what I'm looking for
I have a binary that, for various reasons, I'm pretty sure is executable machine code (although possibly for a VM language, although I doubt it's Java). I'm looking for a table of byte frequencies for byte values v. architecture.
I recognize that those values will vary by compiler, operating system ABI / API, application, and binary format, but for my purposes I'm assuming they vary most markedly by architecture, and:
- I just need frequencies for the actual executable code- the
.textsection- not the entire binary.
- the binary's targeting one of the most common end-user operating systems from 1985 - 2005 (so, old-style unices, Linux, VMS, DOS, Windows NT, MacOS, or OSX).
- it was compiled with default flags on the most common compilers for those systems
If all that fails, I'd at least want a list of
Wait, there's this list on wikipedia. Thank you, wikipedia.
nop opcodes for all the most common architectures, since I think it's probably fair to assume most compilers use nops for padding, and runs of nops will help me figure out where a good entry point for a disassembler would be.
my use case
I have a snippet of a binary, which I'm pretty sure is executable object code (sans headers / section information. I think it's the
.text section (or whatever you'd call that) in its original format).
I'm not sure that it's even from a binary, but when converted to a grayscale bitmap it has some clear patterns (stripes at regular intervals), and I've noticed that the bytes
FF FF appear often enough, and beside other bytes in the form
Fx, that I get the feeling I'm looking at high memory addresses. The shannon entropy is low enough I'm pretty sure it's not compressed or encrypted (around 7.76), but all 256 possible byte values are represented.
I can't actually give the hexdump itself for personal reasons.