From: ph@netcom.com (Peter Hendrickson)
Date: Mon, 11 Nov 1996 20:45:08 -0800 (PST)
To: Mark Rogaski <mhayes@infomatch.com
Subject: Re: Sifting data; looking for "strong crypto"
Message-ID: <v02140b03aeada1e9eb07@[192.0.2.1]>
MIME-Version: 1.0
Content-Type: text/plain


At 7:18 AM 11/11/1996, Mark Rogaski wrote:
>An entity claiming to be Murray Hayes wrote:
>:
>:
>: As far as bit patterns go, is executable code random?
>:
>: mhayes@infomatch.com
>:
>: It's better for us if you don't understand
>: It's better for me if you don't understand
>:                                              -Tragically Hip
>:

> Nope, any executable has the same text-data-stack structure.  Within the
> text segment, all instructions are (usually) of the same size with
> one to four possible formats.  Consider that every instruction will
> begin with one of ~128 opcodes, operands are pretty predictable depending
> on the opcode's associated format.  Any references to symbol and literal
> tables are within a predictable range, and the format of these tables
> is fixed.

> An assembled/linked program is going to be very far from random, same
> basic patterns are used for I/O, subroutine calls, iterative loops, etc.
> I would assume that the entropy of an executable binary is extremely low.

It has been my experience that executable code compresses well, so there
is empirical evidence that you are right.

Peter Hendrickson
ph@netcom.com