Full Disclosure mailing list archives
Re: On Polymorphic Evasion
From: Andrew Farmer <andfarm () teknovis com>
Date: Sat, 2 Oct 2004 21:22:09 -0700
On 2 Oct 2004, at 11:49, Ali Campbell wrote:
Does the fixed-length nature of RISC instructions make detecting a shellcode on a platform such as PPC via IDS easier ? Or does the larger availability of pseudo-NOP instructions on these platforms (owing chiefly to more combinations of registers being available) in fact make it harder ?I wrote some shellcode for OS X once, basically as an exercise, and I caught myself wondering about this.
Well, there are a lot more NOPs on PPC, but most of them can be detected pretty easily. If NOP detection were implemented in an IDS, though, NOPs could be replaced with dead code instead - choose random operations from {add, sub, mul, and, ori, xor} and three random registers to create pseudorandom no-op code.
Attachment:
PGP.sig
Description: This is a digitally signed message part
Current thread:
- On Polymorphic Evasion Phantasmal Phantasmagoria (Oct 01)
- Re: On Polymorphic Evasion zero (Oct 02)
- Re: On Polymorphic Evasion Ali Campbell (Oct 02)
- Re: On Polymorphic Evasion Andrew Farmer (Oct 02)
- Re: On Polymorphic Evasion Ali Campbell (Oct 02)
- Re: On Polymorphic Evasion Vlad902 (Oct 02)
- <Possible follow-ups>
- Re: On Polymorphic Evasion PERFECT. MATERIAL (Oct 01)
- Re: Re: On Polymorphic Evasion xbud (Oct 01)
- Re: Re: On Polymorphic Evasion PERFECT.MATERIAL (Oct 01)
- Re: Re: On Polymorphic Evasion xbud (Oct 01)
- Re: Re: On Polymorphic Evasion r00t3d (Oct 02)
- Re: Re: On Polymorphic Evasion James Tucker (Oct 02)
- Re: On Polymorphic Evasion zero (Oct 02)