3 ms·

> decompilers ... converge to a fixed point but why would you assume that the decompiler is not backdoored? It would know to remove the backdoor code, so the

• TeMPOraL 3y ago
  In theory, any computer tool you use could've already been compromised. You can't be 100% certain (even if you bootstrap from hand-made punchcards, the backdoor could be hidden in hardware). In practice, you can push the likelihood of this down to arbitrarily small levels. Pick a decompiler that's as unrelated to your compiler as you can find. Then pick a second decompiler that's maximally unrelated to both the compiler and the first decompiler. It's highly unlikely all three tools will be backdoored in a fully compatible way.
  • codeflo 3y ago
    Not if the backdoor is inserted into fopen/mmap calls in such a way that when any executable opens the binary for reading, it sees a version without the backdoor.
    • wizzwizz4 3y ago
      That can't be done without either changing the file size or being really obvious.
      • acdha 3y ago
        Malware does that all the time - return different stat() results, change the contents for anything which isn’t execution, etc. It’s detectable but fundamentally you’re in a nasty race since the attacker can use the same tools you do.
  • ericpauley 3y ago
    > In theory, any computer tool you use could've already been compromised. You can't be 100% certain (even if you bootstrap from hand-made punchcards, the backdoor could be hidden in hardware). This is the whole point of Thompson’s lecture, though.