It is hard to be precise with the offset value that gets placed into the return register when an overflow is deliberate, as in during an attack. A NOOP sled cane be placed at the beginning of the shell code to create some margin for error. Which of the following looks like a sled?
A) 0xA4\0x23\0xFE\0x65\0xA5\0x65\0xAE\0x5B
B) 0xFF\0xFF\0xFF\0xFF\0xFF\0xFF\0xFF\0xFF\
C) 0x00\0x0D\0x0A\0xFF\0x00\0x0D\0x0A\0xFF\
D) 0x90\0x90\0x90\0x90\0x90\0x90\0x90\0x90\

Question

Quizplus · Accepted Answer

Detection of a buffer overflow attempt will involve 0x90, NOOP, or NOPS. Be carefull about the last one. NOPS can also just mean "No OPtions Set" if yor are looking at a packet header. Context matters a lot on this exam.

It Is Hard to Be Precise with the Offset Value