NOP slide

<h2 id="detection">Detection</h2>
<p>Many techniques exist to detect the presence of NOP slides in memory.  For example, in 2005, Greek researchers found that they can be easily detected by checking whether a memory image contains a lengthy sequence of bytes such that each starting offset within the sequence is valid and leads execution to the same place.<a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a>
</p>
<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/Heap_spraying/yfz8YhM9">Heap spraying</a>, a technique which is complementary to the use of NOP slides</li>
<li><a href="/facts/Buffer_overflow/uMFduL4B">Buffer overflow § NOP sled technique</a></li>
<li><a href="/facts/Worm_memory_test/f35kPt33">Worm memory test</a></li></ul>

<h2 id="external-links">External links</h2>
<ul><li><a href="https://web.archive.org/web/20110724121346/http://www.phreedom.org/solar/honeynet/scan20/scan20.html">Use of a NOP slide</a> to compromise a system</li>
<li>Neville, Alan (2010-03-20). <a href="https://web.archive.org/web/20120331162546/http://www.bandwidthco.com/sf_whitepapers/compforensics/IDS%20Logs%20in%20Forensics%20Investigations%20-%20An%20Analysis%20of%20a%20Compromised%20Honeypot.pdf">"IDS Logs in Forensics Investigations: An Analysis of a Compromised Honeypot"</a> (PDF). Archived from the original on 2012-03-31. Retrieved 2011-09-03.</li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>corelanc0d3r (2011-12-31). "Exploit writing tutorial part 11: Heap Spraying Demystified". Corelan Team. Archived from the original on 2015-04-25. Retrieved 2014-01-15.{{cite web}}:  CS1 maint: numeric names: authors list (link) <a href="https://web.archive.org/web/20150425014200/https://www.corelan.be/index.php/2011/12/31/exploit-writing-tutorial-part-11-heap-spraying-demystified/#0x0c0c0c0c" target="_blank">https://web.archive.org/web/20150425014200/https://www.corelan.be/index.php/2011/12/31/exploit-writing-tutorial-part-11-heap-spraying-demystified/#0x0c0c0c0c</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
<li id="fn:2"><p>Vangelis (2004-12-08). "Stack-based Overflow Exploit: Introduction to Classical and Advanced Overflow Technique". Wowhacker via Neworder. Archived from the original (text) on 2007-08-18. {{cite journal}}: Cite journal requires |journal= (help) <a href="https://web.archive.org/web/20070818115455/http://www.neworder.box.sk/newsread.php?newsid=12476" target="_blank">https://web.archive.org/web/20070818115455/http://www.neworder.box.sk/newsread.php?newsid=12476</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li>
<li id="fn:3"><p>Balaban, Murat. "Buffer Overflows Demystified". Enderunix.org. Archived from the original on 2004-08-12. {{cite journal}}: Cite journal requires |journal= (help) <a href="https://web.archive.org/web/20040812221752/http://enderunix.org/docs/en/bof-eng.txt" target="_blank">https://web.archive.org/web/20040812221752/http://enderunix.org/docs/en/bof-eng.txt</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li>
<li id="fn:4"><p>Akritidis, P.; Markatos, Evangelos P.; Polychronakis, M.; Anagnostakis, Kostas D. (2005). "STRIDE: Polymorphic Sled Detection through Instruction Sequence Analysis" (PDF). Proceedings of the 20th IFIP International Information Security Conference (IFIP/SEC 2005). IFIP International Information Security Conference. Archived from the original (PDF) on 2012-09-01. Retrieved 2012-03-04. <a href="https://web.archive.org/web/20120901034404/http://dcs.ics.forth.gr/Activities/papers/stride-IFIP-SEC05.pdf" target="_blank">https://web.archive.org/web/20120901034404/http://dcs.ics.forth.gr/Activities/papers/stride-IFIP-SEC05.pdf</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li>
<li id="fn:5"><p>Klein, Christian (September 2004). "Buffer Overflow" (PDF). Archived from the original (PDF) on 2007-09-28. {{cite journal}}: Cite journal requires |journal= (help) <a href="https://web.archive.org/web/20070928011639/http://c0re.23.nu/~chris/presentations/overflow2005.pdf" target="_blank">https://web.archive.org/web/20070928011639/http://c0re.23.nu/~chris/presentations/overflow2005.pdf</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li>
<li id="fn:6"><p>Akritidis, P.; Markatos, E. P.; Polychronakis, M.; Anagnostakis, K. (2005). "STRIDE: Polymorphic Sled Detection Through Instruction Sequence Analysis". Security and Privacy in the Age of Ubiquitous Computing. IFIP Advances in Information and Communication Technology. Vol. 181. pp. 375–391. doi:10.1007/0-387-25660-1_25. ISBN 978-0-387-25658-0. {{cite book}}: |journal= ignored (help) <a href="978-0-387-25658-0" target="_blank">978-0-387-25658-0</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li>
</ol>

NOP slide open-in-new

NOP slide