Alphanumeric barcode for horse racing

Question

I am trying to write some shellcode, which will eventually be in the form of an English paragraph. This means that I'm mostly limited to instructions that have opcodes that are evaluated by alphanumeric characters or punctuation. This actually leaves me with many different transition commands, including: jo , jno , jb , jae , je , jno , jb , ja , js , jns , and jp (which correspond to the letters pz ). Each of these jumps performs a test before it decides to jump or not. In most cases, I can combine the jump plus its reverse to ensure that the jump will take place in shellcode (for example, using jo , then jno or je , then jne ), but I can not do this in the case of jb . The test for jb is CF=1 .

My question is, is there any series of alphanumeric instructions, functionally NOP, but also guarantee that CF=1 ? CF is the carry flag, so any operations guaranteed to set the carry flag will suffice.

Also, to ensure jae , in any case, make sure CF=0 ?

Answer 1

You can use "4444" to set the CF to 0.

"44" is XOR AL, 0x34 .

2 XORs with the same result value do not change in AL .

It should be noted that XOR affects almost all arithmetic flags (the effect on AF is undefined). So this is not completely "NOP".

In 32-bit mode, you can use "PhohohX7X" to set the CF to 1.

"P" - PUSH EAX .
"hohoh" PUSH 0x686F686F .
"X" is POP EAX .
"7" is AAA .
"X" is POP EAX .

There is a reservation with AAA . Its influence on most arithmetic flags is undefined ( CF and AF excluded, they become equal). Therefore, it is not completely "NOP".