Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote code execution via MIDI messages

psi3.ru

Post reply on HN
Print view View original

51–60 of 86 posts

Re: Remote code execution via MIDI messages

#51

Post by liotier »

dhosek wrote: post #25
liotier wrote: post #7

Of course it is SysEx. SysEx is to standard MIDI what inline assembler is to Python. A world of undocumented proprietary stuff lurks within just about every MIDI device !

I wish it was somehow possible to perform a piece of music that would cause remote code execution. It’d be so cool to plug in a MIDI keyboard, play an Am6,9/G# and have it open a terminal window with root access.

> I wish it was somehow possible to perform a piece of music that would cause remote code execution

Cue Frankie Goes to Hollywood's "Relax" triggering Derek Zoolander to kill the Malaysian leader during fashion week

Re: Remote code execution via MIDI messages

#52

Post by portasynthinca3 »

liotier wrote: post #7

Of course it is SysEx. SysEx is to standard MIDI what inline assembler is to Python. A world of undocumented proprietary stuff lurks within just about every MIDI device !

> SysEx is to standard MIDI what inline assembler is to Python

I really like this comparison!

Re: Remote code execution via MIDI messages

#53

Post by p0w3n3d »

1oooqooq wrote: post #22
liotier wrote: post #7

Of course it is SysEx. SysEx is to standard MIDI what inline assembler is to Python. A world of undocumented proprietary stuff lurks within just about every MIDI device !

can't wait to see what sysEx hacks google will cram on chrome midi support they are building for the last couple years.

2030, browsers are TPMd DRMd and JAILed, one cannot simply access web with Firefox anymore:

  so we have jailbroken the Chrome using MIDI protocol to install extension that blocks ads

Re: Remote code execution via MIDI messages

#54

Post by odiroot »

liotier wrote: post #7

Of course it is SysEx. SysEx is to standard MIDI what inline assembler is to Python. A world of undocumented proprietary stuff lurks within just about every MIDI device !

SysEx is awesome. I'm quite sad modern synths seem to use it less and less (Roland!!!).

Though Behringer is still quite good with it. E.g. their Deepmind can be pretty much 100% programmed with it, on top of already good MIDI CC scope.

Re: Remote code execution via MIDI messages

#55

Post by odiroot »

Terr_ wrote: post #6

While I suggest reading the whole thing, the money-quotes: > So yeah, these [keyboard manufacturer] madlads made a shell that runs on top of MIDI SysEx messages on top of USB. > [T]he most interesting commands that we have are arbitrary memory read/write commands. So, if we really wanted to, we could just peek and poke the memory of the synth via MIDI. > If we wanted to, we could write these messages to a MIDI file a…

> > [T]he most interesting commands that we have are arbitrary memory read/write commands. So, if we really wanted to, we could just peek and poke the memory of the synth via MIDI.

This sounds easy but with SysEx having no delivery guarantees, and no sense of connection/session it can be frustrating. Totally normal to get "packet loss".

Re: Remote code execution via MIDI messages

#56

Post by b3orn »

Asooka wrote: post #46
dhosek wrote: post #25

Earlier quoted context omitted.

I wish it was somehow possible to perform a piece of music that would cause remote code execution. It’d be so cool to plug in a MIDI keyboard, play an Am6,9/G# and have it open a terminal window with root access.

Oh there definitely is some MIDI device out there that will get a buffer overrun from a particular set of just regular note inputs. Maybe 11 notes at once due to the programmer thinking "humans have only 10 fingers, a static array of 10 elements is enough to hold all notes currently playing".

More notes or voices playing than the player has fingers is quite common, a note doesn't stop just because you let go of the key. Sometimes you want it to ring out so most synthesizers handle that case. Some even let you configure the behaviour, for example you could reallocate the longest playing note or the closest note.

Re: Remote code execution via MIDI messages

#57

Post by lucasluitjes »

That is amazing research! Reminds me a bit of the 2017 research of RCE on a DNA sequencing machine by synthesizing shellcode in actual DNA/RNA molecules [0]. I was gonna say "next up: OSC" but I guess MIDI is still dominant.

[0] https://www.usenix.org/conference/usenixsecurity17/technical...

Re: Remote code execution via MIDI messages

#58

Post by dkdbejwi383 »

b3orn wrote: post #56
Asooka wrote: post #46

Earlier quoted context omitted.

Oh there definitely is some MIDI device out there that will get a buffer overrun from a particular set of just regular note inputs. Maybe 11 notes at once due to the programmer thinking "humans have only 10 fingers, a static array of 10 elements is enough to hold all notes currently playing".

More notes or voices playing than the player has fingers is quite common, a note doesn't stop just because you let go of the key. Sometimes you want it to ring out so most synthesizers handle that case. Some even let you configure the behaviour, for example you could reallocate the longest playing note or the closest note.

You'd still get a note off event, which would then trigger the release part of the envelope or whatever.

Re: Remote code execution via MIDI messages

#59

Post by b3orn »

dkdbejwi383 wrote: post #58
b3orn wrote: post #56

Earlier quoted context omitted.

More notes or voices playing than the player has fingers is quite common, a note doesn't stop just because you let go of the key. Sometimes you want it to ring out so most synthesizers handle that case. Some even let you configure the behaviour, for example you could reallocate the longest playing note or the closest note.

You'd still get a note off event, which would then trigger the release part of the envelope or whatever.

Yeah, but ideally you'd check if the note is actually playing as part of handling note off.

Re: Remote code execution via MIDI messages

#60

Post by prashnts »

1oooqooq wrote: post #22
liotier wrote: post #7

Of course it is SysEx. SysEx is to standard MIDI what inline assembler is to Python. A world of undocumented proprietary stuff lurks within just about every MIDI device !

can't wait to see what sysEx hacks google will cram on chrome midi support they are building for the last couple years.

I tried to make a bidirectional channel from a webpage to a python script over MIDI. I'd just found that with sysex you can pack any arbitrary data that you want, that python can create virtual MIDI devices, and that Chrome can then connect to such devices.

I'm sure I'd more code than what's in my 8yo repo, but the premise is simply https://github.com/prashnts/midipacks/blob/master/midipacks/...

Post reply on HN