14 ms·

Movfuscator – A single-instruction C compiler

191 points by vasili111 10y ago

isuckatcoding 10y ago
ELI5 please. What does this mean for a developer?
- bluedino 10y ago
  Nothing - it's simply an intellectual exercise. It uses the MOV instruction exclusively to create a working program. Further reading - http://www.cl.cam.ac.uk/%7Esd601/papers/mov.pdf http://www.cl.cam.ac.uk/%7Esd601/papers/mov.pdf
  - 0x0 10y ago
    It might find some use in DRM, malware, and other exploits as it would make reverse engineering/decompiling/analysis somewhat more challenging.
- haberman 10y ago
  Someone made something very clever, but it has no practical usefulness whatsoever. It is an interesting intellectual exercise. It's also very impressive that they could pull this off.
  - SilasX 10y ago
    I would think it has some practical use as research in OISC (one-instruction set computing) processors, which are like the RISC model (do a smaller set of instructions so you can do them faster) on steroids.
  - lucb1e 10y ago
    No practical usefulness? It seems rather great for obfuscation, be it for evil (viruses) or good (license key verification -- which is deemed 'good' merely because they're legal, not because they're not a pain in the arse).
    - TelmoMenezes 10y ago
      Not really. Creating an algorithm for recovering the jumps and the intent of the various MOV patterns would be no more work than it was to write this. Particularly easier because one has access to the obfuscator's code, but I don't think it would be a major hurdle even without the source code.
      - lucb1e 10y ago
        Same could be said for most binaries: they're just compilations (usually with open source or freely available compilers) of C/C++ code. Shouldn't be too hard to reverse once you got all the patterns worked out. I see your point though. I'm not very experienced on this and I'm sure some patterns can easily be recovered, but until someone goes through the effort it's still a considerable effort compared to being able to read the program normally, and even when someone does it's questionable whether the original can be recovered with some simple 1:1 translation.
- jakub_h 10y ago
  You can stop worrying about branchless code and have it generated automatically! ;)
qwertyuiop924 10y ago
That is hilarious.
jezfromfuture 10y ago
And super old , welcome to the internet.
erlehmann_ 10y ago
Previously on Battlehacker Newslactica: https://news.ycombinator.com/item?id=10021259 https://news.ycombinator.com/item?id=10021259
_nalply 10y ago
Some slides here: https://recon.cx/2015/slides/recon2015-14-christopher-domas-The-movfuscator.pdf https://recon.cx/2015/slides/recon2015-14-christopher-domas-...
kersny 10y ago
See also: Demovfuscator https://kirschju.re/demov https://kirschju.re/demov
maxpert 10y ago
I wonder what happens to performance of same code.
- easuter 10y ago
  For large applications performance will undoubtedly nosedive.
  - maxpert 10y ago
    Yep one might just write some key verification code in it but keep rest of the app in GCC
liquidzoot 10y ago
You should be careful with this, you'll wear a hole in your instruction set.
- sonthonax 10y ago
  Dumb question, could that actually happen? Could you actually use a particular set of transistors so much with this that they break?
  - detaro 10y ago
    Yes, but you probably need something more sophisticated than just running the same instruction type over and over again: https://dl.acm.org/citation.cfm?id=2744295.2724718 https://dl.acm.org/citation.cfm?id=2744295.2724718
    - versteegen 10y ago
      Wow, thanks, that's a fascinating paper! Direct link to pdf: [1]. So it turns out that if a transistor is kept on continuously its threshold voltage gradually increases (Negative-Bias Temperature-Instability (NBTI)), increasing the switching delay. This attack targets transistors along the critical path, increasing the path's delay until it exceeds the allowed tolerance (guardband). Turning the transistor off "heals" it; as a workaround they suggest periodically executing certain nop instructions to ensure critical path transistors spend at least 0.05% of their time turned off. They perform simulations using models of 45nm high-k PMOS transistors to produce their results. A good quote about processor reliability: Guardbanding is the current industrial practice to cope with transistor aging and voltage droops [Agarwal et al. 2007]. It entails slowing down the clock frequency (i.e., adding timing margin