Tidy up

docs/lectures/malware/06_anti_disassembly.md

@@ -2,7 +2,7 @@
 
 Sequences of executable code can have multiple disassembly representations, some may be invalid and some may obscure the real functionality of the program.
 
-> Anti-disassembly techniques work by taking advantage of the assumptions and limitations of disassemblers. 
+> Anti-disassembly techniques work by taking advantage of the assumptions and limitations of disassemblers.
 >
 > For example, disassemblers can only represent each byte of a program as part of one instruction at a time. If the disassembler is tricked into disassembling at the wrong offset, a valid instruction could be hidden from view.
 
@@ -16,11 +16,11 @@ Linear disassembly strategy iterates over a block of code, disassembling one ins
 
 This method is used by IDA
 
-- The key difference between linear and flow-oriented is that the disassembler doesn’t blindly irate over a buffer, assuming the data is noting but instructions packed neatly together
+- The key difference between linear and flow-oriented is that the disassembler doesn’t blindly iterate over a buffer, assuming the data is nothing but instructions packed neatly together
 - Instead it examines each instruction and builds a list of locations to disassemble
-  - Most flow-oriented disassemblers will process the false branch of a conditional jump
-  - Pressing the `C` key turns the cursor location into code
-  - Pressing the `D` key turns the cursor location into data
+    - Most flow-oriented disassemblers will process the false branch of a conditional jump
+    - Pressing the `C` key turns the cursor location into code
+    - Pressing the `D` key turns the cursor location into data
 
 ### Anti-Disassembler Techniques
 
@@ -33,14 +33,14 @@ The most common anti-disassembly technique seen in the wild is two back-to-back
 
 #### Jump Instruction with a Constant Condition
 
-Another anti-disassembly technique commonly found in the wild is composed of a single conditional jump instruction placed where the condition will always be the same. 
+Another anti-disassembly technique commonly found in the wild is composed of a single conditional jump instruction placed where the condition will always be the same.
 
 #### Impossible Disassembly
 
-Under some conditions, no traditional assembly listing will accurately represent the instructions that are executed. We use the term *impossible disassembly* for such conditions, but the term isn’t strictly accurate. You could disassemble these techniques, but you would need a vastly different representation of code than what is currently provided by disassemblers. 
+Under some conditions, no traditional assembly listing will accurately represent the instructions that are executed. We use the term *impossible disassembly* for such conditions, but the term isn’t strictly accurate. You could disassemble these techniques, but you would need a vastly different representation of code than what is currently provided by disassemblers.
 
 - A *rogue byte* is a byte placed after a conditional jump instruction
-  - This means the real instruction that follows will not be disassembled
+    - This means the real instruction that follows will not be disassembled
 
 ![1647963505.png](img/1647963505.png)
 
@@ -77,15 +77,15 @@ E8 			db 0E8h
 C3 			retn 
 ```
 
-- This only shows the instructions that are relevent to understanding the program
+- This only shows the instructions that are relevant to understanding the program
 - However this solution may interfere with flow graphs.
-  - Since its difficult to tell how the `xor`, `pop` and `retn` instructions are used
+    - Since it’s difficult to tell how the `xor`, `pop` and `retn` instructions are used
 
 ### Obscuring Flow Control
 
 #### The Function Pointer Problem
 
-If function pointers are used in handwritten assembly or crafted in a **nonstandard way** in source code, the results can be difficult to reverseengineer without dynamic analysis. 
+If function pointers are used in handwritten assembly or crafted in a **nonstandard way** in source code, the results can be difficult to reverse-engineer without dynamic analysis.
 
 ```assembly
 004011D0 sub_4011D0 proc near ; CODE XREF: _main+19p
@@ -124,10 +124,10 @@ We can manually add these in using `AddCodeXref`
 #### Return Pointer Abuse
 
 - `Call` is a combination of `jmp` and `push`
-  - As it jumps to the new function and pushes a return address onto the stack
+    - As it jumps to the new function and pushes a return address onto the stack
 - `retn` instruction pops the value from the top of the stack and jumps to it.
-  - Typically used to return a function call
-  - However no reason why malware authors can’t use it to obscure code
+    - Typically used to return a function call
+    - However no reason why malware authors can’t use it to obscure code
 
 ```assembly
 004011C0 sub_4011C0 proc near ; CODE XREF: _main+19p
@@ -152,5 +152,5 @@ We can manually add these in using `AddCodeXref`
 
 - Here `var_4` is set to the constant `-4`
 - This means `add [esp+4+var_4], 5` is actually `add [esp+4+(-4)]`
-  - `0x4011C9 + 0x5 = 0x4011CA`
-  - The `retn` instruction jumps to that memory location
+    - `0x4011C9 + 0x5 = 0x4011CA`
+    - The `retn` instruction jumps to that memory location