From: Andrew Farmer (andfarmteknovis.com)
Date: Sat Oct 02 2004 - 23:22:09 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On 2 Oct 2004, at 11:49, Ali Campbell wrote:
> Does the fixed-length nature of RISC instructions make detecting a
> shellcode on a platform such as PPC via IDS easier ? Or does the
> larger availability of pseudo-NOP instructions on these platforms
> (owing chiefly to more combinations of registers being available) in
> fact make it harder ?
>
> I wrote some shellcode for OS X once, basically as an exercise, and I
> caught myself wondering about this.

Well, there are a lot more NOPs on PPC, but most of them can be
detected pretty easily. If NOP detection were implemented in an IDS,
though, NOPs could be replaced with dead code instead - choose random
operations from {add, sub, mul, and, ori, xor} and three random
registers to create pseudorandom no-op code.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFBX35xPa6RRaKl0ScRAsafAKCFN+S79DAWO3SMzyALyviEeQtzQwCg/ASB
jfZH6vv7k5n9ncZYpLEIW04=
=nFOg
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]