←back to thread

276 points chei0aiV | 2 comments | | HN request time: 0.431s | source
Show context
seccess ◴[] No.10459977[source]
An interesting point I read awhile ago (wish I could find the article) is that variable-length instruction sets (like x86) are preferred by authors of malicious software over fixed length sets because the binaries are harder to analyze. That is because in variable length ISAs, you must use a recursive decent parser to find all code paths in the program, because jump targets are specified in bytes or words instead of discrete instructions. This allows someone to jump into what might be the data portion of an instruction when parsed one way, and now the behavior totally changes because the bytes are being interpreted another way.
replies(3): >>10460058 #>>10460229 #>>10461969 #
1. kaesve ◴[] No.10460058[source]
Are you talking about "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)"(https://cseweb.ucsd.edu/~hovav/dist/geometry.pdf)? Great paper with a great title.
replies(1): >>10460725 #
2. seccess ◴[] No.10460725[source]
I wasn't, I'm pretty sure it was a blog post not an academic paper. Regardless, this paper looks awesome thanks for the link :D