3 ms·
Relatedly, there's a steganographic opportunity to hide info in machine code by using "XOR rax,rax" for a "zero" and "SUB rax,rax" for a "one" in your executabl
by drfuchs 5mo ago
Relatedly, there's a steganographic opportunity to hide info in machine code by using "XOR rax,rax" for a "zero" and "SUB rax,rax" for a "one" in your executable. Shouldn't be too hard to add a compiler feature to allow you to specify the string you want encoded into its output.
- gynvael 5mo agoThis sounds like a Paged Out article ;)
- defmacr0 5mo agohttps://www.cs.columbia.edu/~angelos/Papers/hydan.pdf https://www.cs.columbia.edu/~angelos/Papers/hydan.pdf Here's some more prior art
- not_a_bijection 5mo agoYou can do better. X86 has both "op [mem], reg" and "op reg, [mem]" variants of most instructions, where "[mem]" can be a register too. So you have two ways to encode "xor eax, eax", differing by which of the operands is in the "possible memory operand" slot, the source or the destination.
- mpeg 5mo agoThis one would be a fun challenge in a ctf, or maybe more appropriate for a puzzle hunt – most people would look at the dissassembly and not at the actual bytes and completely miss the binary encoding
- zzo38computer 5mo agoSome disassembly listings will also include the actual bytes (there are multiple reasons why you will want this).
- EvanAnderson 5mo agoThat could be a style metric, too. Time spent reversing MS-DOS viruses in my youth showed me assembler programmers very clearly have styles to their code. It's too weak for definitive attribution but it was interesting to see "rhymes" between, for example, the viruses written by The Dark Avenger.
- deleted 5mo ago[deleted]