3 ms·
My Google-fu is failing me at the moment, but I remember a piece of malware actually included the copyright string of a disassembler so it would detect "itself"
by mike_d 5y ago
My Google-fu is failing me at the moment, but I remember a piece of malware actually included the copyright string of a disassembler so it would detect "itself" and not let you analyze the malware sample.
- robertlagrant 5y agoGoing to show just how rudimentary said scanning is sometimes.
- grover12 5y agoHey mike_d, I remember this as well. Using my google-fu, I found it. Google: "hopper disassembler" copyright text OR string https://alexomara.com/blog/a-silly-anti-disassembly-trick/ https://alexomara.com/blog/a-silly-anti-disassembly-trick/ backup links: https://web.archive.org/web/20210830080742/https://alexomara.com/blog/a-silly-anti-disassembly-trick/ https://web.archive.org/web/20210830080742/https://alexomara... https://archive.is/uzga3 https://archive.is/uzga3
- Benjamin_Dobell 5y agoFrom the article: > One of the limitations to at-least the demo of Hopper is that it is not able to disassemble itself. I was curious as to whether this limitation was present in the latest licensed version of Hopper (4.8.2). I can confirm that I can indeed disassemble Hopper itself. Whether there's some intentional mistakes in that disassembly I don't really have time to delve into, unfortunately.