Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote code execution via MIDI messages

psi3.ru

Post reply on HN
Print view View original

81–86 of 86 posts

Re: Remote code execution via MIDI messages

#81

Post by lambda »

phkahler wrote: post #66
portasynthinca3 wrote: post #4

Earlier quoted context omitted.

Thanks! The dot matrix is actually eight 5x8 characters, or 320 bits in total. I'm packing those 320 bits into the the 4 bits per byte that are available to us in this shell protocol. Plus, another 9 bytes for the packet header and footer. Looks like I wrote 92 in the article, I must have miscalculated that. I'm not using the full 7 bits because figuring out a way to do so turned out to be way too hard for me, so I o…

Another option might be to modify the baud rate of the MIDI interface. MIDI is terribly slow at 1M/32 bps, and most UARTs can go at least 115200. That would also mean changing the baud rate on your PC software at that point in transmission, and would not allow a standard MIDI file to be used.

This was being done over USB midi, which is already faster than standard DIN midi AFAIK. Trying to change the baud rate of DIN midi on both ends of the communication seems like a lot of work.

Re: Remote code execution via MIDI messages

#82

Post by lambda »

leptons wrote: post #42
friend_Fernando wrote: post #31

Earlier quoted context omitted.

It's starting to look like an increasingly sensible policy IMO.

I won't click on any .ru domains. It's just not worth it at this point.

It's odd that it's .ru since the author is in Armenia.

Re: Remote code execution via MIDI messages

#83

Post by dhosek »

127 wrote: post #43
dhosek wrote: post #25

Earlier quoted context omitted.

I wish it was somehow possible to perform a piece of music that would cause remote code execution. It’d be so cool to plug in a MIDI keyboard, play an Am6,9/G# and have it open a terminal window with root access.

That doesn't make much sense as note on and note off messages are very simple and you can't insert arbitrary bytes with them, unless maybe you use some very particular run mode.

I also wish I had a pony. Wishes don’t need to make much sense.

Re: Remote code execution via MIDI messages

#84

Post by SideQuark »

LegionMammal978 wrote: post #79
SideQuark wrote: post #77

> World’s First MIDI Shellcode There's been MIDI shell code for well over 20 years on pretty much all major platforms: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=midi

Plenty of buffer overflows. But has anyone actually written a shellcode for those?

Metasploit added automated shellcode generators into midi files at least a dozen years ago, likely earlier. https://www.exploit-db.com/exploits/18426

So to test this, surely they tried it once, and presumably Metasploit users generated tons of them .

And from having worked in this space a long time ago, such CVEs would trigger a host of malicious midi files looking for holes, especially since people embedded them in webpages around early 2000s.

Around that time I'd routinely take a MS update, diff the DLLs, reverse interesting location changes, and craft shellcode attacks during training to show people how it's not very hard. And there were tons of people across the spectrum able to do similarly. CVE disclosures made them much easier to develop.

Re: Remote code execution via MIDI messages

#85

Post by helpfulContrib »

portasynthinca3 wrote: post #52
liotier wrote: post #7

Of course it is SysEx. SysEx is to standard MIDI what inline assembler is to Python. A world of undocumented proprietary stuff lurks within just about every MIDI device !

> SysEx is to standard MIDI what inline assembler is to Python I really like this comparison!

[dead]

Re: Remote code execution via MIDI messages

#86

Post by stavros »

bluGill wrote: post #62
127 wrote: post #43

Earlier quoted context omitted.

That doesn't make much sense as note on and note off messages are very simple and you can't insert arbitrary bytes with them, unless maybe you use some very particular run mode.

Note on/off are just messages. We by convention map them to notes, but note 69 is A-440 on most keyboards, but you could see note 69 and play a C instead (this is somewhat common - have the computer transpose so you can play with others who play the music in a different key - better players can do this in their head but it is not a universal skill even with great players) There is no reason you can't take a sequence…

I think the GP's point is that the code that interprets simple note on/off messages is unlikely to be vulnerable to any kind of RCE.
Post reply on HN