5 ms·

From the top link: https://news.ycombinator.com/item?id=18992556 https://news.ycombinator.com/item?id=18992556 >The mov-only DOOM renders approximately one fr

From the top link: https://news.ycombinator.com/item?id=18992556 https://news.ycombinator.com/item?id=18992556 >The mov-only DOOM renders approximately one frame every 7 hours, so playing this version requires somewhat increased patience. https://github.com/xoreaxeaxeax/movfuscator/tree/master/validation/doom https://github.com/xoreaxeaxeax/movfuscator/tree/master/vali... I have to say, reading through the github for the movfuscator was pretty damn amusing. I honestly burst out laughing at the control flow graphs. But I'm curious, is this actually practical for anything? Running Doom at 1 Frame per 7 hours is, pretty unreasonable. Would text based software even be usable with this? Either way, I do enjoy cleverly, overly engineered, possibly useless things created just because someone thought it would be funny.

vgel 5y ago
Could maybe be useful for malware obfuscation?
- jandrese 5y ago
  As long as you don't need your malware to actually accomplish anything. Also, a chunk of code that is just a long string of MOV instructions is going to be really easy to spot for an antivirus program.
  - vgel 5y ago
    What do you mean? Movcc can call external functions (with a jmp, tbf)
    - jandrese 5y ago
      Mostly that it's terribly slow.
- grawprog 5y ago
  That was about the only thing I could think of.
- quietbritishjim 5y ago
  Or for license check / DRM (I appreciate some might consider one or both of these to be a type of malware). As someone else noted, a large block of mov instructions would be quite easy to spot so you'd have to tie it into a bit of core application / algorithm logic. But that doesn't mean the whole program needs to be written that way.
  - teddyh 5y ago
    All software which does something that the user (owner of the device) would rather it didn’t do, is malware.
    - foldor 5y ago
      That's yoo generous of a definition. I would prefer if the software I used didn't crash, or have any bugs, but mistakes get made sometimes. By your definition, that's malware. I would say malware is software who's primary focus is to do things the user wouldn't like. A game checking DRM licenses isn't malware as it's not the primary purpose, just an annoying aspect.
      - teddyh 5y ago
        You’re right, my definition was too broad; intention should matter. But DRM would still count; it intentionally does something which the user or device owner would rather it did not do.
    - Wowfunhappy 5y ago
      So every software with a license check is malware? That doesn't necessarily mean it verifies with an external server, it might just locally check a code and use some bits contained therein to print "Registered to XXXX" on the about screen. What about a one-time screen kindly asking for a donation?
      - teddyh 5y ago
        > So every software with a license check is malware? Yes? Obviously? > What about a one-time screen kindly asking for a donation? If it doesn’t have a “don’t show this again” checkbox, then I would have to say “yes”.
lanbanger 5y ago
I laughed at the flow control graph as well, properly hilarious. I liken the motivations behind things like Movfuscator to mountain climbing: they do it because it's there to be done.
- mro_name 5y ago
  yes, both are related to art – just without the need for an audience. It's play.
schoen 5y ago
> Would text based software even be usable with this? I just wrote a quick C program to find the primes less than 100000 and compiled it with gcc and movcc. I wouldn't say it's, you know, fast, but I'm impressed at how it does finish in an amount of time that I was willing to wait. $ time ./primes.gcc | wc -l 9592 real 0m0.035s user 0m0.031s sys 0m0.012s $ time ./primes.movcc | wc -l 9592 real 0m10.511s user 0m8.289s sys 0m2.228s It looks like the reason that it spent so much time in syscalls is that it somehow uses signals for control flow. (I'm not quite sure how that works.)
- eadler 5y ago
  movccc uses a faulting mov instruction to complete the execution loop. without this a jmp is required for infinite execution. see https://github.com/xoreaxeaxeax/movfuscator/blob/master/movfuscator/movfuscator.c#L868 https://github.com/xoreaxeaxeax/movfuscator/blob/master/movf... and https://github.com/xoreaxeaxeax/movfuscator/blob/master/movfuscator/movfuscator.c#L2400 https://github.com/xoreaxeaxeax/movfuscator/blob/master/movf...
  - diydsp 5y ago
    Could that tbeoretically be replaced with a conditional move to recoup?

vgel 5y ago

Could maybe be useful for malware obfuscation?

jandrese 5y ago
As long as you don't need your malware to actually accomplish anything. Also, a chunk of code that is just a long string of MOV instructions is going to be really easy to spot for an antivirus program.
- vgel 5y ago
  What do you mean? Movcc can call external functions (with a jmp, tbf)
  - jandrese 5y ago
    Mostly that it's terribly slow.
grawprog 5y ago
That was about the only thing I could think of.
quietbritishjim 5y ago
Or for license check / DRM (I appreciate some might consider one or both of these to be a type of malware). As someone else noted, a large block of mov instructions would be quite easy to spot so you'd have to tie it into a bit of core application / algorithm logic. But that doesn't mean the whole program needs to be written that way.
- teddyh 5y ago
  All software which does something that the user (owner of the device) would rather it didn’t do, is malware.
  - foldor 5y ago
    That's yoo generous of a definition. I would prefer if the software I used didn't crash, or have any bugs, but mistakes get made sometimes. By your definition, that's malware. I would say malware is software who's primary focus is to do things the user wouldn't like. A game checking DRM licenses isn't malware as it's not the primary purpose, just an annoying aspect.
    - teddyh 5y ago
      You’re right, my definition was too broad; intention should matter. But DRM would still count; it intentionally does something which the user or device owner would rather it did not do.
  - Wowfunhappy 5y ago
    So every software with a license check is malware? That doesn't necessarily mean it verifies with an external server, it might just locally check a code and use some bits contained therein to print "Registered to XXXX" on the about screen. What about a one-time screen kindly asking for a donation?
    - teddyh 5y ago
      > So every software with a license check is malware? Yes? Obviously? > What about a one-time screen kindly asking for a donation? If it doesn’t have a “don’t show this again” checkbox, then I would have to say “yes”.

lanbanger 5y ago

I laughed at the flow control graph as well, properly hilarious. I liken the motivations behind things like Movfuscator to mountain climbing: they do it because it's there to be done.

mro_name 5y ago
yes, both are related to art – just without the need for an audience. It's play.

schoen 5y ago

> Would text based software even be usable with this? I just wrote a quick C program to find the primes less than 100000 and compiled it with gcc and movcc. I wouldn't say it's, you know, fast, but I'm impressed at how it does finish in an amount of time that I was willing to wait. $ time ./primes.gcc | wc -l 9592 real 0m0.035s user 0m0.031s sys 0m0.012s $ time ./primes.movcc | wc -l 9592 real 0m10.511s user 0m8.289s sys 0m2.228s It looks like the reason that it spent so much time in syscalls is that it somehow uses signals for control flow. (I'm not quite sure how that works.)

eadler 5y ago
movccc uses a faulting mov instruction to complete the execution loop. without this a jmp is required for infinite execution. see https://github.com/xoreaxeaxeax/movfuscator/blob/master/movfuscator/movfuscator.c#L868 https://github.com/xoreaxeaxeax/movfuscator/blob/master/movf... and https://github.com/xoreaxeaxeax/movfuscator/blob/master/movfuscator/movfuscator.c#L2400 https://github.com/xoreaxeaxeax/movfuscator/blob/master/movf...
- diydsp 5y ago
  Could that tbeoretically be replaced with a conditional move to recoup?