Reverse Engineering - Analyse Self Modifying 16-bit Code with Ida Pro

Analysing self-modifying code with Ida Pro

In this video we look at the standard AV test file - EICAR. We deep dive into the assembly code to identify self-modifying code.

EICAR:
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

16-bit code debugging tips
~~~~~~~~~~~~~~~~~

* The last 2 bytes of a DOS program segment are usually zeroed out.

* Address of the code segment in 16-bit is 0100

* INT 21,9 - Print string
https://stanislavs.org/helppc/int_21-9.html
DS:DX = pointer to string ending in "$"
outputs character string to STDOUT up to "$"

* INT 20 - Program Terminate
https://stanislavs.org/helppc/int_20.html

IDA Pro Tips
~~~~~~~~~~~~~~~~~

* Interpret bytes as code, ASCII, or raw data:
Edit - Code (C)
Edit - Strings - String (A)
Edit - Data (D)

* View the raw bytes behind code mnemonics:
Options - General - Disassembly and set ‘Number of opcode bytes’

* Rebase the current segment to a different address:
Edit - Segments - Move current segment

* Modify program code bytes:
Edit - Patch program - Change byte

* Modify program assembly code:
Edit - Patch program assemble

Follow us on Twitter : https://twitter.com/reversinghub
Github : https://github.com/reversinghub

---------------------------------------------------------------------------------------------------

If you liked this video and you want to learn hands-on how to analyse malware, with real samples and practical exercises, find us on Udemy :

https://www.udemy.com/course/reverse-engineering-essentials/?referralCode=D738F461C93A2CD029FB

---------------------------------------------------------------------------------------------------

Want to support us continue to make great content? Buy us a coffee :
https://ko-fi.com/reversinghub

Thank you ?