I wonder whether mov-oriented programming would a useful obfuscation technique for malware authors. I'd assume that typical disassemblers are not very helpful.
Yes/no. Yes, because it's (slightly) harder to see what's executed. No, because AVs will soon get a rule like: basic block full of MOVs - flag it immediately. Some AVs even flag UPX packed executables by default, so it wouldn't be unexpected.
At around 34:30 in the talk he discusses this briefly, with the conclusion that you'd signature the data and also continue to monitor API calls etc. It wouldn't be such a big deal.
Obfuscation uses a lot of techniques including this. Redundancy also allows to create polymorphic code, that is which creates variable copies of itself.
one talk I remember said as much. If i remember correctly, repeated obfuscation via self modifying code can increase code size dramatically, though a correlation to time complexity was not shown (and I don't remember how the code modified).
