Strategies for Anti-Disassembly
Anti-disassembly utilizes specially formulated code or data within a program to deceive disassembly analysis tools, resulting in a misleading program listing. Malware authors construct this technique either manually, with a dedicated tool in the creation and deployment process, or by integrating it into their malware’s source code. Although any successfully executed code can be reverse-engineered, in this chapter, you will learn how to armor your code with anti-disassembly and anti-debugging methods, thereby raising the level of expertise required for successful malware development.
In this chapter, we’re going to cover the following main topics:
- Popular anti-disassembly techniques
- Exploring the function control problem and its benefits
- Obfuscation of the API and assembly code
- Crashing malware analysis tools