during design) based on the worst degradation the transistors might experience during their lifetime. The guardbands ensure that enough current passes through the processor to keep it above the threshold voltage and in turn ensure that the processor functionality is intact for an average period of 5 to 7 years [Tiwari and Torrellas 2008]. However, inserting wide guardbands degrades performance and increases energy consumption. Hence, processor design companies usually have small guardbands, typically 10% [Agarwal et al. 2007]. However, the MAGIC-based attack can deteriorate the critical path by 11% and cause erroneous results in 1 month. This also explains why overclocking a CPU may be a bad idea, although they also show that random instructions don't come close to the worst case ageing. [1] https://www.researchgate.net/profile/Naghmeh_Karimi/publication/275720759_MAGIC_Malicious_aging_in_CircuitsCores/links/5564bf1e08aec4b0f4859151.pdf https://www.researchgate.net/profile/Naghmeh_Karimi/publicat...
mighty_atomic_c 10y ago
Seems like it would give a large performance penalty. I don't get it.
- detaro 10y ago
  It's a joke/demonstration that it is possible, not something you're supposed to use.
  - posterboy 10y ago
    Obfuscation is surely used in malware. One instruction set computers (OISC) are more than a joke, I suppose, but I didn't dig far into theoretical computer science and can't say, what's important about them. I read a comment the other day, that stipulated neurons would be akin to massively parallel single instruction computers.
    - stcredzero 10y ago
      One instruction set computers (OISC) are more than a joke, I suppose, but I didn't dig far into theoretical computer science and can't say, what's important about them. They're for highly parallel programable SIMD number crunching. The OISC would allow for easily fabricating a whole heaping bunch of ALUs.
- hulahoof 10y ago
  There is a good talk that accompanies the code
  - caretStick 10y ago
    source?
    - hulahoof 10y ago
      youtube.com/watch?v=HlUe0TUHOIc At about 7 minutes in he is chatting about it but all is a good watch - could only find the YT link sorry
aub3bhat 10y ago
Could this be used for creating a ROP Gadget that overcomes ASLR on 64 bit machines?
- l_zzie 10y ago
  How does it get past aslr? You still need to find addresses of the movs, don't you?
danjoc 10y ago
And for the minimalist, the zero-instruction C compiler https://github.com/jbangert/trapcc https://github.com/jbangert/trapcc
toolslive 10y ago
just what I need for my next virus
tbodt 10y ago
How do we do arithmetic if we can only do movs? I know! Lookup tables!
LightMachine 10y ago
Not sure I understand how that is possible. How would you implement a boolean "and" with only "mov"? If you can only move stuff around, how do you read and compare things?
- __s 10y ago
  If you look at turing machines they're pretty minimal, just a state machine reading/writing state on a tape Repo includes a good set of slides: https://github.com/xoreaxeaxeax/movfuscator/blob/master/slides/domas_2015_the_movfuscator.pdf https://github.com/xoreaxeaxeax/movfuscator/blob/master/slid... Indirect memory accesses serve for conditional execution Here's the macro for boolean and: https://github.com/xoreaxeaxeax/movfuscator/blob/master/poc/movfuscator.c#L201 https://github.com/xoreaxeaxeax/movfuscator/blob/master/poc/...
- deleted 10y ago
  [deleted]
projectdp 10y ago
Saw this recently after reviewing some Defcon 23 videos. The author goes into detail about how it's working and some other fun stuff regarding anti-reverse-engineering. 2015 DEFCON 23 - Chris Domas - Repsych: Psychological Warfare in Reverse Engineering https://www.youtube.com/watch?v=HlUe0TUHOIc https://www.youtube.com/watch?v=HlUe0TUHOIc And a paper by him: https://www.cl.cam.ac.uk/~sd601/papers/mov.pdf https://www.cl.cam.ac.uk/~sd601/papers/mov.pdf
_c_ 10y ago
Since we are joking, assuming that the MOV instruction exists on many CPU's, could the input for this compiler be considered a needed "portable assembly language"? http://cr.yp.to/qhasm/20050129-portable.txt http://cr.yp.to/qhasm/20050129-portable.txt
2opdude 10y ago
The MOV mnemonic is more like a family of instructions, isn't it? Not knowing anything about GPU programming, isn't it similar to Movfuscator in some respects? Both branches are taken and run simultaneously?
amelius 10y ago
But MOV is not really a single instruction. I would be more impressed by a single opcode compiler.

