Assembly Language is Too High Level

Assembly and Machine Code

Assembly language is often described as one-to-one with machine code, but this is incorrect. Assembly instructions can have multiple valid machine-code representations.

Redundant Encoding

Single assembly instructions can encode as different machine code bytes, and different machine code can decode to equivalent instructions. Understanding these redundancies reveals security implications.

IRASM Tool

The Interactive Redundant Assembler (irasm) is released, allowing exploration of alternate machine-code representations. Tool output can be used in tools like mona for self-modifying code and exploitation.

Applications

Use cases include creating alternate shellcode representations, improving tool flexibility, and applying stego techniques. Understanding machine-code redundancy provides additional options for sophisticated exploitation and evasion.