full-disclosure - On Polymorphic Evasion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: andfarm at teknovis.com (Andrew Farmer)
Subject: On Polymorphic Evasion

On 2 Oct 2004, at 11:49, Ali Campbell wrote:
> Does the fixed-length nature of RISC instructions make detecting a 
> shellcode on a platform such as PPC via IDS easier ? Or does the 
> larger availability of pseudo-NOP instructions on these platforms 
> (owing chiefly to more combinations of registers being available) in 
> fact make it harder ?
>
> I wrote some shellcode for OS X once, basically as an exercise, and I 
> caught myself wondering about this.

Well, there are a lot more NOPs on PPC, but most of them can be 
detected pretty easily. If NOP detection were implemented in an IDS, 
though, NOPs could be replaced with dead code instead - choose random 
operations from {add, sub, mul, and, ori, xor} and three random 
registers to create pseudorandom no-op code.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20041002/18d802d5/PGP.bin