META - Handle antidisassembly tricks

[XVilka]

• [ ] https://github.com/radareorg/radare2/issues/5136
• [ ] https://github.com/radareorg/radare2/issues/4635
• [ ] https://medium.com/@0x4ndr3/assembly-wrapping-a-new-technique-for-anti-disassembly-c144eb90e036 (see https://reverseengineering.stackexchange.com/questions/1531/what-is-overlapping-instructions-obfuscation also)

[unixfreaxjp]

@XVilka ; test result are below from my point, hope helps, ref: https://github.com/radareorg/radare2/issues/5136 (deadcode)

I tested in these tree instances without build error today, just now, using commit: ae883f0cd3b12da0272f1471cab82c2e75cd1575

$ r2 -v
radare2 4.5.0-git 24737 @ linux-x86-32 git.4.4.0-253-gae883f0
commit: ae883f0cd3b12da0272f1471cab82c2e75cd1575 build: 2020-06-10__19:52:19

$ r2 -v
radare2 4.5.0-git 24737 @ freebsd-x86-64 git.4.4.0-253-gae883f0cd
commit: ae883f0cd3b12da0272f1471cab82c2e75cd1575 build: 2020-06-10__19:54:43

$ r2 -v
radare2 4.5.0-git 24737 @ linux-x86-64 git.4.4.0-253-gae883f0
commit: ae883f0cd3b12da0272f1471cab82c2e75cd1575 build: 2020-06-10__19:19:40

Using assembly code below from @trufae :

In assembly:

.arch x86
.bits 64
    push rbp
    jz target
    jnz target
.byte 33
target:
    mov eax, 33
    int 0x80
    ret

How the binary looks like in all tests.

$ rasm2 -f antidism.asm
557403750121b821000000cd80c3

The results are in below (It is self explanatory)

in 32bit:

                                                          .---------------------------------------.
                                                          | [0x0]                                 |
                                                          | 16: fnc000 ();                        |
                                                          | 0x00000000 55             push ebp    |
                                                          | 0x00000001 7403           je 6        |
                                                          `---------------------------------------'
                                                                  f t
                                                                  | |
                                                                  | '--------------------------.
                                               .------------------'                            |
                                               |                                               |
                                           .------------------------------------.              |
                                           |  0x3 [ob]                          |              |
                                           | 0x00000003 7501           jne 6    |              |
                                           `------------------------------------'              |
                                                   f t                                         |
                                                   | |                                         |
                                                   | '--------------------.                    |
        .------------------------------------------'                      |                    |
        |                                                                 | .------------------'
        |                                                                 | |
    .----------------------------------------------------------.    .--------------------------------------------.
    |  0x5 [oc]                                                |    |  0x6 [od]                                  |
    | 0x00000005 21b821000000   and dword [eax + 0x21], edi    |    | ; '!'                                      |
    `----------------------------------------------------------'    | ; 33                                       |
                                                                    | 0x00000006 b821000000     mov eax, 0x21    |
                                                                    `--------------------------------------------'

in 64 bit:

                                                          .---------------------------------------.
                                                          | [0x0]                                 |
                                                          | 16: fcn001 (int64_t arg1);            |
                                                          | ; arg int64_t arg1 @ rdi              |
                                                          | 0x00000000 55             push rbp    |
                                                          | 0x00000001 7403           je 6        |
                                                          `---------------------------------------'
                                                                  f t
                                                                  | |
                                                                  | '--------------------------.
                                               .------------------'                            |
                                               |                                               |
                                           .------------------------------------.              |
                                           |  0x3 [ob]                          |              |
                                           | 0x00000003 7501           jne 6    |              |
                                           `------------------------------------'              |
                                                   f t                                         |
                                                   | |                                         |
                                                   | '--------------------.                    |
        .------------------------------------------'                      |                    |
        |                                                                 | .------------------'
        |                                                                 | |
    .----------------------------------------------------------.    .--------------------------------------------.
    |  0x5 [oc]                                                |    |  0x6 [od]                                  |
    | ; arg1                                                   |    | ; '!'                                      |
    | 0x00000005 21b821000000   and dword [rax + 0x21], edi    |    | ; 33                                       |
    `----------------------------------------------------------'    | 0x00000006 b821000000     mov eax, 0x21    |
                                                                    `--------------------------------------------'  

Hope this helps.