From: Mark Rogaski <wendigo@pobox.com>
Date: Mon, 11 Nov 1996 04:17:03 -0800 (PST)
To: mhayes@infomatch.com
Subject: Re: Sifting data; looking for "strong crypto"
In-Reply-To: <199611110903.BAA07962@infomatch.com>
Message-ID: <199611111218.HAA09575@gate.cybernex.net>
MIME-Version: 1.0
Content-Type: text/plain


An entity claiming to be Murray Hayes wrote:
: 
: 
: As far as bit patterns go, is executable code random?
: 
: mhayes@infomatch.com
: 
: It's better for us if you don't understand
: It's better for me if you don't understand
:                                              -Tragically Hip
: 

Nope, any executable has the same text-data-stack structure.  Within the
text segment, all instructions are (usually) of the same size with 
one to four possible formats.  Consider that every instruction will
begin with one of ~128 opcodes, operands are pretty predictable depending
on the opcode's associated format.  Any references to symbol and literal
tables are within a predictable range, and the format of these tables
is fixed.

An assembled/linked program is going to be very far from random, same
basic patterns are used for I/O, subroutine calls, iterative loops, etc.
I would assume that the entropy of an executable binary is extremely low.

mark


-- 
[]  Mark Rogaski                    
[]  wendigo@pobox.com               
[]  http://www.pobox.com/~wendigo/  
[]  >> finger for PGP pubkey <<