Call Trick

Created the Saturday 23 March 2019. Updated 2 months ago.

The call trick is an anti-disassembling technique that involves modifying the default function's return address. This can be used in conjunction with other techniques, such as the insertion of garbage bytes, to break disassemblers. Disassemblers that use recursive traversal or linear sweep may be particularly vulnerable to this trick, as they may be unable to accurately interpret the next instruction after the call, making them susceptible to other anti-disassembly techniques.

Technique Identifier

U0205

Technique Tags

Call trick Return address modification Anti-disassembling Garbage bytes Disassembler evasion Function call interception Recursive traversal disassembly Linear sweep disassembly

Code Snippets

Description

This code modifies the default function's return address to point to a different location, in this case 0x123456. It also inserts some "garbage" instructions (in this case, four no-op instructions) to break disassemblers that use recursive traversal or linear sweep. This makes it more difficult for disassemblers to accurately interpret the next instruction after the call, making them susceptible to other anti-disassembly techniques.

#include <stdio.h>

int main() {
    // Store the current value of the return address
    void *return_address = __builtin_return_address(0);

    // Modify the return address to point to a different location
    __builtin_return_address(0) = (void *)0x123456;

    // Insert garbage bytes to break disassemblers
    __asm__("nop\n"
            "nop\n"
            "nop\n"
            "nop\n");

    // Use the modified return address
    return 0;
}

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

https://media.blackhat.com/bh-us-12/Briefings/Branco/BH_US_12_Branco_Scientific_Academic_WP.pdf