2 ms·
> Most software bugs are not exploitable. I've never seen any evidence of that. Most bugs start you down rarely thought about paths and if you didn't map them
by akvadrako 9y ago
> Most software bugs are not exploitable.
I've never seen any evidence of that. Most bugs start you down rarely thought about paths and if you didn't map them out before hand all kinds of unexpected behavior could crop up.
- crankylinuxuser 9y agohttps://www.youtube.com/watch?v=OPcV9uIY5i4 https://www.youtube.com/watch?v=OPcV9uIY5i4 Video is about exploiting Super Mario world, on SNES. The result is that the exploiter then proceeds to make 2 new games inside SMW: Pong and Snake. Those games don't exist inside SMW. They were uploaded using controller inputs. All it takes is 1 hack.
- eridius 9y agoDoesn't that hack allow you to write to arbitrary memory? Being able to write to attacker-controlled memory is a serious problem. That's not what the kill(-1) bug lets you do though.
- crankylinuxuser 9y agoThe attack was a buffer overflow on handling objects in the "saved item" area at the top. By manipulating objects as done in the video, one can set RAM up as needed to construct the "program". Then when the overflow is executed, it jumps to the invalid place in memory, thus executing the code you seeded. This is also done in Pokemon Yellow with a link cable. The last time I saw this being done, a TAS hacker was able to inject a TCP stack over the link cable, and build an IRC client on top, and chat using the game boy. And I realize that's not the immediate action that bug has, regarding kill(-1). But I've seen what people thought were innocuous bugs that ended up being "gimmee root" kind of bugs.