5 ms·

Running out of hex words?

40 points by rschildmeijer 16y ago

deadbeaf and cafebabe is so 2010

rschildmeijer 16y ago
5ca1ab1e, ca11ab1e. to mention a few
ComputerGuru 16y ago
Very incomplete list. His algorithm skips multiple permutations of the same word. Doesn't even have popular ones like d34d, c4f3, b33f, and believe it or not 1337!
- deleted 16y ago
  [deleted]
- rschildmeijer 16y ago
  cant believe he issed 1337
- iclelland 16y ago
  Um, that's mostly because there's no real need to substitute 'a' with '4', because 'a' is a valid hex digit. Same goes for 'e' and '3'. If you look, 'dead', 'cafe', 'beef', and even '1ee7' are in the list.
  - ComputerGuru 16y ago
    Um, I know. That's actually what I said - there is no support for multiple permutations. If you're geeky enough to be using hexadecimal seed values that look like words, you'll appreciate 0xD34DBEEF more than you will 0xdeadbeef. Or maybe you won't. But it's still a valid option, and IMHO, his algorithm shouldn't have ignored them.
douglasfshearer 16y ago
The following paper may be of interest, it takes this idea considerably further: "Specifically, we demonstrate a technique for automatically producing English Shellcode, transforming arbitrary shell- code into a representation that is superficially similar to English prose." http://www.cs.jhu.edu/~sam/ccs243-mason.pdf http://www.cs.jhu.edu/~sam/ccs243-mason.pdf
jrockway 16y ago
I think malloc implementations that zero memory should be required to switch to 0xa110ca7ed0 instead. Imagine a debugging session where you wonder, "is this memory allocated?" and then you type "x 5" and you get "a1 10 ca 7e d0". "Yes," you will be able to reply to yourself, "it is allocated."
- mahmud 16y ago
  Isn't that, like, the oldest debugging trick in the world? First thing you do to trace dataflow in an application is feed it known junk and search for that in memory. I loved "XXXXXXXXXX" when I was a cracker; lights the hex-view on fire with my lucky 888888888888888s, and you could pick it out if it was disassembled as code by mistake, since it's a series of "POP AX"s :-)
labria 16y ago
d34dc0de is my favourite one, not on this list =(
- quanticle 16y ago
  Well, he did say that his list only includes single words, not truncations (e.g. 'decaf') or compound words (e.g. 'deadbeef', 'deadc0de', etc.).
forgotusername 16y ago
Another simple approach seen in many places (e.g. Nucleus OS) is using ASCII characters. That way, you get a unique identifier and as you get quicker at recognising them, you also get to immediately ASCII character values in hex, which is great for e.g. looking at coredumps.. >>> 'SEMA'.encode('hex') '53454d41'
zaphoyd 16y ago
IPv6 will provide another market for readable hex words host www.v6.facebook.com www.v6.facebook.com has IPv6 address 2620:0:1cfe:face:b00c::3

40 points by rschildmeijer 16y ago

deadbeaf and cafebabe is so 2010

rschildmeijer 16y ago

5ca1ab1e, ca11ab1e. to mention a few

ComputerGuru 16y ago

Very incomplete list. His algorithm skips multiple permutations of the same word. Doesn't even have popular ones like d34d, c4f3, b33f, and believe it or not 1337!

deleted 16y ago
[deleted]
rschildmeijer 16y ago
cant believe he issed 1337
iclelland 16y ago
Um, that's mostly because there's no real need to substitute 'a' with '4', because 'a' is a valid hex digit. Same goes for 'e' and '3'. If you look, 'dead', 'cafe', 'beef', and even '1ee7' are in the list.
- ComputerGuru 16y ago
  Um, I know. That's actually what I said - there is no support for multiple permutations. If you're geeky enough to be using hexadecimal seed values that look like words, you'll appreciate 0xD34DBEEF more than you will 0xdeadbeef. Or maybe you won't. But it's still a valid option, and IMHO, his algorithm shouldn't have ignored them.

douglasfshearer 16y ago

The following paper may be of interest, it takes this idea considerably further: "Specifically, we demonstrate a technique for automatically producing English Shellcode, transforming arbitrary shell- code into a representation that is superficially similar to English prose." http://www.cs.jhu.edu/~sam/ccs243-mason.pdf http://www.cs.jhu.edu/~sam/ccs243-mason.pdf

jrockway 16y ago

I think malloc implementations that zero memory should be required to switch to 0xa110ca7ed0 instead. Imagine a debugging session where you wonder, "is this memory allocated?" and then you type "x 5" and you get "a1 10 ca 7e d0". "Yes," you will be able to reply to yourself, "it is allocated."

mahmud 16y ago
Isn't that, like, the oldest debugging trick in the world? First thing you do to trace dataflow in an application is feed it known junk and search for that in memory. I loved "XXXXXXXXXX" when I was a cracker; lights the hex-view on fire with my lucky 888888888888888s, and you could pick it out if it was disassembled as code by mistake, since it's a series of "POP AX"s :-)

labria 16y ago

d34dc0de is my favourite one, not on this list =(

quanticle 16y ago
Well, he did say that his list only includes single words, not truncations (e.g. 'decaf') or compound words (e.g. 'deadbeef', 'deadc0de', etc.).

forgotusername 16y ago

Another simple approach seen in many places (e.g. Nucleus OS) is using ASCII characters. That way, you get a unique identifier and as you get quicker at recognising them, you also get to immediately ASCII character values in hex, which is great for e.g. looking at coredumps.. >>> 'SEMA'.encode('hex') '53454d41'

zaphoyd 16y ago

IPv6 will provide another market for readable hex words host www.v6.facebook.com www.v6.facebook.com has IPv6 address 2620:0:1cfe:face:b00c::3