5 ms·
Research paper is also an executable x86 program [pdf]
- mizzao 3y agoIs it executable by renaming the .txt file to an .exe or what?
- revskill 3y agoI guess by chmod +x .
- AntiRush 3y agoYep, it has the telltale MZ header at the top. Either a DOS or windows executable. [1] The pdf appears to be a readable formatted version, to get the actual executable you’ll need the raw text sans newlines (as described in the paper) 1:https://en.m.wikipedia.org/wiki/DOS_MZ_executable https://en.m.wikipedia.org/wiki/DOS_MZ_executable
- netsharc 3y agoTrivia: all Windows EXEs run on DOS, but most of them just print something like "this program doesn't run on DOS" and terminate. There are exceptions, like REGEDIT.EXE of Windows 95.
- lifthrasiir 3y agoAnd you can replace the default DOS stub file with `/STUB` in the MSVC linker. Different linkers can and do use different stub files, though MSVC and GCC happen to use the same stub file because the original author of the BFD code---that was eventually used by GNU ld to generate a PE file---had apparently no idea what it was... /* this next collection of data are mostly just characters. It appears to be constant within the headers put on NT exes */ filehdr_in->pe.dos_message[0] = 0x0eba1f0e; filehdr_in->pe.dos_message[1] = 0xcd09b400; filehdr_in->pe.dos_message[2] = 0x4c01b821; /* ... snip ... */ filehdr_in->pe.dos_message[13] = 0x0a0d0d2e; filehdr_in->pe.dos_message[14] = 0x24; filehdr_in->pe.dos_message[15] = 0x0; filehdr_in->pe.nt_signature = NT_SIGNATURE; (Of course, this code dates back to 1996 or earlier so the existence of DOS stubs might not have been a common knowledge if you didn't do any Windows programming.) On the other hand, lld uses a functionally same but slightly different stub file [1] because it prints no newlines. [1] https://github.com/llvm/llvm-project/blob/d7642b2/lld/COFF/Writer.cpp#L50-L76 https://github.com/llvm/llvm-project/blob/d7642b2/lld/COFF/W...
- sumtechguy 3y agoEven the DLL's are executables. It is about 100 bytes in where it says the real executable type. Some are OS1.x, win3x, win32... and so on. Think there is also a platform byte (x86, arm, mips, etc). My google fu is failing on the list of different types at the moment.
- Hogarth01 3y agoHere's the companion video for the paper: https://www.youtube.com/watch?v=LA_DrBwkiJA https://www.youtube.com/watch?v=LA_DrBwkiJA
- FatherPaulStone 3y agoWell that was a fantastic watch. Thanks for sharing.
- adgjlsfhk1 3y agofor bonus points, the video should also be executable :)
- tak2hu 3y agoReminds me a PDF which is also bootable x86 image from PoC||GTFO [1], specifically the second issue (0x02) on section 8 “This OS is also a PDF” [1] https://pocorgtfo.hacke.rs/ https://pocorgtfo.hacke.rs/
- uptheroots 3y agoTom7 the goat
- Doubtme 3y ago[dead]
- codyd51 3y agoThis is a very impressive and fun piece of work!
- lifthrasiir 3y agoNot only that, but it is an executable x86 program written in a printable subset of x86 instructions (so no self-modifying code), as noted in the section 3 with a comparison to the similarly printable EICAR anti-virus test file.
- x86x87 3y agoYes. This is nuts (in a good way). I remember the first time I saw the video on youtube and the author was going through how he's going to do this with only printable chatacter and i had a "no fucking way" moment followed by being in awe at the solution that was found.
- Two9A 3y agoMany years ago, I wrote up a post on doing this kind of thing in plain DOS .com files: https://imrannazar.com/articles/x86-printable-opcodes https://imrannazar.com/articles/x86-printable-opcodes It's good to see the principle can be expanded to EXEs, I'll have to dig into this some more.
- tomcam 3y agoJustine is probably adding both targets to the αcτµαlly pδrταblε εxεcµταblε toolchain
- urbandw311er 3y agoWhat does it do when executed?
- genewitch 3y agoit plays music specified by a printable format given as an argument. By default it plays a default song (i didn't bother to see what it was), and 3 other songs. Author described as 'a bad organ' sound. It's not much of a slog, but i did zone out around the 16th part, before i could get to the loops and not having access to the asm INT opcode
- ChrisMarshallNY 3y agoOne of my employees once wrote a specification for his vignette correction algorithm in Postscript. The illustrations and charts were actual examples of his algorithm, being executed at render time.
- sim7c00 3y agoreminds me of PoC || GTFO e-zine stuff :D fun things! cool piece!
- dpflan 3y agoKnuth would approve of this literate programming?
- alchemist1e9 3y agoLazy question, sorry briefly skimmed the PDF and this doesn’t do this, but hypothetically could one design a PDF file generator technique the produces a spec compliant file that uses this technique to chain load another arbitrary base64 encoded binary stored inside the PDF. Maybe someone has already done that.
- huppeldepup 3y agoWhen he talked about the inability to jump to certain places it reminded me of a powerpoint I read a decade or two back that discussed the disassembly of Skype. They used any and every trick in the book to make disassembly impossible, like calculating an int, feeding it to a cosine instruction and the result would be the jump distance. I tried finding the powerpoint but alas Google is garbage these days, maybe the author can find some hints in there to reduce the amount of code coming out of the compiler. Wish I had come up with this compiler, great stuff.
- arthurmorgan 3y agoIs this the presentation that you're referring to? https://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-biondi/bh-eu-06-biondi-up.pdf https://www.blackhat.com/presentations/bh-europe-06/bh-eu-06... https://archive.org/details/Fabrice_Desclaux_and_Kostya_Kortchinsky_Vanilla_Skype https://archive.org/details/Fabrice_Desclaux_and_Kostya_Kort...
- huppeldepup 3y agoIt isn't, unfortunately. Thanks for looking, though. The presentation I had was a powerpoint that focussed entirely on the disassembly and anti-debugging tricks, nothing about networking or traffic analysis.
- tw1984 3y agohard core science!
- CatchSwitch 3y agoI love this guy's content so much. Easily one of my favorite programming content creators around
- o11c 3y agoContrary to what's in the paper, I'm pretty sure IMUL-by-constant is in fact useful, since you can use subtraction: x * (a - b) === x * a - x * b and this applies even when losing the top half.