Mastering Assembly Programming

The call obfuscation macro

Prior to beginning with the obfuscation of the call instruction itself, we will define a utility macro called random:

; The %t below stands for the current; timestamp (at the compile time)random_seed = %t; This macro sets 'r' to current random_seedmacro random r{   random_seed = ((random_seed *\                   214013 +\                   2531011) shr 16) and 0xffffffff   r = random_seed }

The random macro generates a pseudo-random integer and returns it in the parameter variable. We will need this tiny portion of randomization in order to add some diversity to our call implementation occurrences. The macro itself (let us call it f_call) makes use of the EAX register; therefore, we would either take care of preserving this register before the f_call ...