312-50V11 · Question #685
You are programming a buffer overflow exploit and you want to create a NOP sled of 200 bytes in the program exploit.c What is the hexadecimal value of NOP instruction?
The correct answer is D. 0x90. The x86 NOP (No Operation) instruction has the opcode value 0x90, and a sequence of NOP bytes forms a NOP sled used in buffer overflow exploits to reliably redirect execution to shellcode.
Question
You are programming a buffer overflow exploit and you want to create a NOP sled of 200 bytes in the program exploit.c What is the hexadecimal value of NOP instruction?
Options
- A0x60
- B0x80
- C0x70
- D0x90
How the community answered
(15 responses)- B7% (1)
- C7% (1)
- D87% (13)
Why each option
The x86 NOP (No Operation) instruction has the opcode value 0x90, and a sequence of NOP bytes forms a NOP sled used in buffer overflow exploits to reliably redirect execution to shellcode.
0x60 is the opcode for the PUSHA instruction on x86, which pushes all general-purpose registers onto the stack and is unrelated to no-operation behavior.
0x80 is a prefix byte used in x86 immediate arithmetic and logical instructions such as ADD, SUB, and CMP with byte-sized immediate operands, not a NOP.
0x70 is the opcode for the JO short conditional jump instruction on x86, which transfers execution if the overflow flag is set and has no no-operation semantics.
On x86 architecture, the NOP instruction is encoded as the single byte 0x90 (decimal 144), which tells the CPU to do nothing and advance to the next instruction. In buffer overflow exploit development, a NOP sled consisting of 200 consecutive 0x90 bytes is placed before the shellcode so that if the hijacked return address lands anywhere within the sled, execution slides sequentially through all the no-ops until it reaches and executes the shellcode, greatly increasing reliability when the exact stack offset is uncertain.
Concept tested: x86 NOP opcode 0x90 in buffer overflow NOP sled
Source: https://www.intel.com/content/www/us/en/developer/articles/technical/intel-sdm.html
Topics
Community Discussion
No community discussion yet for this question.