determine the correct target addresses for the branch instructions without actually executing the program.\r\n\r\n\r\nFor example, suppose a program contains the following instructions:\r\n\r\n```assembly\r\nmov eax, 0x12345678\r\ncall eax\r\n```\r\n\r\nIn this case, the call instruction uses a dynamically computed target address, as the value of the eax register is not known until the program is actually executed. This means that a disassembler will not be able to determine the correct target address for the call instruction without executing the program. If the disassembler tries to disassemble the program without executing it, it might generate incorrect disassembly output, like this:\r\n\r\n```assembly\r\n0x00000000: mov eax, 0x12345678\r\n0x00000004: call eax\r\n```\r\n\r\nIn this case, the disassembler has assumed that the target address of the call instruction is the value stored in the eax register at the time the disassembler was run, but this is not necessarily the correct target address. The actual target address could be different if the program is executed, and the disassembler will not be able to determine the correct target address without executing the program.\r\n\r\nThis technique can be used by malware authors and other attackers to make it more difficult for analysts to disassemble and understand their programs. It can also make it more difficult for other tools, such as debuggers, to accurately interpret the program's behavior. This can be especially effective when the snapshot of the program is taken at a point during its execution when the resolution of the dynamically computed target address has not yet taken place in the code, as this can make it even more difficult for a disassembler to determine the correct target addresses.",
    "resources": "https://books.google.fr/books?id=3nPAM3AZ1foC&pg=PA436&lpg=PA436&dq=dynamically+computed+target+address&source=bl&ots=Nm7aJXEhDp&sig=ACfU3U2X1g6CTacHMZ3AH1kyk0XBDRUiQA&hl=en&sa=X&ved=2ahUKEwi5wbKV-pXhAhUPy4UKHS1xAdAQ6AEwAHoECAYQAQ#v=onepage&q=dynamically%20computed%20target%20address&f=false",
    "creation_date": "2019-03-18T13:55:53Z",
    "tags": "Dynamically computed target addresses,\r\nAnti-disassembling,\r\nBranch instruction,\r\nTarget address,\r\nExecution,",
    "modification_date": "2023-10-04T10:44:39.984000Z",
    "category": [
        5
    ],
    "rules": [],
    "attachments": [],
    "featured_api": [],
    "contributors": []
}