The call

There are several ways to replace the call instruction with a sequence of instructions that would perform exactly the same action but would be treated by decompilers in a different manner. For example, the following code would do exactly what the call instruction does:

   ; Preceding code
push .return_address ; Push the return address on stack
push .callee ; Redirect the execution flow to
ret ; callee
.return_address:
; the rest of the code

We may, as well, replace the following sequence:

push  callee
ret

with, for example:

lea  eax, [callee]
jmp eax

This would still yield the same result. However, we want our obfuscation to be a bit stronger; therefore, we proceed and create a macro.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset