------------------------- priestmasters nop secrets ----------------------------
------------------------- <priest@priestmaster.org> ----------------------------
------------------------ http://www.priestmaster.org --------------------------

* What is a nop, why we need nops ?

Nop stands for no operation. If the cpu calls the nop instruction, the cpu
do nothing, but a nop instruction consume time. Nops are often needed by
exploit coders. If we found a way to jump to a user specified function
(shellcode in most exploit's), we need the exact address of the shellcode. But
if our buffer is larger then the shellcode, we can add such nops at the
beginning of the buffer. Now its easier to hit one of the
nops. We can jump to any location filled with nops. The nops are executed and
after the nops, the shellcode is executed.


* Nops in exploit coders environment

In most cases, we use the intel nop instruction to fill our exploit buffer.
The machine instruction nop is 0x90 (hexadecimal 90) in ascii. But we can
use other instruction, which do anything, we do not need. An example of
such nops are: A, B, C, D and many others. You can use "ABCDABCD and so on"
as your nop sled, or "GGGGGGGGGGAAABBBB", ... This instructions do such
things like inc cx, inc dx, inc bx, ... We can call such instructions, because
they do not change anything in the shellcode, because the registers are set
to zero in our shellcode (xor eax, eax for example).


* Nops and Intrusion Detection Systems

IDS search for shellcode and nop sleds. To circumvent this, we can use
encrypted or polymorph shellcode and random nop sleds. If you use a nop
sled like "\x90\x90\x90...", this is easy to detect. "ABCABCABCABC" is
also easy to detect, because "ABCD" repeats to often. The best way to
generate a nop sled is a random nop sled. The file nops.c includes a 
random nop sled generator. We only use alphanumeric characters (A-Z)
for the nop sled.


* How to use nops.c program ?

Compile it with "make" or "gcc nops.c -o nops", then

- ./nops 10 > file

The output is

- cat file
FJMCRILICMuser@domain.com

You can use this with perl like exploitation. Example:

- echo `nops 10``cat shellcode`

You can copy the function get_nops to your own exploit. Call it with your
exploit buffer. Function is:

- int gen_nops(char *buffer, int size)

buffer is a allocated buffer and size is how many chars of buffer shuold
contain random nop data. My tip is: fill the whole buffer with random
nop data and then copy the shellcode and other stuff into the buffer.

I hope this helps a little bit.

If you have questions, mail me or visit my homepage.

Happy hacking :-)

priestmaster <priest@priestmaster.org>
