In the context of IDS entries, the 0x90 value is typically associated with which of the following?

• A. An encryption marker
• B. A checksum value
• C. A NOOP instruction used by Intel processors, often signaling a buffer overflow attempt
• D. A routine jump instruction

Answer: (C)

The 0x90 byte is the x86 NOOP (no-operation) instruction. In practice, attackers use a NOP sled—many 0x90 bytes—to pad payloads so the instruction pointer lands reliably in the actual shellcode regardless of small variations in where execution begins. Intrusion detection systems flag long sequences of 0x90 because they’re a common sign of buffer overflow attempts or shellcode delivery. It isn’t an encryption marker, a checksum, or a jump instruction (jumps use different opcodes like 0xEB or 0xE9). So the best match is a NOOP instruction used as padding to facilitate exploitation.