4 ms·

I couldn't find said example (sorry), but I did find one of his other examples of abusing the assembler: http://bin.smwcentral.net/u/1686/boredom.asm http://bi

by byuu 10y ago

I couldn't find said example (sorry), but I did find one of his other examples of abusing the assembler: http://bin.smwcentral.net/u/1686/boredom.asm http://bin.smwcentral.net/u/1686/boredom.asm You won't believe me unless you try it for yourself, but ... download xkas v06 here: http://www.romhacking.net/utilities/269/ http://www.romhacking.net/utilities/269/ Then download the above boredom.asm. And now run the following on the command-line: touch boredom.sfc xkas boredom.asm boredom.sfc Note again that this is a cross-assembler to produce code for the Super Nintendo. Yet you will be greeted by a fully-playable game of Snake in the terminal window. No, I am not kidding. (The black hats here can probably guess what's going on.) For those who won't/can't try it out: http://i.imgur.com/LTSAHw1.png http://i.imgur.com/LTSAHw1.png

ReedJessen 10y ago
I'm not a black hat, what is going on?
- byuu 10y ago
  It's a native code execution exploit. He exploits the parser to corrupt the stack frame, and executes raw x86 instructions embedded in that file. How exactly it converts that pile of gibberish into a valid x86 program is beyond even my comprehension. Alcaro's always been a wizard at stuff like this. Here's an example of an SNES ROM image he crafted to execute native x86 code from inside ZSNES: https://www.youtube.com/watch?v=Q3SOYneC7mU https://www.youtube.com/watch?v=Q3SOYneC7mU (Yes, you can potentially get a real PC virus from loading up an SNES ROM in ZSNES. Or a specially crafted source code file in xkas v06.)
Natanael_L 10y ago
They're abusing filetype ambiguity. One file can simultaneously be valid HTML, ZIP and PDF, opening correctly in readers for each file format. Mostly it is because of lax requirements on file headers and structuring of the data inside. I guess they found a way to make it produce something your terminal can process.

by byuu 10y ago

ReedJessen 10y ago

I'm not a black hat, what is going on?

byuu 10y ago
It's a native code execution exploit. He exploits the parser to corrupt the stack frame, and executes raw x86 instructions embedded in that file. How exactly it converts that pile of gibberish into a valid x86 program is beyond even my comprehension. Alcaro's always been a wizard at stuff like this. Here's an example of an SNES ROM image he crafted to execute native x86 code from inside ZSNES: https://www.youtube.com/watch?v=Q3SOYneC7mU https://www.youtube.com/watch?v=Q3SOYneC7mU (Yes, you can potentially get a real PC virus from loading up an SNES ROM in ZSNES. Or a specially crafted source code file in xkas v06.)

Natanael_L 10y ago

They're abusing filetype ambiguity. One file can simultaneously be valid HTML, ZIP and PDF, opening correctly in readers for each file format. Mostly it is because of lax requirements on file headers and structuring of the data inside. I guess they found a way to make it produce something your terminal can process.