51–60 of 84 posts
Earlier quoted context omitted.
GNU's printf specifier language is Turing complete, I believe.
Presumably it needs a loop around it, so it's not Turing-complete by itself?
Earlier quoted context omitted.
Presumably it needs a loop around it, so it's not Turing-complete by itself?
It does not need the loop. It might be easier to understand by looking at something like this. [0] That printf allows for this kind of Turing complete control flow is well known [1]. [0] https://github.com/HexHive/printbf [1] http://nebelwelt.net/publications/files/15SEC.pdf
Earlier quoted context omitted.
GNU's printf specifier language is Turing complete, I believe.
Presumably it needs a loop around it, so it's not Turing-complete by itself?
> To achieve full Turing-complete computation, we need a way to loop a format string. This is possible by overwriting the pointer inside printf() that tracks which character in the format string is currently being executed. The attacker is unlucky in that at the time the “%n” format specifier is used, this value is saved in a register on our 64-bit system. However, we identify one point in time in which the attacker can always mount the attack. The printf() function makes calls to puts() for the static components of the string. When this function call is made, all registers are saved to the stack. It turns out that an attacker can overwrite this pointer from within the puts() function. By doing this, the format string can be looped.
> An attacker can cause puts() to overwrite the desired pointer. Prior to printf() calling puts(), the attacker uses “%n” format specifiers to overwrite the stdout FILE object so that the temporary buffer is placed directly on top of the stack where the index pointer will be saved. Then, we print the eight bytes corresponding to the new value we want the pointer to have. Finally, we use more “%n” format specifiers to move the buffer back to some other location so that more unintended data will not be overwritten.
[0] https://www.usenix.org/system/files/conference/usenixsecurit..., Appendix B "Printf is Turing-complete".
Earlier quoted context omitted.
There is somewhere a compiler that outputs to all sorts of crazy languages including awk, sed, printf, etc.. but I can't find it right now. Hopefully someone knows what I'm talking about. I feel like it did LLVM IR to a bunch of languages or something like that.. but my memory is faulty.
You are looking for ELVM: https://github.com/shinh/elvm/ (I have seen many others, but in terms of activity it seems the most maintained one.)
https://scholar.google.com/citations?user=q4qDvAoAAAAJ&hl=en...