Remix.run Logo
drfuchs 10 hours ago

Relatedly, there's a steganographic opportunity to hide info in machine code by using "XOR rax,rax" for a "zero" and "SUB rax,rax" for a "one" in your executable. Shouldn't be too hard to add a compiler feature to allow you to specify the string you want encoded into its output.

an hour ago | parent | next [-]
[deleted]
not_a_bijection 4 hours ago | parent | prev | next [-]

You can do better. X86 has both "op [mem], reg" and "op reg, [mem]" variants of most instructions, where "[mem]" can be a register too. So you have two ways to encode "xor eax, eax", differing by which of the operands is in the "possible memory operand" slot, the source or the destination.

mpeg 3 hours ago | parent [-]

This one would be a fun challenge in a ctf, or maybe more appropriate for a puzzle hunt – most people would look at the dissassembly and not at the actual bytes and completely miss the binary encoding

EvanAnderson 3 hours ago | parent | prev | next [-]

That could be a style metric, too. Time spent reversing MS-DOS viruses in my youth showed me assembler programmers very clearly have styles to their code. It's too weak for definitive attribution but it was interesting to see "rhymes" between, for example, the viruses written by The Dark Avenger.

gynvael 6 hours ago | parent | prev [-]

This sounds like a Paged Out article ;)

defmacr0 4 hours ago | parent [-]

https://www.cs.columbia.edu/~angelos/Papers/hydan.pdf

Here's some more prior art