> I’m very unexperienced when it comes to reverse engineering
Lol… where does that leave the rest of us in comparison
Remote code execution via MIDI messages
21–30 of 86 posts
Re: Remote code execution via MIDI messages
#22Of course it is SysEx. SysEx is to standard MIDI what inline assembler is to Python. A world of undocumented proprietary stuff lurks within just about every MIDI device !
can't wait to see what sysEx hacks google will cram on chrome midi support they are building for the last couple years.
Re: Remote code execution via MIDI messages
#23Of course it is SysEx. SysEx is to standard MIDI what inline assembler is to Python. A world of undocumented proprietary stuff lurks within just about every MIDI device !
can't wait to see what sysEx hacks google will cram on chrome midi support they are building for the last couple years.
WebMIDI already has SysEx support: https://developer.mozilla.org/en-US/docs/Web/API/Web_MIDI_AP...
Re: Remote code execution via MIDI messages
#24Now for the most important question: can you run DOOM on it? :)
Re: Remote code execution via MIDI messages
#25Of course it is SysEx. SysEx is to standard MIDI what inline assembler is to Python. A world of undocumented proprietary stuff lurks within just about every MIDI device !
I wish it was somehow possible to perform a piece of music that would cause remote code execution. It’d be so cool to plug in a MIDI keyboard, play an Am6,9/G# and have it open a terminal window with root access.
Re: Remote code execution via MIDI messages
#26Of course it is SysEx. SysEx is to standard MIDI what inline assembler is to Python. A world of undocumented proprietary stuff lurks within just about every MIDI device !
I wish it was somehow possible to perform a piece of music that would cause remote code execution. It’d be so cool to plug in a MIDI keyboard, play an Am6,9/G# and have it open a terminal window with root access.
[deleted]
Re: Remote code execution via MIDI messages
#27Earlier quoted context omitted.
can't wait to see what sysEx hacks google will cram on chrome midi support they are building for the last couple years.
WebMIDI already has SysEx support: https://developer.mozilla.org/en-US/docs/Web/API/Web_MIDI_AP...
did you read the article?
of course webmidi must support sysEx, it's essential to work with midi2 at all. but mostly because you must parse the weird sized packet to properly ignore it.
what might show up are chrome specific sysEx messages which then leads to exploits as the article.
Re: Remote code execution via MIDI messages
#28While I suggest reading the whole thing, the money-quotes: > So yeah, these [keyboard manufacturer] madlads made a shell that runs on top of MIDI SysEx messages on top of USB. > [T]he most interesting commands that we have are arbitrary memory read/write commands. So, if we really wanted to, we could just peek and poke the memory of the synth via MIDI. > If we wanted to, we could write these messages to a MIDI file a…
> If we wanted to, we could write these messages to a MIDI file and play it on the synth like any other MIDI file. Hey, that gives me an idea.....
I'm imagining dubstep would be the result
Re: Remote code execution via MIDI messages
#29[deleted]
Re: Remote code execution via MIDI messages
#30> Now, we have to get a little philosophical here. In my eyes, RE is like a game of minesweeper. You start with an empty field not knowing the state of any of the cells, i.e. not knowing whether each individual cell contains a landmine or not. When you discover the state of a cell, you have the context to deduce the state of its neighbor cells. In minesweeper, you don’t have a particular direction in which you progre…
I don’t know RE but I love this sentiment. I think it’s quite generalizable too. So many things are like that. Just start somewhere. It really doesn’t matter where. And what you find will guide your next steps. Eventually you’ll have enough context to see a much bigger picture well before it’s fully revealed.
Gradient Descent?