9 ms·
Branchless Doom
- tzahola 9y ago“The mov-only DOOM renders approximately one frame every 7 hours, so playing this version requires somewhat increased patience.” lol
- dawnerd 9y agoWould be interesting to make this a sort of twitch plays. 7 hour voting windows.
- catmanjan 9y agoI think it only registers input every 5 or so frames anyway :O
- hnzix 9y agoThis needs blockchain GPU mining!
- cubano 9y agoPlease don't give anyone any ideas.
- felipellrocha 9y agoMan, I lol'd when I read that line. That was amazing!
- geluso 9y agoRidiculous. Why does it become so slow though?
- vvanders 9y agoThat reminds me of playing C&C: Red Alert on a 486/66, I though it was a deliberate strat game. That was until I installed it on my dad's Pentium 200, the speed increased 3x and I realized it was a completely different beast.
- jftuga 9y agoAnother great use case for quantum computing.
- mhd 9y agoAs a veteran of early Origin games, I'm up for that. I ran Ultima VII on a DoubleSpaced 386.
- iokevins 9y ago"This is thought to be entirely secure against the Meltdown and Spectre CPU vulnerabilities, which require speculative execution on branch instructions."
- tgb 9y agoI must not be understanding Meltdown correctly and I know this is a joke, but I thought it was the malicious code that used speculative execution to (indirectly) read unauthorized memory. So in what sense is Branchless Doom secure against Meltdown?
- trentnelson 9y agoYou don't store your plaintext passwords in a modded version of Doom with a kernel scheduler hack to ensure it mostly gets dispatched on the HyperThread core neighboring the one your browser is getting dispatched onto? Amateur.
- UncleMeat 9y agoMeltdown doesn't involve speculative execution across branches. It is out of order execution through instructions that will fail.
- shakna 9y agoUses movfuscator, one of the most painful tools when you're faced with reverse engineering. Also one of the most fun, from the other side of the aisle.
- chii 9y agoi love the design of the movfuscator. Most obfuscation tools tries to add more complexity and branching, in the hope that it will fool the decompiler. But it turns out, having absolutely no branching, and no 'features' makes it so much more of a nightmare to reverse!
- shakna 9y agoI think you can see a similar trend in estoric languages. Malboge is so complicated that nobody can really write a working program. Brainfuck is so simple that nearly anybody can write it, but reverse-engineering it is a massive time-sink.
- elago 9y agoHopefully this isn't too off topic, but could you explain how to even start approaching this from a RE/malware analysis perspective? I'm guessing there's no drag-and-drop de-obfuscate tool like there is for some of the common .NET obfuscators. Do you just rely on behavioral/dynamic methods?
- problems 9y agoFor even the nastiest of obfuscators there are often attempts at deobfuscators... https://github.com/kirschju/demovfuscator https://github.com/kirschju/demovfuscator
- shakna 9y agoI was just looking to replace a specific function call, because the company weren't using VC, and no longer had a working codebase. So I was hunting a particular pattern to replace, that I knew probably existed. A simple combination of demovfuscator, regex on the "original" asm and eyeballing it succeeded in the end.
- banachtarski 9y agoMy understanding of how some of this works is that to handle jmps, the program uses nojmp to become its own signal handler and inserts a faulty mov to raise a SIGSEGV, mov addresses around, and continue as though it was a successful jmp. And it looks like float and int math is handled with lookup tables. yikes! but impressive!
- monocasa 9y agoIt's cooler than that, IMO. It uses the SIGSEGV to jump back to the start, once per global iteration. Bit most of the normal 'jumps' are encoded by doing both sides of the work, but using a scratch base address for the storage of the 'not taken' side that ends up not contributing to the actual result.
- euyyn 9y agoSo it prevents speculative execution of branches, by speculatively executing them itself? lol
- banachtarski 9y agoIt went full circle! The irony is that CPUs already do a ton of speculative branching
- dfox 9y agoStructuring code like this actually has it's purpose. Instruction stream executed by massively parallel SIMD systems (prototypically for 80's supercomputers like Connection Machine, but also for GPUs few generations back) actually works in exactly same way.
- peatmoss 9y agoThank heavens for this advancement! I imagine those using Doom to manage system processes (https://www.cs.unm.edu/~dlchao/flake/doom/chi/chi.html https://www.cs.unm.edu/~dlchao/flake/doom/chi/chi.html), will appreciate the security measures implemented in this version. I can only hope these two projects can find common purpose.
- sjsbsh 9y agoThey’ll certainly have enough time to decide which proc to kill!
