Assembly obfusscation

[Zigmund]

As you said 'IDA can correctly handle this most of the time'...
That's the main goal of obfuscation - prevent disassembling... But IDA in use of skilled reverser can give very good results in suche way (example you gave)...

Simpliest way (as for me) is to change outputed .asm listing of compilled program and parse it. Hardest and more professional methods : write you own translator and write VirtualMachine.

I'll describe JUNKs technique (one of the sipliest):

we have some asm listing:
--
$L8547:
mov eax, 1
Junk1
test eax, eax
je $L8548
Junk2
mov ecx, DWORD PTR [ebp-64]
mov dl, BYTE PTR [ecx+3]
or dl, 128
--
and Junk1(2) are macroses like:

Junk1 macro
local @@y
jmp @@y
db 0BCh
@@y:
endm

Junk2 macro
local @@1, @@2
push offset @@1
ret
db 069h
@@1:
push offset @@2
ret
db 0E8h
@@2:
endm

db 069h, E8h, BCh... etc - opcodes of long instructions

MOst of times IDA displays real JUNK in disasm

Any other methods? Or tools?!