nerdexam
EC-Council

312-50V10 · Question #685

You are programming a buffer overflow exploit and you want to create a NOP sled of 200 bytes in the program exploit.c What is the hexadecimal value of NOP instruction?

The correct answer is D. 0x90. On x86 architecture, the NOP (No Operation) instruction is represented by the opcode 0x90, which is used to build NOP sleds in buffer overflow exploits.

System Hacking

Question

You are programming a buffer overflow exploit and you want to create a NOP sled of 200 bytes in the program exploit.c What is the hexadecimal value of NOP instruction?

Options

  • A0x60
  • B0x80
  • C0x70
  • D0x90

How the community answered

(33 responses)
  • B
    3% (1)
  • C
    3% (1)
  • D
    94% (31)

Why each option

On x86 architecture, the NOP (No Operation) instruction is represented by the opcode 0x90, which is used to build NOP sleds in buffer overflow exploits.

A0x60

0x60 is the opcode for the PUSHA instruction on x86, which pushes all general-purpose registers onto the stack, not a no-operation instruction.

B0x80

0x80 is not a standalone NOP opcode; it is the leading byte of multi-byte arithmetic and logic group instructions such as ADD and SUB with immediate operands.

C0x70

0x70 is the opcode for JO (Jump if Overflow), a conditional branch instruction, not a no-operation instruction.

D0x90Correct

0x90 is the single-byte opcode for the NOP instruction on x86 processors, which causes the CPU to do nothing and advance to the next instruction. In buffer overflow exploitation, a NOP sled is a sequence of consecutive 0x90 bytes placed before shellcode so that any jump landing within the sled slides execution forward into the payload. This increases the reliability of exploits when the exact return address cannot be pinpointed.

Concept tested: x86 NOP opcode value in buffer overflow NOP sleds

Source: https://www.intel.com/content/www/us/en/developer/articles/technical/intel-sdm.html

Topics

#buffer overflow#NOP sled#shellcode#exploit development

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice