5 ms·

There's an entire community of video game hackers (smwcentral.net) using a cross-assembler I wrote in 2001 named xkas. I added a few minor patches and by early

by byuu 10y ago

There's an entire community of video game hackers (smwcentral.net) using a cross-assembler I wrote in 2001 named xkas. I added a few minor patches and by early 2004 I had released the final version, v06. I never really intended for anyone to use it seriously. I made it for myself, but went ahead and posted it online anyway. It is a 1500-line single-file, nearly-commentless, nearly-spaceless abomination of code with no documentation, and an endless list of critical bugs that every user keeps encountering. They have elaborate workarounds for many of these bugs. It became a negative feedback loop: "Why do we use xkas? Because everything else is written in xkas", and so now even more code was created and written in xkas. And so even though I've since written a proper assembler that's dozens of times nicer, no one can/will use it. Lately, people have been writing their own versions (in addition to countless forks) that try to offer backward compatibility with all the crazy parsing errors and (mis)features of xkas, like left-to-right evaluation of math expressions, and the most convoluted macro evaluation system you've ever seen (one user proved it was Turing complete and wrote a Brainfuck parser in it.) It's surreal. I feel terrible that so many people are stuck with this mess, but even I can't stop it anymore :/

logicallee 10y ago
thanks for writing this up for us. This is great.
Rainymood 10y ago
>(one user proved it was Turing complete and wrote a Brainfuck parser in it.) Okay. That is hilarious.
- byuu 10y ago
  I couldn't find said example (sorry), but I did find one of his other examples of abusing the assembler: http://bin.smwcentral.net/u/1686/boredom.asm http://bin.smwcentral.net/u/1686/boredom.asm You won't believe me unless you try it for yourself, but ... download xkas v06 here: http://www.romhacking.net/utilities/269/ http://www.romhacking.net/utilities/269/ Then download the above boredom.asm. And now run the following on the command-line: touch boredom.sfc xkas boredom.asm boredom.sfc Note again that this is a cross-assembler to produce code for the Super Nintendo. Yet you will be greeted by a fully-playable game of Snake in the terminal window. No, I am not kidding. (The black hats here can probably guess what's going on.) For those who won't/can't try it out: http://i.imgur.com/LTSAHw1.png http://i.imgur.com/LTSAHw1.png
  - ReedJessen 10y ago
    I'm not a black hat, what is going on?
    - byuu 10y ago
      It's a native code execution exploit. He exploits the parser to corrupt the stack frame, and executes raw x86 instructions embedded in that file. How exactly it converts that pile of gibberish into a valid x86 program is beyond even my comprehension. Alcaro's always been a wizard at stuff like this. Here's an example of an SNES ROM image he crafted to execute native x86 code from inside ZSNES: https://www.youtube.com/watch?v=Q3SOYneC7mU https://www.youtube.com/watch?v=Q3SOYneC7mU (Yes, you can potentially get a real PC virus from loading up an SNES ROM in ZSNES. Or a specially crafted source code file in xkas v06.)
  - Natanael_L 10y ago
    They're abusing filetype ambiguity. One file can simultaneously be valid HTML, ZIP and PDF, opening correctly in readers for each file format. Mostly it is because of lax requirements on file headers and structuring of the data inside. I guess they found a way to make it produce something your terminal can process.
aexaey 10y ago
Thank you for this: > ...and by early 2004 I had released the final version, v06. I wish more software had "final version", where possible [0] as opposed to endless churn and inevitable "is this project dead" question after a couple of weeks/months of inactivity. [1] [0] Obviously some projects can't do this. E.g. there is no way youtube-dl would ever have a final version, etc.. [1] https://www.google.com/search?q=is+this+project+dead+site:github.com https://www.google.com/search?q=is+this+project+dead+site:gi...
shthed 10y ago
I like this: http://www.romhacking.net/utilities/269/ http://www.romhacking.net/utilities/269/ "Newer versions have been released, however contain poor documentation, and removal of features that can be found in v0.06. Version 0.06 is still considered the best version available by most ROM hackers until the author addresses the shortcomings of subsequent versions."
- byuu 10y ago
  There's a reason I stopped associating with that scene/site years ago. Almost everyone in it is toxic and stuck in their rebellious teenage years. Case in point: http://www.romhacking.net/forum/index.php/topic,21797.html http://www.romhacking.net/forum/index.php/topic,21797.html The newer versions are called bass, and you can compare yourself here: http://byuu.org/tool/bass/ http://byuu.org/tool/bass/ There is full documentation of every possible command, the code is readable by human beings (eg variables are named words instead of single letter abbreviations, C++ is used for more than just the class keyword, there's more than one source code file, I learned how to use the spacebar key in my code, etc), it has a real recursive descent parser that builds a proper abstract syntax tree for evaluations, it has a macro system that supports recursion and conditional evaluation, supports multiple architectures instead of just one, allows the user to dynamically add/change the actual opcode mnemonics used by the assembler (useful as the SNES has games using several strange coprocessors), has no known bugs (as opposed to xkas' that allow native code execution), etc. xkas was written when I had about a years' worth of real programming experience, bass was after over a decade's worth of experience; including experience using assemblers to create code. If you want to know why RHDN users threw a fit about it; it's because I used // as a comment delimiter instead of ; and decided to add a closing marker to defines so you could say "lda {macro}_b", which was impossible with the old "lda !macro_b" because it'd look for "macro_b" instead of "macro". That's really it. That's the whole of why many people there say they'll never use it. The syntax is 99% compatible otherwise. I could link you to posts saying as much, but I really don't feel like browsing their site any more than I have to. SMWC's case is very different: they're all hacking the same game, so they require 100% backward-compatibility with a decade's worth of game patches; and they only make the problem worse as time goes on. This constraint would not apply to new games started on from scratch.
pc86 10y ago
> one user proved it was Turing complete and wrote a Brainfuck parser in it. Of course they did

by byuu 10y ago

logicallee 10y ago

thanks for writing this up for us. This is great.

