18 ms·
This is a great example of Bratus et al refer to as a "weird machine" [1], in which an attacker uses crafted input to create a new and unexpected computational
by apawloski 14y ago
This is a great example of Bratus et al refer to as a "weird machine" [1], in which an attacker uses crafted input to create a new and unexpected computational environment. That is, by using special input, the attacker manipulates pieces of the target program to act like a CPU that processes "weird commands" (ie more special inputs are used as assembly instructions that run on the weird machine).
Anyway, there is a rising field ("language-theoretic security") that studies this phenomenon. If this Pokemon example interests you, then you should give it a look.
[1]http://www.cs.dartmouth.edu/~sergey/langsec/ http://www.cs.dartmouth.edu/~sergey/langsec/
- anextio 14y agoA fantastic talk by Meredith L. Patterson on this very topic at 28c3: http://www.youtube.com/watch?v=3kEfedtQVOY http://www.youtube.com/watch?v=3kEfedtQVOY
- drudru11 14y agoWow - excellent link. I've been thinking about this lately. I'm not alone in thinking that languages are going to be important here. This is a great resource for further study! Thanks!
- d0m 14y agoIsn't it a little like forcing a shell or repl out of a running program?
- jopt 14y agoMore like reimplementing a shell from within a shell and running your program on the latter.
- philh 14y agoNot really. As I understand, the different layers are: 1. In-game, he can write non-arbitrary but sufficiently powerful machine code to be executed directly. He uses this to write layer two. 2. He can write arbitrary machine code using A, B, start, select. He uses this to write layer three. 3. He can write arbitrary machine code using all the buttons (including d-pad combinations that I assume are physically impossible). He uses this to write the balloons. All the code that actually gets run is precompiled machine code being executed by the processor. (There's nothing to stop him writing a shell, he just didn't.) He's not exploiting a system which happens to be turing-complete, he's gaining access to a system which was designed to be turing-complete but locked down.
- gizmo686 14y agoMy understanding was that he exploited a buffer overflow in the inventory menu to get the cpu to jump execution to data he had crafted.