Indeed A86 did actually do this, as the MOV instructions had not only a source and a destination, but also a direction (which was a bit of overkill on Intel's part). I subsequently used the technique to obfuscate my code so .EXE unpackers didn't recognise what the program had been compressed with.

Mike

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/2623/18499#18499