9 ms·
Movfuscator – Single instruction C compiler
- garganzol 8y agoAt first look, the code produced by Movfuscator is mind boggling. But despite its perceived entanglement there exist some deobfuscators that bring the code back to Harvard (e.g. human readable) model. TL/DR obfuscation by translating a program to "mov" instructions is susceptible to static analysis and thus fully reversible.
- TimTheTinker 8y ago> there exist some deobfuscators that bring the code back Care to elaborate? The author of Movfuscator is very experienced and capable at reverse engineering. In one of his video talks he hits some Movfuscated code with some tools and says he doesn't know of anything that can deobfuscate it. That may have changed since then -- I'd be curious to know.
- andreareina 8y agoThere's the demovfuscator: https://kirschju.re/demov https://kirschju.re/demov
- TimTheTinker 8y agoThanks! That’s really cool.
- ianbicking 8y agoI'd recommend the video presentation linked off the page, where he walks through how he actually turned mov into a machine. It's very weird and interesting! https://www.youtube.com/watch?v=R7EEoWg6Ekk https://www.youtube.com/watch?v=R7EEoWg6Ekk
- Legogris 8y agoI love how he nonchalantly throws in a 0-day x86 PoC in the end.
- dx87 8y agoin a similar vein, here is an exmple program that runs using only x86 CPU faults. https://github.com/jbangert/trapcc https://github.com/jbangert/trapcc
- benj111 8y agoSo as there's no branch prediction, this is good defense against spectre type attacks?
- klodolph 8y agoThis is a defense against spectre type attacks, but this cannot be a "good" defense because it sacrifices too much. The programs written this way are assuredly quite slow.
- JasuM 8y agoI can imagine some timing-specific attacks for memory accesses, but they're not likely as robust as attacks against the branch-predictor: 1. This is the simplest one - if the memory being accessed is in a cache (L1/L2, or page in TLB), the function will take a significantly shorter time to execute. If movfuscator achieves conditional execution by manipulating index registers to perform idempotent operations, this will be very easy to detect. 2. Prefetching - if movfuscator reads memory sequentially with a detectable stride, prefetching will shorten the execution time. 3. Write combining - if the code writes to nearby addresses (same cache line), the CPU will combine them to a single write. This will cause a measurable timing difference. EDIT: One more: Store forwarding - if the code writes to a memory address and reads it soon, the CPU may bypass the memory access (and even cache access) completely.
- mbauman 8y agoFor a certain value of "good", yes. > This is thought to be entirely secure against the Meltdown and Spectre CPU vulnerabilities, which require speculative execution on branch instructions. > The mov-only DOOM renders approximately one frame every 7 hours, so playing this version requires somewhat increased patience. https://github.com/xoreaxeaxeax/movfuscator/tree/master/validation/doom https://github.com/xoreaxeaxeax/movfuscator/tree/master/vali...
- ClassyJacket 8y agoShould be good enough for console players.
- odorousrex 8y agoHa! This is actually pretty darn clever! I wonder what the final binary sizes are in comparison to normal GCC compilation, as well as execution speed. I can't believe you made a floating point emulator just for this as well! Quite impressed.
- kbenson 8y agoFrom the example images of original and obfuscated assembly, there's seems to be about a sixfold increase in the number of instructions (for that example, at least), so I imagine you'll see a similar binary size increase.
- acheron 8y agoTo be clear, I (the HN submitter) have nothing to do with this, I just found it and thought it was great.
- Legogris 8y agoConsidering that the floating point library is big enough to be disabled by default tells me you might run out of disk space compiling a single application. That being said, if this can increase difficulty of sidechannel attacks and branch prediction, maybe it'd actually make sense for very isolated parts of some services.
- odorousrex 8y ago>That being said, if this can increase difficulty of sidechannel attacks and branch prediction, maybe it'd actually make sense for very isolated parts of some services. I agree, I can see how it certain special circumstances/services this could be very useful. However, I still expect someone to compile Quake with it by the end of the year.
- simcop2387 8y agoThey've apparently done DOOM already, and it's hours per frame. I don't want to think what Quake would be like.
