28 Sep
2004
28 Sep
'04
7:46 a.m.
From: "ben franchuk"
<bfranchuk(a)jetnet.ab.ca>
Peter C. Wallace wrote:
Hi
It is interesting that different people have different ideas
as to what self modifying code is. Actually, the ability to
load code and execute from a mass storage is self modifying.
Code that uses a variable value for a table to look up execution
addresses is self modifying. Most every multitasking system
I've seen are self modifying.
I think what people consider dangerous self modifying is
when the program alters the actual execution instructions in
memory and then executes them. It is strange that this form
gets such a large amount of emotional negative response while
other types are hardly considered issues.
No matter how the code is written, one can make bad code in
most any form. One can also make good code as well. There is
no reason why self modifying code should be any more dangerous
than any other type of coding if done with a complete understanding
of what the limitations are. What is the difference between
replacing one or two instructions and then executing them or
replacing an overlay and then executing that overlay? Other
than size, both are doing the same thing. One is forbidden
while the other is normal operation.
Dwight
Isn't self modifying code pretty much
deprecated these days (aside from
trampolines and such)
So what is a trampoline?
Peter Wallace
I have yet to see a good use for self-modifying code. Other than
subroutines and interupts placing data into a code segement the only
self modifying code I have seen was for the 8088.
Ben.
28 Sep
28 Sep
8:50 a.m.
New subject: Self Modifing Code was RE: Harvard vs. vonNeuman
>> It is interesting that different people have
different
>> ideas as to what self modifying code is. Actually, the
>> ability to load code and execute from a mass storage is
>> self modifying.
AGREED
>> Code that uses a variable value for a table to
look up
>> execution addresses is self modifying.
DISAGREE [the contents of a location containing executabgle code are never
changed]
>> Most every
>> multitasking system I've seen are self modifying.
AGREED
>> I think what people consider dangerous self
modifying is
>> when the program alters the actual execution instructions
>> in memory and then executes them. It is strange that this
>> form gets such a large amount of emotional negative
>> response while other types are hardly considered issues.
>> No matter how the code is written, one can make bad code
>> in most any form. One can also make good code as well.
>> There is no reason why self modifying code should be any
>> more dangerous than any other type of coding if done with a
>> complete understanding of what the limitations are. What is
>> the difference between replacing one or two instructions
>> and then executing them or replacing an overlay and then
>> executing that overlay? Other than size, both are doing the
>> same thing. One is forbidden while the other is normal operation.
Since when do peoples reactions and reality coincide?
When I was involved in military systems development [77-92] the restriction
[for certain applications] against self-modifying code were quite clear:
Program memory had to be completely inviolate to change, execution out of
modifiable memory was not allowed, AND this had to be hardware enforced.
9:23 a.m.
>>>> "Dwight" == Dwight K Elvey
<dwight.elvey(a)amd.com> writes:
Dwight> Hi It is interesting that different people have different
Dwight> ideas as to what self modifying code is. Actually, the
Dwight> ability to load code and execute from a mass storage is self
Dwight> modifying.
Indeed.
Dwight> Code that uses a variable value for a table to
Dwight> look up execution addresses is self modifying.
Not as the term is usually used. You're changing a pointer, and
pointers are data. Ask yourself "do I have to flush the I-cache for
this to work?" The answer in this case is NO.
Dwight> Most every
Dwight> multitasking system I've seen are self modifying. I think
Dwight> what people consider dangerous self modifying is when the
Dwight> program alters the actual execution instructions in memory
Dwight> and then executes them. It is strange that this form gets
Dwight> such a large amount of emotional negative response while
Dwight> other types are hardly considered issues. No matter how the
Dwight> code is written, one can make bad code in most any form.
True.
Part of the issue, for modern machines, is that the hardware gets in
the way. If you change code, the I-cache doesn't change (in machines
I'm familiar with) so the old instruction may still execute. This
makes instruction modification a tricky business. Debuggers do it,
operating systems do it -- and both have to pay attention to all the
cache magic you have to perform for it to be right.
paul
10:08 a.m.
