3 ms·
Let's pretend a compiler with this backdoor will always correctly detect when it's compiling a compiler. I.e. looksLikeCompilerCode() and generateCompilerWithB
by csense 13y ago
Let's pretend a compiler with this backdoor will always correctly detect when it's compiling a compiler. I.e. looksLikeCompilerCode() and generateCompilerWithBackDoorDetection() are oracles.
With this assumption, to write a compiler that's safe, you can't run it through an existing possibly-compromised compiler. You would have to bootstrap your safe compiler, as if for a totally new language.
So you'd have to initially write it in a different language. You probably can't write it in most existing languages, e.g. Python and Java are both implemented in C. Because, if you tried to write a safe compiler in Python, a sufficiently smart [1] C compiler would have been able to tell that you were compiling a Python interpreter when it compiled /usr/bin/python, and inserted a backdoor into that Python interpreter which will trigger when the interpreter is interpreting a C compiler written in Python.
You'd basically have to consider any code that has ever passed through an automated tool to be potentially backdoored, so you'd have to start writing in machine code (no assembler allowed, of course, because it's probably written in C). Of course, you could program an assembler in pure machine code (or using a potentially-tainted assembler, verifying its output by hand).
[1] It'd either be a general artificial intelligence of human level programming ability, or some kind of magical oracle.
- e12e 13y agoReading this, I was reminded of an article using the dos debug[1] command to bootstrap tools written from (memorized) assembly language. Note, I can't find the actual article now - I think it may have been in one of the early issues of Phrack[2]. [1] http://www.intel-assembler.it/portale/5/Write-an-assembly-program-using-DEBUG/Write-an-assembly-program-using-DEBUG.asp http://www.intel-assembler.it/portale/5/Write-an-assembly-pr... [2] http://www.phrack.org http://www.phrack.org