8 ms·

>These redundant encodings are used by some assemblers to “fingerprint” their output. Fascinating! Does anyone have links to more information about this? What

by aftbit 4y ago

>These redundant encodings are used by some assemblers to “fingerprint” their output. Fascinating! Does anyone have links to more information about this? What purpose might one have for this fingerprinting?

retrac 4y ago
If you sell a commercial compiler or assembler, and some company starts selling a product produced with your compiler/assembler, and you know you never sold them a license, you've got yourself someone to sue. For a less successful/commercial product, it could also just be for the joy of finding it used in the wild. Similar fingerprinting techniques were also used by assembly coders as proof of copyright. When reverse-engineering to a spec, it's not unusual for routines, even long routines, as well as lookup tables, etc. to end up being coded the same, or nearly so, as the original software. This isn't necessarily infringing of copyright -- for example there are only a few sensible ways to check if a character is uppercase in ASCII. It can be hard to tell reverse-engineered and re-implemented code, from disassembled and reshuffled code (which is copyright infringement). If the suspect routine incorporates something like an idiosyncratic sequence of NOPs that serve no particular purpose, coincidence is a lot harder to argue.
bell-cot 4y ago
One example (scroll down to 'Code fingerprint') - https://en.wikipedia.org/wiki/A86_(software) https://en.wikipedia.org/wiki/A86_(software)
- rep_lodsb 4y ago
  Can anyone find a version of A86 that actually encodes some information in its output, or is this just a legend? It produces different opcodes for some instructions than MASM, but so do DEBUG and various other assemblers. And the same instruction repeated multiple times always assembles to the same opcode as far as I have seen. To prove some program was made with A86, there would have to be a more specific signature that wouldn't match any other assembler, like a copyright message encoded bit-by-bit in the opcode choice.
  - rep_lodsb 4y ago
    Tried it out now with different instructions. There's a pattern, though it's not quite a steganographic message, just a different encoding chosen depending on the second register operand. 02 C0 ADD AL,AL 02 C1 ADD AL,CL 00 D0 ADD AL,DL 00 D8 ADD AL,BL 02 C4 ADD AL,AH 02 C5 ADD AL,CH 00 F0 ADD AL,DH 00 F8 ADD AL,BH Don't know if this would hold up in court for proving that some code was assembled with A86... edit: other ALU ops are the same; for MOV the "direction bit" is inverted.
    - a1369209993 4y ago
      That's not a a86 thing; it's to avoid generating a modrm byte that can be decoded as a return instruction[0] for ROP gadgets. $ zasm -Mx86 -='add al al;add al dl;add dl al' 000000 - 02 C0 00 D0 02 D0 |...... | $ hex C3 | ndisasm -au - 00000000 C3 ret 0: C2, C3, CA, or CB, so modrm (ax/cx) (dx/bx)
      - rep_lodsb 4y ago
        ROP wasn't a concept back then. From the manual of the latest version of A86: A86 assembler package V4.05 January 14, 2000 The entire package is Copyright 2000 Eric Isaacson. All rights reserved.
csense 4y ago
When I first got into assembly language programming, I used MS-DOS DEBUG as my assembler, since it was included on basically every PC in those days. I was extremely frustrated because my textbook's later chapters used MASM as the assembler, which at the time cost some ghastly amount of money (somewhere around $180 if I recall correctly, which was a truly staggering number of birthday and Christmas presents). Anyway, my point is, in 2022 everyone takes for granted that an assembler for any system that matters can be downloaded for free from the Internet -- or if it doesn't, one will soon be written by some enthusiast and posted on Gitlab. But back in the 1980's and well into the 1990's, assemblers were expensive products that companies actually got away with charging a lot of money for. Presumably they made a significant amount of revenue from those sales. So the use case that immediately springs to my mind is being able to prove a particular commercial binary was assembled by your assembler, in order to make a successful accusation of software piracy and extract a monetary settlement from its developer.
- jacquesm 4y ago
  Yes, this is very much true. For the first three systems I owned I wrote my own assembler, just to save some money (which was incredibly tight in those days, as in: that was three months worth of food or so). Time was worth relatively little in comparison and I figured I will at least know the instruction set inside-out.
  - rightbyte 4y ago
    How did you do that? Did you bootstrap it with hand-assembled code or some Basic? Did you assemble the assembler with itself?
    - dhosek 4y ago
      When I was in high school, I hand-assembled my 6502 code. I’d write it longhand out on graph paper, then write down addresses in the leftmost column, opcodes in the middle & finally I’d type in all the hex from the Apple Monitor. It was slow, painstaking and error-prone, but it made for clear thinking about how the program worked before I sat at the computer.
woodruffw 4y ago
Not for fingerprinting, but I wrote a tool that does this to hide messages in x86 binaries[1]. I also wrote an explanation here[2]. [1]: https://github.com/woodruffw/steg86 https://github.com/woodruffw/steg86 [2]: https://blog.yossarian.net/2020/08/16/Hiding-messages-in-x86-binaries-using-semantic-duals https://blog.yossarian.net/2020/08/16/Hiding-messages-in-x86...
ralferoo 4y ago
a86[1] was definitely one that did. It was sold under a shareware model, and if you used it commercially you were supposed to buy the licence. I guess they randomly sampled other people's software to see if it looked like it was built with a86 or not, but honestly I'd never actually heard of them doing that and suspected that it was just enough of a threat to know it was possible that they hoped people would pay up. [1] https://en.wikipedia.org/wiki/A86_(software) https://en.wikipedia.org/wiki/A86_(software)

