Different x86 Bytecode Interpretations
Working on an efficient generic shellcode detection engine and verifying results with randomly generated input, I’ve effectively ended up fuzzing different open source disassembler libraries. The disassembler library of choice for my current project is libdasm because of its comparatively long history and public domain license. But writing a sound and complete x86 disassembler is obviously not a trivial task due to the complex nature of the x86 instruction set.
libdasm used to have issues correctly disassembling certain floating point instructions in the past, but this was simply caused by an off-by-three error in the opcode lookup tables (three NULL rows missing) and thus the fix was comparatively easy.
Tags: anti-virus, Ask, Industry News, Industry News, Information Technology, Internet Security, Kaspersky, security, Software, virus
You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.