Practical Malware Analysis

Chapter 6. Recognizing C Code Constructs in Assembly

In Chapter 4, we reviewed the x86 architecture and its most common instructions. But successful reverse engineers do not evaluate each instruction individually unless they must. The process is just too tedious, and the instructions for an entire disassembled program can number in the thousands or even millions. As a malware analyst, you must be able to obtain a high-level picture of code functionality by analyzing instructions as groups, focusing on individual instructions only as needed. This skill takes time to develop.

Let’s begin by thinking about how a malware author develops code to determine how to group instructions. Malware is typically developed using a high-level language, most commonly ...