by aftbit 4y ago

retrac 4y ago

If you sell a commercial compiler or assembler, and some company starts selling a product produced with your compiler/assembler, and you know you never sold them a license, you've got yourself someone to sue. For a less successful/commercial product, it could also just be for the joy of finding it used in the wild. Similar fingerprinting techniques were also used by assembly coders as proof of copyright. When reverse-engineering to a spec, it's not unusual for routines, even long routines, as well as lookup tables, etc. to end up being coded the same, or nearly so, as the original software. This isn't necessarily infringing of copyright -- for example there are only a few sensible ways to check if a character is uppercase in ASCII. It can be hard to tell reverse-engineered and re-implemented code, from disassembled and reshuffled code (which is copyright infringement). If the suspect routine incorporates something like an idiosyncratic sequence of NOPs that serve no particular purpose, coincidence is a lot harder to argue.

bell-cot 4y ago

One example (scroll down to 'Code fingerprint') - https://en.wikipedia.org/wiki/A86_(software) https://en.wikipedia.org/wiki/A86_(software)

rep_lodsb 4y ago
Can anyone find a version of A86 that actually encodes some information in its output, or is this just a legend? It produces different opcodes for some instructions than MASM, but so do DEBUG and various other assemblers. And the same instruction repeated multiple times always assembles to the same opcode as far as I have seen. To prove some program was made with A86, there would have to be a more specific signature that wouldn't match any other assembler, like a copyright message encoded bit-by-bit in the opcode choice.
- rep_lodsb 4y ago
  Tried it out now with different instructions. There's a pattern, though it's not quite a steganographic message, just a different encoding chosen depending on the second register operand. 02 C0 ADD AL,AL 02 C1 ADD AL,CL 00 D0 ADD AL,DL 00 D8 ADD AL,BL 02 C4 ADD AL,AH 02 C5 ADD AL,CH 00 F0 ADD AL,DH 00 F8 ADD AL,BH Don't know if this would hold up in court for proving that some code was assembled with A86... edit: other ALU ops are the same; for MOV the "direction bit" is inverted.
  - a1369209993 4y ago
    That's not a a86 thing; it's to avoid generating a modrm byte that can be decoded as a return instruction[0] for ROP gadgets. $ zasm -Mx86 -='add al al;add al dl;add dl al' 000000 - 02 C0 00 D0 02 D0 |...... | $ hex C3 | ndisasm -au - 00000000 C3 ret 0: C2, C3, CA, or CB, so modrm (ax/cx) (dx/bx)
    - rep_lodsb 4y ago
      ROP wasn't a concept back then. From the manual of the latest version of A86: A86 assembler package V4.05 January 14, 2000 The entire package is Copyright 2000 Eric Isaacson. All rights reserved.

csense 4y ago

When I first got into assembly language programming, I used MS-DOS DEBUG as my assembler, since it was included on basically every PC in those days. I was extremely frustrated because my textbook's later chapters used MASM as the assembler, which at the time cost some ghastly amount of money (somewhere around $180 if I recall correctly, which was a truly staggering number of birthday and Christmas presents). Anyway, my point is, in 2022 everyone takes for granted that an assembler for any system that matters can be downloaded for free from the Internet -- or if it doesn't, one will soon be written by some enthusiast and posted on Gitlab. But back in the 1980's and well into the 1990's, assemblers were expensive products that companies actually got away with charging a lot of money for. Presumably they made a significant amount of revenue from those sales. So the use case that immediately springs to my mind is being able to prove a particular commercial binary was assembled by your assembler, in order to make a successful accusation of software piracy and extract a monetary settlement from its developer.

jacquesm 4y ago
Yes, this is very much true. For the first three systems I owned I wrote my own assembler, just to save some money (which was incredibly tight in those days, as in: that was three months worth of food or so). Time was worth relatively little in comparison and I figured I will at least know the instruction set inside-out.
- rightbyte 4y ago
  How did you do that? Did you bootstrap it with hand-assembled code or some Basic? Did you assemble the assembler with itself?
  - dhosek 4y ago
    When I was in high school, I hand-assembled my 6502 code. I’d write it longhand out on graph paper, then write down addresses in the leftmost column, opcodes in the middle & finally I’d type in all the hex from the Apple Monitor. It was slow, painstaking and error-prone, but it made for clear thinking about how the program worked before I sat at the computer.

woodruffw 4y ago

Not for fingerprinting, but I wrote a tool that does this to hide messages in x86 binaries[1]. I also wrote an explanation here[2]. [1]: https://github.com/woodruffw/steg86 https://github.com/woodruffw/steg86 [2]: https://blog.yossarian.net/2020/08/16/Hiding-messages-in-x86-binaries-using-semantic-duals https://blog.yossarian.net/2020/08/16/Hiding-messages-in-x86...

ralferoo 4y ago

a86[1] was definitely one that did. It was sold under a shareware model, and if you used it commercially you were supposed to buy the licence. I guess they randomly sampled other people's software to see if it looked like it was built with a86 or not, but honestly I'd never actually heard of them doing that and suspected that it was just enough of a threat to know it was possible that they hoped people would pay up. [1] https://en.wikipedia.org/wiki/A86_(software) https://en.wikipedia.org/wiki/A86_(software)