Windows C++ / Disassembly Desynchronization
Author | Unprotect |
Platform | Windows |
Language | C++ |
Technique | Disassembly Desynchronization |
Description:
This code contains the original instructions mov eax, 0x12345678 and add eax, 0x00000004, but it also includes some "garbage" instructions (the nop instructions) between these two instructions. This breaks the normal sequence of instructions and can cause a disassembler to generate incorrect disassembly output.
Code
#include <stdio.h>
int main() {
// Original instructions
__asm__("mov eax, 0x12345678\n"
"add eax, 0x00000004\n");
// "Garbage" instructions that break the normal sequence of instructions
__asm__("nop\n"
"nop\n"
"nop\n"
"nop\n");
// More original instructions
__asm__("mov ebx, 0x87654321\n"
"sub ebx, 0x00000004\n");
return 0;
}
Created
December 6, 2022
Last Revised
April 22, 2024