Dynamically Computed Target Address

Created the Monday 18 March 2019. Updated 1 month, 3 weeks ago.

Dynamically computed target addresses is an anti-disassembling technique that involves using dynamically computed addresses as the targets of branch instructions in a program. This can make it difficult for a disassembler to accurately reconstruct the original instructions of the program, as the disassembler will not be able to determine the correct target addresses for the branch instructions without actually executing the program.

For example, suppose a program contains the following instructions:

mov eax, 0x12345678
call eax

In this case, the call instruction uses a dynamically computed target address, as the value of the eax register is not known until the program is actually executed. This means that a disassembler will not be able to determine the correct target address for the call instruction without executing the program. If the disassembler tries to disassemble the program without executing it, it might generate incorrect disassembly output, like this:

0x00000000: mov eax, 0x12345678
0x00000004: call eax

In this case, the disassembler has assumed that the target address of the call instruction is the value stored in the eax register at the time the disassembler was run, but this is not necessarily the correct target address. The actual target address could be different if the program is executed, and the disassembler will not be able to determine the correct target address without executing the program.

This technique can be used by malware authors and other attackers to make it more difficult for analysts to disassemble and understand their programs. It can also make it more difficult for other tools, such as debuggers, to accurately interpret the program's behavior. This can be especially effective when the snapshot of the program is taken at a point during its execution when the resolution of the dynamically computed target address has not yet taken place in the code, as this can make it even more difficult for a disassembler to determine the correct target addresses.

Technique Identifier

U0208

Technique Tags

Dynamically computed target addresses Anti-disassembling Branch instruction Target address Execution

Code Snippets

Description

This code uses the malloc function to dynamically allocate memory for a target address that will be used as the target of a call instruction. It then uses the main function's address as the base for the target address, and adds an offset of 0x00000004 to it to compute the final target address. This computed target address is then stored in the dynamically allocated memory and is used as the target of the call instruction.

#include <stdio.h>
#include <stdlib.h>

int main() {
    // Dynamically compute the target address of the "call" instruction
    char *target = (char *)malloc(8);
    *(unsigned long long *)target = (unsigned long long)main + 0x00000004;

    // Use the dynamically computed target address in a "call" instruction
    __asm__("mov eax, [%0]\n"
            "call eax\n"
            :: "r" (target) : "eax");

    return 0;
}

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

The IDA Pro Book, 2nd Edition: The Unofficial Guide to the World's Most ... - Chris Eagle - Google Books