Hiding messages in x86 binaries using semantic duals (2020) | Hacker News Reader

Hiding messages in x86 binaries using semantic duals (2020)

blog.yossarian.net

38 pointswoodruffw4 comments

Discussed at the time:

Hiding messages in x86 binaries using semantic duals - https://news.ycombinator.com/item?id=24178188 - Aug 2020 (55 comments)

I wonder whether any other ISAs support something similar.

In 32 bit ARM you could get close with variations on a load/store instruction with an offset of 0.

  LDR R0, [R1]
  LDR R0, [R1, #-0]
  LDR R0, [R1, #0]!
  LDR R0, [R1], #0

Same instruction but different addressing modes and therefore different mnemonics.

Even in the unlikely event an ISA were to have no semantic confusion possibilities, there are plenty of covert channels in binaries, eg rearranging runtime addresses. (then there's the binary itself: even if we were to restrict ourselves to loading exactly the same process image, in general there are many different executable files that would do so)

Or even just changing the order of instructions whenever there are no dependencies.

Reply on news.ycombinator.com