Mastering Reverse Engineering

Garbage code insertion

Garbage code insertion is a cheap way of making code look complicated. A code is simply injected with a code or a sequence of code that actually does nothing. In the following code snippet, try to identify all of the garbage codes:

    mov eax, [esi]    pushad    popad    xor eax, ffff0000h    nop    call loc_004017f    shr eax, 4    add ebx, 34h    sub ebx, 34h    push eax    ror eax, 5    and eax, 0ffffh    pop eax    jmp loc_0040180loc_004017f:    ret

Removing the garbage codes should reduce it down to this code:

    mov eax, [esi]    xor eax, ffff0000h    shr eax, 4    jmp loc_0040180

A lot of malware employs this technique to quickly generate variants of its own code. It may increase the size of code, but as a result, it makes it undetectable by signature-based anti-malware ...