- jghn 9y agoSeveral years back I convinced a coworker to try and install that. He had a mac and I was running FreeBSD or something and couldn't run it. He'd been running some sort of simulation for several days on that machine. So we fired it up and within about 2-3 minutes he managed to shoot PID 1 or something like that as the machine rebooted. Boss was not happy.
- pkilgore 9y agoCompiler FAQ, in it's entirety, says it all: >Q: Why did you make this? A: I thought it would be funny.
- romwell 9y agoTo the author's credit, it really is. I'm still giggling.
- Legion 9y agoI look forward to this being a benchmark for testing CPU advancement in the years to come. "It gets 2 frames per hour in Branchless DOOM!"
- darawk 9y agoThis is excellent work.
- pslam 9y agoI know it's a joke, but this still branches, via an obscure mechanism of faulting, and mov instructions past the faulting instruction will speculatively execute.
- describrion 9y agoThat's not quite true... the code (essentially) loops over itself infinitely; the only branch is a loop back to the beginning of the program. Since this branch has only one target, it can be a direct jump (as opposed to an indirect one), meaning it would not use the branch trace buffer, and would not cause speculative execution. The author used faulting for branches only to write the program in all mov instructions; if the last 'mov' is replaced with a direct jmp (which, it looks like, can be done with the --no-mov-loop flag to the compiler), no more speculative execution.
- Liquid_Fire 9y ago> direct jump Another important thing here is that it's an unconditional direct jump. A conditional direct jump can still cause speculative execution (e.g. could be vulnerable to Spectre variant 1).
- deleted 9y ago[deleted]
- yarg 9y agoThat's a pity, I was hoping that this could be converted to a SIMD architecture allowing you to run hundreds of staggeringly slow doom instances simultaneously on a GPU.
- animal531 9y agoIt would be even better if each of the e.g. 1k instances also ran full networking, so you could have 1024 player splitscreen on the GPU.
- 9y ago
- fil_d 9y agobut why...
- dang 9y agoJust being interesting is enough.
- brokenmachine 9y agoSome ask, "why". Others ask, "why not"...
- bitwize 9y ago"Science isn't about 'why', it's about 'why not'! Why don't you marry safe science if you love it so much!" --Cave Johnson
- jmiserez 9y agoI always liked that quote. In full: I hear you say "Why?" Always "Why?" You see things; and you say "Why?" But I dream things that never were; and I say "Why not?" (https://en.wikiquote.org/wiki/George_Bernard_Shaw https://en.wikiquote.org/wiki/George_Bernard_Shaw)
- calebtroyer 9y agoIt says why right in the compiler FAQ — "I thought it would be funny"
- MaxBarraclough 9y agoIt's neat, and rather funny. To see an unmodified real-world C program run on a real-world hardware architecture, completely branchless, is pretty damn neat. The way it takes hours to render a frame of DOOM is hilarious. I wonder if the compiler will be optimised in future.
- earenndil 9y ago> unmodified You have to patch the source though...
- IncRnd 9y agoWell, the compiler works!
- wasx 9y agoFinally I can play my favourite game without worrying about how Intel has fucked me!
- craftyguy 9y agoYou could run it on a mid-90's CPU without speculative branching and very likely see better performance.
- NinjaKitten 9y ago486 or Pentium 90, what this game was made for.
- phillco 9y agoI was disappointed to find out the screenshot is not a GIF.
- js2 9y agoHN discussion of movfuscator: https://news.ycombinator.com/item?id=9751312 https://news.ycombinator.com/item?id=9751312 HN discussion of trapcc: https://news.ycombinator.com/item?id=5261598 https://news.ycombinator.com/item?id=5261598
- Endy 9y agoThis is a more interesting idea than I would have thought at first. I wonder if it could be used to discover whether any frame-perfect exploits still remain unfound in Doom. I know that there are people who have played the game frame-by-frame in order to identify possible advantages, this is an interesting take on the idea. The one concern I have is this: does it change the enemy logic significantly? Will the enemies still react in roughly the same way? I also wonder if it would be at all possible to eventually speed it up (maybe not to actual play speed, but faster) while remaining branchless and free of speculation. It might be interesting to see if research in Doom could provide faster and more secure solutions in the real world.
- 51Cards 9y ago"The mov-only DOOM renders approximately one frame every 7 hours, so playing this version requires somewhat increased patience." Favourite line.
- ninju 9y agoThe mov-only DOOM renders approximately one frame every 7 hours, so playing this version requires somewhat increased patience. hehe