Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Best of show – abuse of libc

ioccc.org

Post reply on HN
Print view View original

31–40 of 84 posts

Re: Best of show – abuse of libc

#31

Post by jcande »

archi42 wrote: post #23
klyrs wrote: post #16

Earlier quoted context omitted.

That's fun, but esoteric languages in general and brainfuck in specific tend to lack things you'd want out of c: file system access, system calls, etc.

Hm, I think you could add numeric syscalls, similar to what happens at the asm level. E.g. put the syscall id and some parameters on the "stack", then let the interpreter run the syscall with a new "instruction" e.g. '!'. This could even substitute '.' (putchar) and ',' (getchar), since these are very much just syscalls. So that would reduce the number of instructions by one (to 7). Oh, getting to 6 would also be fun…

That was my approach for an analogous program that uses memcpy instead of printf. I didn't go with the jit-style you describe, however. If you're curious here's how I setup the syscalls https://github.com/jcande/xenocryst/blob/master/src/gadgets.... and here's the main loop https://github.com/jcande/xenocryst/blob/master/src/exec.c#L...

Re: Best of show – abuse of libc

#32

Post by dang »

aftbit wrote: post #20
dang wrote: post #2

General thread here: https://news.ycombinator.com/item?id=25651942

Personally I find it amusing that the 0-signal comment "Thanks for all dang" is upvoted while the opposite 0-signal comment "Thanks for nothing dang" is downvoted. I mean, I think dang is chill, but neither of these really contributes to the discussion any more than the other, so shouldn't they have the same score? Upvotes really are a popularity contest these days.

This was addressed by pg over a decade ago: https://news.ycombinator.com/newswelcome.html

Empty comments can be ok if they're positive. There's nothing wrong with submitting a comment saying just "Thanks." What we especially discourage are comments that are empty and negative—comments that are mere name-calling.

If you think in terms of what's good/bad for community it may make more sense.

(I hope it's clear this applies whether or not the mods were mentioned in either a positive or negative way.)

Re: Best of show – abuse of libc

#33

Post by FartyMcFarter »

tomjakubowski wrote: post #12
rightbyte wrote: post #8

Earlier quoted context omitted.

There is some innocent beauty in the twistedness of printf - especially with GNU extensions.

GNU's printf specifier language is Turing complete, I believe.

Presumably it needs a loop around it, so it's not Turing-complete by itself?

Re: Best of show – abuse of libc

#34

Post by astrange »

saagarjha wrote: post #30
wahern wrote: post #27

Earlier quoted context omitted.

Another interesting factoid is that macOS only supports %n if the format string is located in read-only memory. Per printf(3) on macOS: > For this reason, a format argument containing %n is assumed to be untrustworthy if located in writable memory (i.e. memory with protection PROT_WRITE; see mprotect(2)) and any attempt to use such an argument is fatal. Practically, this means that %n is permitted in literal format s…

Someone should inform The Open Group about this violation of POSIX ;) Another fun fact: glibc does this too, if you compile with -D_FORTIFY_SOURCE=2. However, since Linux lacks the nice vm_region APIs the code opens up /proc/self/maps :/

dyld on Darwin has an API to ask if any pointer is to a read-only section of a binary. It’s useful because you can e.g. skip strcpys and other allocations.

Re: Best of show – abuse of libc

#35

Post by enedil »

saagarjha wrote: post #28

For those interested in more Turing complete format strings, look no further than the "sprint" challenge from this year's Google CTF Quals: https://ctftime.org/task/12834 . It's sprintf in a loop this time and the program simulates a maze: https://github.com/google/google-ctf/tree/master/2020/quals/...

The author works at Google, so I suspect he's the same who created this challenge. Really enjoyable, although I didn't manage to solve it during contest.

Re: Best of show – abuse of libc

#36

Post by lifthrasiir »

felixr wrote: post #14
hahajk wrote: post #9

Earlier quoted context omitted.

https://github.com/HexHive/printbf well this is a brainfuck interpreter inside printf. I’m pretty sure there are plenty of c-to-bf transpilers.

This is by the same author as the ioccc entry and also one of authors of the paper showing the turing completeness of printf http://nebelwelt.net/publications/#15SEC

Ah, that explains everything. I have already seen this technique before and wondered why this entry has to be the best of show---I don't doubt it is worth the prize, just that it didn't sound very novel. But it all makes sense if the technique is not well known and authors tried to revitalize that.

Re: Best of show – abuse of libc

#37

Post by olliej »

%n has frequently been used as an attack vector - generally in the context of the other poor practice of printf(, ...)

It’s actually intentionally disallowed in some libc implementations.

Re: Best of show – abuse of libc

#38

Post by enedil »

archi42 wrote: post #23
klyrs wrote: post #16

Earlier quoted context omitted.

That's fun, but esoteric languages in general and brainfuck in specific tend to lack things you'd want out of c: file system access, system calls, etc.

Hm, I think you could add numeric syscalls, similar to what happens at the asm level. E.g. put the syscall id and some parameters on the "stack", then let the interpreter run the syscall with a new "instruction" e.g. '!'. This could even substitute '.' (putchar) and ',' (getchar), since these are very much just syscalls. So that would reduce the number of instructions by one (to 7). Oh, getting to 6 would also be fun…

It's already implemented: https://github.com/ajyoon/systemf There is even an HTTP server built with it.

Re: Best of show – abuse of libc

#39

Post by lathiat »

badsectoracula wrote: post #7

Up next: a C compiler that compiles to printf statements :-P

There is somewhere a compiler that outputs to all sorts of crazy languages including awk, sed, printf, etc.. but I can't find it right now. Hopefully someone knows what I'm talking about.

I feel like it did LLVM IR to a bunch of languages or something like that.. but my memory is faulty.

Re: Best of show – abuse of libc

#40

Post by archi42 »

enedil wrote: post #38
archi42 wrote: post #23

Earlier quoted context omitted.

Hm, I think you could add numeric syscalls, similar to what happens at the asm level. E.g. put the syscall id and some parameters on the "stack", then let the interpreter run the syscall with a new "instruction" e.g. '!'. This could even substitute '.' (putchar) and ',' (getchar), since these are very much just syscalls. So that would reduce the number of instructions by one (to 7). Oh, getting to 6 would also be fun…

It's already implemented: https://github.com/ajyoon/systemf There is even an HTTP server built with it.

Why am I not even surprised...? I thought about writing a sentence about how (relatively) easy it would be to build a verified compiler (think CompCert-for-brainfuck); I'd guess the outcome is one of (a) "someone already did that as well, here is the link" or (b) "I spent the weekend with that, here is the project on github". The Internet is awesome, as are people :)
Post reply on HN