I Understand that adding NOP-Sled will increase the possibility of the attack, but why do we need to add more than a copy of NOP-sled + shellcode? if we have one big NOP_sled+shellcode it will be more possible to find the shellcode on the heap.

  • Don't know what exploit you're referring to, since not all exploits require a NOP sled even, given an attacker has sufficient enough control over the execution of a program. But for any example where you need to perform a heap-spray, there are benefits to aligning your data in arbitrarily sized pockets of memory between other objects. For example, in a heap that's become fragmented, objects may be spread randomly throughout a given memory layout, and an attempt to acquire one large allocation could be much less successful than several smaller ones. – dreamist Mar 21 '17 at 13:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.