Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Alternatives to NOP for shellcode nop sleds

Does anyone know of any online source that provides instruction alternatives to a NOP opcode ?

Like 'xchg ax, ax' and the likes. I'm pretty sure that there is also a tool for it, can someone point me to that direction please ?

like image 776
Spyros Avatar asked Sep 29 '11 16:09

Spyros


People also ask

What is a NOP sled in Linux?

A NOP sled (also known as a NOP slide) is a long sequence of instructions preceding shellcode, as shown in Figure 19-3. NOP sleds are not required to be present with shellcode, but they are often included as part of an exploit to increase the likelihood of the exploit succeeding.

How does NOP work in shellcode?

Shellcode authors can do this by creating a large NOP sled immediately preceding the shellcode. As long as execution is directed somewhere within the NOP sled, the shellcode will eventually run.

What is a 128-byte NOP sled?

A 128-byte NOP sled is just a group of NOP intructions 128 bytes wide. NOTE #1: NOP (No-OPeration) is an instruction available in most (all?) architectures that does nothing, other than occupying memory and some runtime.

How many bytes is a NOP instruction?

NOTE #2: in architectures with variable length instructions, a NOP instruction is usually just one byte in length, so it can be used as a convenient instruction padding. Unfortunately, that also makes it easy to do a NOP sled. Show activity on this post.


1 Answers

This page has a nice list of NOP alternatives with increasing encoding lengths: http://www.asmpedia.org/index.php?title=NOP

like image 98
500 - Internal Server Error Avatar answered Sep 27 '22 15:09

500 - Internal Server Error