191 points by vasili111 10y ago

isuckatcoding 10y ago

ELI5 please. What does this mean for a developer?

bluedino 10y ago
Nothing - it's simply an intellectual exercise. It uses the MOV instruction exclusively to create a working program. Further reading - http://www.cl.cam.ac.uk/%7Esd601/papers/mov.pdf http://www.cl.cam.ac.uk/%7Esd601/papers/mov.pdf
- 0x0 10y ago
  It might find some use in DRM, malware, and other exploits as it would make reverse engineering/decompiling/analysis somewhat more challenging.
haberman 10y ago
Someone made something very clever, but it has no practical usefulness whatsoever. It is an interesting intellectual exercise. It's also very impressive that they could pull this off.
- SilasX 10y ago
  I would think it has some practical use as research in OISC (one-instruction set computing) processors, which are like the RISC model (do a smaller set of instructions so you can do them faster) on steroids.
- lucb1e 10y ago
  No practical usefulness? It seems rather great for obfuscation, be it for evil (viruses) or good (license key verification -- which is deemed 'good' merely because they're legal, not because they're not a pain in the arse).
  - TelmoMenezes 10y ago
    Not really. Creating an algorithm for recovering the jumps and the intent of the various MOV patterns would be no more work than it was to write this. Particularly easier because one has access to the obfuscator's code, but I don't think it would be a major hurdle even without the source code.
    - lucb1e 10y ago
      Same could be said for most binaries: they're just compilations (usually with open source or freely available compilers) of C/C++ code. Shouldn't be too hard to reverse once you got all the patterns worked out. I see your point though. I'm not very experienced on this and I'm sure some patterns can easily be recovered, but until someone goes through the effort it's still a considerable effort compared to being able to read the program normally, and even when someone does it's questionable whether the original can be recovered with some simple 1:1 translation.
jakub_h 10y ago
You can stop worrying about branchless code and have it generated automatically! ;)

qwertyuiop924 10y ago

That is hilarious.

jezfromfuture 10y ago

And super old , welcome to the internet.

erlehmann_ 10y ago

Previously on Battlehacker Newslactica: https://news.ycombinator.com/item?id=10021259 https://news.ycombinator.com/item?id=10021259

_nalply 10y ago

Some slides here: https://recon.cx/2015/slides/recon2015-14-christopher-domas-The-movfuscator.pdf https://recon.cx/2015/slides/recon2015-14-christopher-domas-...

kersny 10y ago

See also: Demovfuscator https://kirschju.re/demov https://kirschju.re/demov

maxpert 10y ago

I wonder what happens to performance of same code.

easuter 10y ago
For large applications performance will undoubtedly nosedive.
- maxpert 10y ago
  Yep one might just write some key verification code in it but keep rest of the app in GCC

liquidzoot 10y ago

You should be careful with this, you'll wear a hole in your instruction set.

sonthonax 10y ago
Dumb question, could that actually happen? Could you actually use a particular set of transistors so much with this that they break?
- detaro 10y ago
  Yes, but you probably need something more sophisticated than just running the same instruction type over and over again: https://dl.acm.org/citation.cfm?id=2744295.2724718 https://dl.acm.org/citation.cfm?id=2744295.2724718
  - versteegen 10y ago
    Wow, thanks, that's a fascinating paper! Direct link to pdf: [1]. So it turns out that if a transistor is kept on continuously its threshold voltage gradually increases (Negative-Bias Temperature-Instability (NBTI)), increasing the switching delay. This attack targets transistors along the critical path, increasing the path's delay until it exceeds the allowed tolerance (guardband). Turning the transistor off "heals" it; as a workaround they suggest periodically executing certain nop instructions to ensure critical path transistors spend at least 0.05% of their time turned off. They perform simulations using models of 45nm high-k PMOS transistors to produce their results. A good quote about processor reliability: Guardbanding is the current industrial practice to cope with transistor aging and voltage droops [Agarwal et al. 2007]. It entails slowing down the clock frequency (i.e., adding timing margin during design) based on the worst degradation the transistors might experience during their lifetime. The guardbands ensure that enough current passes through the processor to keep it above the threshold voltage and in turn ensure that the processor functionality is intact for an average period of 5 to 7 years [Tiwari and Torrellas 2008]. However, inserting wide guardbands degrades performance and increases energy consumption. Hence, processor design companies usually have small guardbands, typically 10% [Agarwal et al. 2007]. However, the MAGIC-based attack can deteriorate the critical path by 11% and cause erroneous results in 1 month. This also explains why overclocking a CPU may be a bad idea, although they also show that random instructions don't come close to the worst case ageing. [1] https://www.researchgate.net/profile/Naghmeh_Karimi/publication/275720759_MAGIC_Malicious_aging_in_CircuitsCores/links/5564bf1e08aec4b0f4859151.pdf https://www.researchgate.net/profile/Naghmeh_Karimi/publicat...

