Lab 15-1

Analyze the sample found in the file Lab15-01.exe. This is a command-line program that takes an argument and prints ‘Good Job!’ if the argument matches the secret code.

Questions:

1. What anti-disassembly technique is used in this binary?

   The anti-disassembly technique present in Lab15-01.exe is false conditional jumps.

   Throughout the code it is possible to see several red highlighted zones:

   

   In all of these, we can see they are preceded by “xor eax eax”, and a jump zero statement. Since the zero flag is going to be set because of the XOR operation, the jump will always be taken. Nevertheless, IDA mistakenly produced conflicting code because it tried to interpret a true branch and a false branch.

   For the first example, looking at the Jump, we can see a jump to loc_401010+1, meaning that whatever it is on 401010 isn’t going to be executed. Since the OPCode here is E8 (call) and usually calls are 5 bytes long because of the provided address that it is calling, it doesn’t make sense to leave a E8 byte laying around all alone, therefore it can either be converted in data:

   

   Or replaced by a NOP:

   

2. What rogue opcode is the disassembly tricked in to disassembling?

   The rogue OPCode is E8.

3. How many times is this technique used?

   Throughout the code it has been identified the usage of the Rogue OPCode 5 times.

4. What command-line argument will cause the program to print “Good Job!”?

   The string the code expects to in order to print “Good Job!” is anything that starts with “pdq”: