Inserting Garbage Bytes

Created the Saturday 23 March 2019. Updated 6 months, 2 weeks ago.

Garbage bytes are random or meaningless data that is inserted into a program's code in order to make reverse engineering and analysis more difficult. This is an anti-disassembling technique, as the insertion of these random bytes can cause disassemblers to misinterpret the code and produce incorrect disassembly results.

The insertion of garbage bytes is usually used in conjunction with other techniques, such as code transposition or register reassignment. This can make the code even harder to analyze and understand, as the disassembler will not only have to deal with the incorrect disassembly caused by the garbage bytes, but also with the other obfuscation techniques that are being used.

The goal of this technique is to make it more difficult for a reverse engineer or disassembler to understand the code's behavior and intentions. By inserting random or meaningless data into the code, the disassembler will be unable to accurately reconstruct the original program, making it harder to analyze and understand.

Technique Identifiers

U0204 B0032.007

Technique Tags

Random data Meaningless data Code obfuscation Code transposition Register reassignment Code confusion Obfuscated code

Code Snippets

Description

In this example, the code first allocates an array of 10 random bytes and inserts them into the code. Then, it uses the garbage bytes to confuse a disassembler by adding them to the code in a way that does not affect the program's behavior. When the disassembler tries to analyze the code, it will be unable to correctly reconstruct the original program due to the presence of the garbage bytes. This can make it more difficult to understand and analyze the code's behavior and intentions.

#include <stdio.h>
#include <stdlib.h>

int main()
{
    // Insert garbage bytes into the code
    char* garbage = malloc(10);
    for (int i = 0; i < 10; i++)
    {
        garbage[i] = rand() % 256;
    }

    // Use the garbage bytes to confuse a disassembler
    int a = 5;
    int b = 10;
    int c = a + b;

    printf("The result is: %d\n", c);

    return 0;
}

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/online-training-material/documents/static-analysis-of-artefacts-toolset.pdf