mighty_atomic_c 10y ago

Seems like it would give a large performance penalty. I don't get it.

detaro 10y ago
It's a joke/demonstration that it is possible, not something you're supposed to use.
- posterboy 10y ago
  Obfuscation is surely used in malware. One instruction set computers (OISC) are more than a joke, I suppose, but I didn't dig far into theoretical computer science and can't say, what's important about them. I read a comment the other day, that stipulated neurons would be akin to massively parallel single instruction computers.
  - stcredzero 10y ago
    One instruction set computers (OISC) are more than a joke, I suppose, but I didn't dig far into theoretical computer science and can't say, what's important about them. They're for highly parallel programable SIMD number crunching. The OISC would allow for easily fabricating a whole heaping bunch of ALUs.
hulahoof 10y ago
There is a good talk that accompanies the code
- caretStick 10y ago
  source?
  - hulahoof 10y ago
    youtube.com/watch?v=HlUe0TUHOIc At about 7 minutes in he is chatting about it but all is a good watch - could only find the YT link sorry

aub3bhat 10y ago

Could this be used for creating a ROP Gadget that overcomes ASLR on 64 bit machines?

l_zzie 10y ago
How does it get past aslr? You still need to find addresses of the movs, don't you?

danjoc 10y ago

And for the minimalist, the zero-instruction C compiler https://github.com/jbangert/trapcc https://github.com/jbangert/trapcc

toolslive 10y ago

just what I need for my next virus

tbodt 10y ago

How do we do arithmetic if we can only do movs? I know! Lookup tables!

LightMachine 10y ago

Not sure I understand how that is possible. How would you implement a boolean "and" with only "mov"? If you can only move stuff around, how do you read and compare things?

__s 10y ago
If you look at turing machines they're pretty minimal, just a state machine reading/writing state on a tape Repo includes a good set of slides: https://github.com/xoreaxeaxeax/movfuscator/blob/master/slides/domas_2015_the_movfuscator.pdf https://github.com/xoreaxeaxeax/movfuscator/blob/master/slid... Indirect memory accesses serve for conditional execution Here's the macro for boolean and: https://github.com/xoreaxeaxeax/movfuscator/blob/master/poc/movfuscator.c#L201 https://github.com/xoreaxeaxeax/movfuscator/blob/master/poc/...
deleted 10y ago
[deleted]

projectdp 10y ago

Saw this recently after reviewing some Defcon 23 videos. The author goes into detail about how it's working and some other fun stuff regarding anti-reverse-engineering. 2015 DEFCON 23 - Chris Domas - Repsych: Psychological Warfare in Reverse Engineering https://www.youtube.com/watch?v=HlUe0TUHOIc https://www.youtube.com/watch?v=HlUe0TUHOIc And a paper by him: https://www.cl.cam.ac.uk/~sd601/papers/mov.pdf https://www.cl.cam.ac.uk/~sd601/papers/mov.pdf

_c_ 10y ago

Since we are joking, assuming that the MOV instruction exists on many CPU's, could the input for this compiler be considered a needed "portable assembly language"? http://cr.yp.to/qhasm/20050129-portable.txt http://cr.yp.to/qhasm/20050129-portable.txt

2opdude 10y ago

The MOV mnemonic is more like a family of instructions, isn't it? Not knowing anything about GPU programming, isn't it similar to Movfuscator in some respects? Both branches are taken and run simultaneously?

amelius 10y ago

But MOV is not really a single instruction. I would be more impressed by a single opcode compiler.