Which term describes an anti-analysis technique that prevents disassembly tools from listing program instructions correctly?

Which term describes an anti-analysis technique that prevents disassembly tools from listing program instructions correctly?

• A. Anti-disassembly
• B. Anti-debugging
• C. Anti-heuristics
• D. Anti-emulation

Answer: (A)

Anti-disassembly techniques are designed to foil static analysis by disassemblers, making it hard for those tools to reconstruct the exact sequence of instructions. They achieve this through tricks like self-modifying code, unusual or mixed data and code, encryption or packing of code, and reinterpreting bytes so that a disassembler’s linear listing doesn’t reflect the true runtime behavior. Because disassemblers rely on decoding a straightforward byte stream into instructions, any method that disrupts that mapping prevents accurate listing of program instructions, which is exactly what anti-disassembly aims to do. The other terms focus on different analysis angles: anti-debugging aims to thwart live debugging, anti-emulation targets tools that simulate execution, and anti-heuristics tries to defeat heuristic-based detection. None of them specifically obstructs the disassembler’s ability to list instructions like anti-disassembly does.

Anti-disassembly techniques are designed to foil static analysis by disassemblers, making it hard for those tools to reconstruct the exact sequence of instructions. They achieve this through tricks like self-modifying code, unusual or mixed data and code, encryption or packing of code, and reinterpreting bytes so that a disassembler’s linear listing doesn’t reflect the true runtime behavior. Because disassemblers rely on decoding a straightforward byte stream into instructions, any method that disrupts that mapping prevents accurate listing of program instructions, which is exactly what anti-disassembly aims to do.

The other terms focus on different analysis angles: anti-debugging aims to thwart live debugging, anti-emulation targets tools that simulate execution, and anti-heuristics tries to defeat heuristic-based detection. None of them specifically obstructs the disassembler’s ability to list instructions like anti-disassembly does.