mBJO5ySOv (Ziyaretçi)
| | In fact, there are some Binary code obsfucators have been using this kind of trick to fool IDA and pvreent manual analysis:.text:00010EB5 mov [esp+8], eax.text:00010EB9 push ecx.text:00010EBA mov eax, [esp].text:00010EBD mov [esp+8], eax ; DATA XREF: .text:00010AF2o.text:00010EE8 retnSo I think maybe multi code xref or data xref should be added to ret.Additionaly I think IDA could try to backtrace the stack top to automatic resolve some these tricks.There aren't any GUI command to add data xref or code xref in IDA now.Maybe it's better to expose them to the user than SDK/script only.When I use the SDK function to add code xref IDA wouldn't add automatic comments to some indirect jump or call such as call [edx], I had to add the comment manually, would IDA support automatic comments to manual added xrefs in 5.1?Additionaly more and more obsfucators using unconditonal jump such as:wé 12.text:00011276 push eax.text:00011277 push [esp+0Ch+var_C].text:0001127A mov eax, [esp+0].text:0001127D mov [esp+10h+var_C], eax.text:00011281 jmp loc_11332loc_11332: ; CODE XREF: sub_11276+Bo.text:00011208 push edi.text:00011209 mov eax, esp.text:0001120B jmp loc_113FBto split one node into mutiple nodes, maybe IDA graph could reassemble them together when the jump target is one-indegree node.I think these kind of trick would be used in more and more software to protect themselves from being analyzed within one or two years. |