Because disassemblers break down binary files into assembly code based on their own (often very complex) algorithms, there’s some room for error. Malware authors are aware of this vulnerability and can actively exploit it. They may also attempt to obfuscate the malware’s control flow or string and API function call references, making the code especially difficult to navigate statically. These are examples of anti-disassembly techniques, or ways in which malware complicates the process of reverse engineering code with a disassembler. In this chapter, we’ll look at these tactics in depth and what malware analysts can do ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month, and much more.
