Mastering Reverse Engineering

Code obfuscation with a metamorphic engine

A program can be coded in different ways. To "increment the value of a variable" means adding one to it. In assembly language, INC EAX would also be equivalent to ADD EAX, 1. The concept of replacing the same instruction or set of instructions with an equivalent instruction relates to metamorphism.  

Here are a few examples of code that can be interchanged with each other:

mov eax, 78h	push 78hpop eax
mov cl, 4mul cl	shl eax, 2
jmp 00401000h	push 00401000hret
xchg eax, edx	xor eax, edxxor edx, eaxxor eax, edx
rol eax, 7	push ebxmov ebx, eaxshl eax, 7shr ebx, 25or eax, ebxpop ebx
push 1234h	sub esp, 4mov [esp], 1234h

 

This concept was introduced in computer viruses that ...