4 ms·

You don't need jmp, a faulting mov works as well, like mov CS, eax. https://github.com/xoreaxeaxeax/movfuscator#notes https://github.com/xoreaxeaxeax/movfuscat

• LegionMammal978 3y ago
  However, the movfuscator as implemented does still require a sigaction(2) syscall (via an INT 0x80 or similar) to set up a signal handler, under the justification that "it is not actually part of the program" and that "if we were in ring 0, we wouldn't need help from the kernel" [0]. The latter part seems a little dubious to me: without the help of the bootloader running non-MOV instructions, you'd never be able to escape from 16-bit real mode into 32-bit protected mode, since you wouldn't be able to load a valid GDT with the LGDT instruction. [0] https://github.com/xoreaxeaxeax/movfuscator/blob/90a49f312199a34075da0cc59c995e9ede642b8a/movfuscator/movfuscator.c#L2785 https://github.com/xoreaxeaxeax/movfuscator/blob/90a49f31219...