On Sep 28, 2004, at 9:46 AM, Dwight K. Elvey wrote:
> From: "ben franchuk"
<bfranchuk(a)jetnet.ab.ca>
>
> Peter C. Wallace wrote:
>> Isn't self modifying code pretty much deprecated these days (aside
>> from
>> trampolines and such)
>>
Can you create self modifying code in any high level language, the kind
of code
where the application program actually changes it's own instructions?
I know in C it is possible to pass an address of a function to a
function, that's not
really what I mean.
11:05 a.m.
>> >>>
>> Can you create self modifying code in any high level
>> language, the kind of code where the application program
>> actually changes it's own instructions?
>>
>> I know in C it is possible to pass an address of a function
>> to a function, that's not really what I mean.
>>
Actually this is (sort of) becoming more common. One exciting feature of a
new platform by the software vendor who shall not be named, is that the
compiler is actually part of the runtime. This means that any program can
write source code to a string (or other structure) and compile and execute
it!!!!!!
11:44 a.m.
On Tue, Sep 28, 2004 at 04:05:18PM -0400, David V. Corbin wrote:
This "new feature" has been with us for a _long_ time, just not with the
likes of C. Having the full language always available and being able to
write programs that build, compile and execute programs at runtime
without any special tools is one of the many nice features of Common
Lisp and in general, most lisp-like languages. Seems again that The
Software Vendor That Shall Not Be Named knows where to steal his "new
features" ;-)
Regards,
Alex.
--
"Opportunity is missed by most people because it is dressed in overalls and
looks like work." -- Thomas A. Edison
>>
>>>
>> Can you create self modifying code in any high level
>> language, the kind of code where the application program
>> actually changes it's own instructions?
>>
>> I know in C it is possible to pass an address of a function
>> to a function, that's not really what I mean.
>>
Actually this is (sort of) becoming more common. One exciting feature of a
new platform by the software vendor who shall not be named, is that the
compiler is actually part of the runtime. This means that any program can
write source code to a string (or other structure) and compile and execute
it!!!!!! 
12:12 p.m.
On Tue, 2004-09-28 at 16:05 -0400, David V. Corbin wrote:
I suppose it's been around in interpreted languages for years. No doubt
you-know-who will claim they invented it though (and worse still, most
of the users will believe them)
>>
>>>
>> Can you create self modifying code in any high level
>> language, the kind of code where the application program
>> actually changes it's own instructions?
Actually this is (sort of)
becoming more common. This means that any program can
write source code to a string (or other structure) and compile and execute
it!!!!!!
Sounds like a dream come true for virus writers :-)
cheers,
Jules
7:53 a.m.
On Tue, 28 Sep 2004, Jules Richardson wrote:
On Tue, 2004-09-28 at 16:05 -0400, David V. Corbin
wrote:
I suppose it's been around in interpreted languages for years. No doubt
you-know-who will claim they invented it though (and worse still, most
of the users will believe them)
Just wait until they attempt to patent it. Which will pale compared to
when they are actually awarded the patent.
--
Sellam Ismail Vintage Computer Festival
------------------------------------------------------------------------------
International Man of Intrigue and Danger http://www.vintage.org
[ Old computing resources for business || Buy/Sell/Trade Vintage Computers ]
[ and academia at www.VintageTech.com || at http://marketplace.vintage.org ]
>>
>>>
>> Can you create self modifying code in any high level
>> language, the kind of code where the application program
>> actually changes it's own instructions?
Actually this is (sort of)
becoming more common.
1:06 p.m.
On Sep 28, 2004, at 2:12 PM, Jules Richardson wrote:
On Tue, 2004-09-28 at 16:05 -0400, David V. Corbin
wrote:
I suppose it's been around in interpreted languages for years. No doubt
you-know-who will claim they invented it though (and worse still, most
of the users will believe them)
Or they will try to patent it.
>>>>>
>> Can you create self modifying code in any high level
>> language, the kind of code where the application program
>> actually changes it's own instructions?
Actually this is (sort of)
becoming more common. This means that any program can
write source code to a string (or other structure) and compile and
execute
it!!!!!!
Sounds like a dream come true for virus writers :-)
cheers,
Jules
5:54 p.m.
