NOP slide

In computer CPUs, a NOP slide, NOP sled or NOP ramp is a sequence of NOP (no-operation) instructions (on Intel x86, this is the opcode 0x90) meant to "slide" the CPU's instruction execution flow to its final, desired, destination. Generally a NOP slide will be used in cases where execution will branch into a position that cannot be determined with absolute accuracy, therefore "padding" the memory area before and after the approximate branch address is performed in the hope of avoiding an exception which would cause the program or system to crash. Once the CPU branches anywhere within the NOP slide, its instruction pointer (IP) will "slide" to its final destination, where there is valid code to be executed. This payload code may consist of executable instructions, a simple register spring, some return-oriented code, etc.

NOP slides can be used in buffer overflow and similar exploits designed to take over a program's execution path, or in defensive programming such as in EMC aware programming.

Example

If you were writing a numbered list of things for a person to do and you didn't know where he might start, you could add many "no operation" steps at the beginning and end, so that in most cases he would do something predictable, rather than beginning in the middle of the important steps.

1. Continue.
2. Continue.
3. Continue.
4. Place key in lock.
5. Turn key.
6. Continue.
7. Remove key from lock.
8. You're done.
9. Continue.
10. Continue.
11. Continue.
12. Continue.
13. Go to step 1.

See also

• Heap spraying, a technique which is complementary to the use of NOP slides

Sources

• Use of a NOP slide to compromise a system
• Alan Neville (March 20, 2010). "IDS Logs in Forensics Investigations: An Analysis of a Compromised Honeypot". http://www.bandwidthco.com/sf_whitepa pers/compforensics/IDS%20Logs%20in%20 Forensics%20Investigations%20-%20An%2 0Analysis%20of%20a%20Compromised%20Ho neypot.pdf. Retrieved September 3, 2011.