OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Pavel Kankovsky (peakargo.troja.mff.cuni.cz)
Date: Sun Jan 27 2002 - 15:21:13 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    On Sat, 26 Jan 2002, Robert Flicker wrote:

    > His ideas revolve around counting multiple NOP type operations in a row and
    > alerting when a threshold is reached. The idea has been kicked around for a
    > while, but this is the first one that I have seen in actual implementation.

    The time has come to replace nop with another harmless instruction?
    Let's say, "inc %eax" on i386 (assuming the shellcode does not need to
    know the original value of %eax)? Or "mov $0x40b048b4, %eax"?
    (The explanation is left as an exercise to any reader who has got a
    disassembler.)

    --Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ]
    "Resistance is futile. Open your source code and prepare for assimilation."