54 ms·
This technique is known as a NOP sled. You have to change all the bytes in the jump to NOPs (opcode 0x90). https://en.wikipedia.org/wiki/NOP_slide https://en.w
by 29athrowaway 6y ago
This technique is known as a NOP sled. You have to change all the bytes in the jump to NOPs (opcode 0x90).
https://en.wikipedia.org/wiki/NOP_slide https://en.wikipedia.org/wiki/NOP_slide
- ashkankiani 6y agoI may have used that technique once or twice in Ollydbg before, but I didn't realize it had a name. Thanks for that.
- 29athrowaway 6y agoOllyDbg has been discontinued but now you can use one of its spiritual successors: - https://github.com/eteran/edb-debugger https://github.com/eteran/edb-debugger - https://x64dbg.com/ https://x64dbg.com/ Other tools you might like... - https://cutter.re/ https://cutter.re/ - https://github.com/longld/peda https://github.com/longld/peda - https://github.com/Gallopsled/pwntools https://github.com/Gallopsled/pwntools And of course, Ghidra, that means no mention.
- _Microft 6y agoA NOP slide is a slightly different thing. The NOPs as suggested by GP are meant to replace unwanted instructions. The purpose of a NOP slide is to serve as target area for jumps and to guide the flow of execution to a particular adress at the end of the slide, independent of where in the NOPed range a jump was actually executed to.