Running out of hex words? | Hacker News Reader

Running out of hex words?

nedbatchelder.com

40 pointsrschildmeijer12 comments

deadbeaf and cafebabe is so 2010

I think malloc implementations that zero memory should be required to switch to 0xa110ca7ed0 instead. Imagine a debugging session where you wonder, "is this memory allocated?" and then you type "x 5" and you get "a1 10 ca 7e d0". "Yes," you will be able to reply to yourself, "it is allocated."

Isn't that, like, the oldest debugging trick in the world? First thing you do to trace dataflow in an application is feed it known junk and search for that in memory.

I loved "XXXXXXXXXX" when I was a cracker; lights the hex-view on fire with my lucky 888888888888888s, and you could pick it out if it was disassembled as code by mistake, since it's a series of "POP AX"s :-)

The following paper may be of interest, it takes this idea considerably further:

"Specifically, we demonstrate a technique for automatically producing English Shellcode, transforming arbitrary shell- code into a representation that is superficially similar to English prose."

http://www.cs.jhu.edu/~sam/ccs243-mason.pdf

IPv6 will provide another market for readable hex words

host www.v6.facebook.com www.v6.facebook.com has IPv6 address 2620:0:1cfe:face:b00c::3

Another simple approach seen in many places (e.g. Nucleus OS) is using ASCII characters. That way, you get a unique identifier and as you get quicker at recognising them, you also get to immediately ASCII character values in hex, which is great for e.g. looking at coredumps..

    >>> 'SEMA'.encode('hex')
    '53454d41'

Very incomplete list. His algorithm skips multiple permutations of the same word.

Doesn't even have popular ones like d34d, c4f3, b33f, and believe it or not 1337!

cant believe he issed 1337

Um, that's mostly because there's no real need to substitute 'a' with '4', because 'a' is a valid hex digit. Same goes for 'e' and '3'.

If you look, 'dead', 'cafe', 'beef', and even '1ee7' are in the list.

Um, I know. That's actually what I said - there is no support for multiple permutations.

If you're geeky enough to be using hexadecimal seed values that look like words, you'll appreciate 0xD34DBEEF more than you will 0xdeadbeef. Or maybe you won't. But it's still a valid option, and IMHO, his algorithm shouldn't have ignored them.

5ca1ab1e, ca11ab1e. to mention a few

d34dc0de is my favourite one, not on this list =(

Well, he did say that his list only includes single words, not truncations (e.g. 'decaf') or compound words (e.g. 'deadbeef', 'deadc0de', etc.).

Reply on news.ycombinator.com