Rainymood 10y ago

>(one user proved it was Turing complete and wrote a Brainfuck parser in it.) Okay. That is hilarious.

byuu 10y ago
I couldn't find said example (sorry), but I did find one of his other examples of abusing the assembler: http://bin.smwcentral.net/u/1686/boredom.asm http://bin.smwcentral.net/u/1686/boredom.asm You won't believe me unless you try it for yourself, but ... download xkas v06 here: http://www.romhacking.net/utilities/269/ http://www.romhacking.net/utilities/269/ Then download the above boredom.asm. And now run the following on the command-line: touch boredom.sfc xkas boredom.asm boredom.sfc Note again that this is a cross-assembler to produce code for the Super Nintendo. Yet you will be greeted by a fully-playable game of Snake in the terminal window. No, I am not kidding. (The black hats here can probably guess what's going on.) For those who won't/can't try it out: http://i.imgur.com/LTSAHw1.png http://i.imgur.com/LTSAHw1.png
- ReedJessen 10y ago
  I'm not a black hat, what is going on?
  - byuu 10y ago
    It's a native code execution exploit. He exploits the parser to corrupt the stack frame, and executes raw x86 instructions embedded in that file. How exactly it converts that pile of gibberish into a valid x86 program is beyond even my comprehension. Alcaro's always been a wizard at stuff like this. Here's an example of an SNES ROM image he crafted to execute native x86 code from inside ZSNES: https://www.youtube.com/watch?v=Q3SOYneC7mU https://www.youtube.com/watch?v=Q3SOYneC7mU (Yes, you can potentially get a real PC virus from loading up an SNES ROM in ZSNES. Or a specially crafted source code file in xkas v06.)
- Natanael_L 10y ago
  They're abusing filetype ambiguity. One file can simultaneously be valid HTML, ZIP and PDF, opening correctly in readers for each file format. Mostly it is because of lax requirements on file headers and structuring of the data inside. I guess they found a way to make it produce something your terminal can process.

aexaey 10y ago

Thank you for this: > ...and by early 2004 I had released the final version, v06. I wish more software had "final version", where possible [0] as opposed to endless churn and inevitable "is this project dead" question after a couple of weeks/months of inactivity. [1] [0] Obviously some projects can't do this. E.g. there is no way youtube-dl would ever have a final version, etc.. [1] https://www.google.com/search?q=is+this+project+dead+site:github.com https://www.google.com/search?q=is+this+project+dead+site:gi...

shthed 10y ago

I like this: http://www.romhacking.net/utilities/269/ http://www.romhacking.net/utilities/269/ "Newer versions have been released, however contain poor documentation, and removal of features that can be found in v0.06. Version 0.06 is still considered the best version available by most ROM hackers until the author addresses the shortcomings of subsequent versions."

byuu 10y ago
There's a reason I stopped associating with that scene/site years ago. Almost everyone in it is toxic and stuck in their rebellious teenage years. Case in point: http://www.romhacking.net/forum/index.php/topic,21797.html http://www.romhacking.net/forum/index.php/topic,21797.html The newer versions are called bass, and you can compare yourself here: http://byuu.org/tool/bass/ http://byuu.org/tool/bass/ There is full documentation of every possible command, the code is readable by human beings (eg variables are named words instead of single letter abbreviations, C++ is used for more than just the class keyword, there's more than one source code file, I learned how to use the spacebar key in my code, etc), it has a real recursive descent parser that builds a proper abstract syntax tree for evaluations, it has a macro system that supports recursion and conditional evaluation, supports multiple architectures instead of just one, allows the user to dynamically add/change the actual opcode mnemonics used by the assembler (useful as the SNES has games using several strange coprocessors), has no known bugs (as opposed to xkas' that allow native code execution), etc. xkas was written when I had about a years' worth of real programming experience, bass was after over a decade's worth of experience; including experience using assemblers to create code. If you want to know why RHDN users threw a fit about it; it's because I used // as a comment delimiter instead of ; and decided to add a closing marker to defines so you could say "lda {macro}_b", which was impossible with the old "lda !macro_b" because it'd look for "macro_b" instead of "macro". That's really it. That's the whole of why many people there say they'll never use it. The syntax is 99% compatible otherwise. I could link you to posts saying as much, but I really don't feel like browsing their site any more than I have to. SMWC's case is very different: they're all hacking the same game, so they require 100% backward-compatibility with a decade's worth of game patches; and they only make the problem worse as time goes on. This constraint would not apply to new games started on from scratch.

pc86 10y ago

> one user proved it was Turing complete and wrote a Brainfuck parser in it. Of course they did