SolarNet addresses one aspect of the issue but there's another important one here for PowerPC. Every instruction has to start on a 4-byte boundary[1] so if a s

SolarNet addresses one aspect of the issue but there's another important one here for PowerPC. Every instruction has to start on a 4-byte boundary[1] so if a sequence of bytes that make up the Evil Instruction is present but at a 1 byte offset you're still perfectly safe. This isn't true for x86, where if you start executing at byte 1000 you might get one valid sequence of instructions but if you start executing at byte 1001 you might get another equally valid but malicious sequence[2]. [1] Unless there's some variable width mode like ARM's thumb I'm not aware of, but even then you're limited to 2 byte boundaries. [2]http://mainisusuallyafunction.blogspot.com/2012/11/attacking-hardened-linux-systems-with.html http://mainisusuallyafunction.blogspot.com/2012/11/attacking...