- stcredzero 8y agoOf course, no post like this is complete without OISC: https://en.wikipedia.org/wiki/One_instruction_set_computer https://en.wikipedia.org/wiki/One_instruction_set_computer (Then, there's my contribution: NISC -- the Null Instruction Set Computer! It's a revolutionary architecture, in that die sizes and TDP can be scaled down, seemingly arbitrarily, with no loss in functionality. In fact, NISC can transcend the solid state entirely, and be implemented directly on the quantum foam of the vacuum! Another benefit: NISC machines are entirely immune to all buffer overflow and use after free exploits! In fact, they are free of all exploits, whatsoever!)
- Terr_ 8y agoNope, it's trivial to DoS them. Attackers don't even have to do anything.
- deleted 8y ago[deleted]
- tiuPapa 8y agoIf the attackers can't do anything how will they DoS them? Wait I think I understand now how it can be implemented on the directly on the quantum foam of the vacuum.
- naniwaduni 8y agoIt doesn't matter that they can't do anything if they don't need to do anything. Things attackers can't do only matter if they'd need to do them.
- stcredzero 8y agoNewsflash: NISC system weathers huge DDOS attack, with no discernible effects! > Things attackers can't do only matter if they'd need to do them. BUT, by the same token, things attackers can do don't matter either! NISC computers: So advanced, they make all attackers meaningless!
- saurik 8y agohttps://hn.algolia.com/?query=movfuscator&sort=byPopularity https://hn.algolia.com/?query=movfuscator&sort=byPopularity
- na85 8y agoWhy haven't Single Instruction-Set architectures taken off? If mov is Turing Complete it seems like there'd be a big win here... You could parallelize this massively. Edit: can someone explain why this is being down voted please, because this is a legit question
- saagarjha 8y agoThey’re impractical and massively inefficient?
- na85 8y agoOkay? I'm asking because I don't know; can you elaborate on why that is? Aren't most modern GPUs similar in that they're designed to just shit out triangles as fast as possible, massively parallel?
- chongli 8y agoNo, modern GPUs run many of the same instructions as CPUs. They have branches and everything. Their main limitation is that groups of threads are bundled together (called warps) and share a program counter, so lots of branching can result in a lot of wasted work if the threads disagree on which branch to take. That, and there's a huge penalty you pay for moving data across the bus to GPU RAM.
- saagarjha 8y agoBasically, you're going to try to emulate other instructions that you don't have with this one instruction, and that's not going to perform very well because now, instead of many optimized instructions, you have strings of this one instruction in its place. And I don't see any way to parallelize this: you're doing the same thing you always were, just with a bunch more code.
- CyberDildonics 8y agoWhy would it make sense to use a single instruction? (Also no, GPUs are not the same at all)
- readingnews 8y agoBest part of the project is at the bottom, in the FAQ: > Q: Why did you make this? A: I thought it would be funny.
- gnulinux 8y agoThis is real hacker news.
- jchw 8y agoThis is awesome and it gets posted periodically. Previous discussion: https://news.ycombinator.com/item?id=12372242 https://news.ycombinator.com/item?id=12372242
- ChrisSD 8y agoOn a slight tangent, I remember minimal lambda languages like Iota, Jot and Zot that I think were derived from Unlambda.
- stephencanon 8y agoWithout taking anything away from the author, calling MOV a "single instruction" stretches things quite a bit. It's more of a big family of instructions that happen to share an assembly mnemonic.
- posteriscorrect 8y agoWhen did HN become Slashdot? Why was the post downvoted? It's 100% correct. The various MOV instructions feature addition, multiplication, conditional copies, and various register/memory address modes.
- simcop2387 8y ago"No wireless. Less space than a nomad. Lame." -- CmdrTaco Yea this isn't a true OISC setup, but it's very close and still completely impressive that this technique even works. That you can influence all necessary registers like this and accomplish arithmetic isn't immediately obvious.
- stephencanon 8y agoMy comment should not be interpreted as criticism.
- stcredzero 8y agoMOV a "single instruction" stretches things quite a bit. It's more of a big family of instructions that happen to share an assembly mnemonic. But if you look at the serious attempts to implement OISC, you'll find that the "single instruction" has so many parameters, some might think it might as well be a big family of instructions.
- stephencanon 8y agoThis is completely fair, which is why I said not to take "anything away from the author" =)
- 8y ago
- yellowapple 8y agoWho would win: the world's most popular CISC architecture or one MOVey boi?