What's the easiest way for a third party to malleate a transaction? Let's say I am a node. A transaction has been relayed to me, and one of the scriptSig fields is:

&lt;sig&gt; &lt;pubKey&gt;


What is the easiest way for me to malleate this transaction?


For example, could I just add a "dummy" opcode to it, like this: OP_NOP &lt;sig&gt; &lt;pubKey&gt;?

Also, are certain types of scriptSig easier to malleate than others?


Basically, I'm interested in the most practical way a third party might go about malleating a transaction.
The easiest way to malleate a transaction is to just change the signature from Low-S to High-S and vice versa.