On Tue, Sep 28, 2004 at 04:05:18PM -0400, David V. Corbin wrote:
Actually this is (sort of) becoming more common. One
exciting feature of a
new platform by the software vendor who shall not be named, is that the
compiler is actually part of the runtime. This means that any program can
write source code to a string (or other structure) and compile and execute
it!!!!!!
You mean like Perl's 'eval'?
-ethan
--
Ethan Dicks, A-130-S Current South Pole Weather at 29-Sep-2004 02:50 Z
South Pole Station
PSC 468 Box 400 Temp -55.1 F (-48.4 C) Windchill -97.8 F (-72.2 C)
APO AP 96598 Wind 21.9 kts Grid 013 Barometer 683.5 mb (10496. ft)
Ethan.Dicks(a)amanda.spole.gov http://penguincentral.com/penguincentral.html
11:24 a.m.
Rumor has it that Ron Hudson may have mentioned these words:
On Sep 28, 2004, at 9:46 AM, Dwight K. Elvey wrote:
Sure... I've seen examples (and made one, *years* ago) in Microsoft Basic
on my CoCo.
If you consider MERGEing different basic programs (if you MERGE in a new
program where line numbers match, most basics that I'd worked with would
replace the original statement with the new... if you count that, it was
rather common in the CoCo world.
I'd seen one in applesoft basic as well -- it had to do with
self-populating DATA statements, IIRC.
Laterz,
Roger "Merch" Merchberger
--
Roger "Merch" Merchberger --- sysadmin, Iceberg Computers
zmerch(a)30below.com
Hi! I am a .signature virus. Copy me into your .signature to join in!
>From: "ben franchuk"
<bfranchuk(a)jetnet.ab.ca>
>
>Peter C. Wallace wrote:
>>Isn't self modifying code pretty much deprecated these days (aside from
>>trampolines and such)
Can you create self modifying code in any high level
language, the kind of
code
where the application program actually changes it's own instructions?
I know in C it is possible to pass an address of a function to a function,
that's not
really what I mean. 
1 Oct
1 Oct
11:39 a.m.
New subject: Harvard vs. vonNeumanZ
On Tue, 28 Sep 2004, Roger Merchberger wrote:
If you consider MERGEing different basic programs (if
you MERGE in a new
program where line numbers match, most basics that I'd worked with would
replace the original statement with the new... if you count that, it was
rather common in the CoCo world.
BASIC "code" is data, interpreted by an interpreter program,
so this does not count as self-modifying in a global sort of way.
In fact the whole idea of self-modifying and to a limited extent,
stored-program is somewhat slippery.
Non-stored-program computers, like the old Harvard relay
calculators and new Microchip Inc's PICs, can however simulate
a stored-program computer, by having the fixed, unchanging
program be an interpreter for a scheme that is, in effect,
stored-program. This isn't very amazing or even notable, since
"real" stored-program computers are made out of dumb things like
transistors or even tubes, so making one out of a Harvard arch
"computer" is only a subset.
28 Sep
28 Sep
12:46 p.m.
>>>> "Ron" == Ron Hudson
<ron.hudson(a)sbcglobal.net> writes:
Ron> On Sep 28, 2004, at 9:46 AM, Dwight K. Elvey wrote:
>> From: "ben franchuk"
<bfranchuk(a)jetnet.ab.ca>
>>
>> Peter C. Wallace wrote:
>>> Isn't self modifying code pretty much deprecated these days
>>> (aside from trampolines and such)
>>>
Ron> Can you create self modifying code in any high level
language,
Ron> the kind of code where the application program actually changes
Ron> it's own instructions?
Ron> I know in C it is possible to pass an address of a function to a
Ron> function, that's not really what I mean.
I think the answer is "usually not". C is an exception, as you
noted. So is Espol, the OS writing language on Burroughs mainframes.
I'd also exclude systems (like PDP11s) which have a program overlay
mechanism -- that too of course is self-modifying code, and generally
would be supported with any language used on that system, high level
languages included.
paul
29 Sep
29 Sep
4:22 a.m.
At 04:46 PM 9/28/2004, Paul Koning wrote:
Ron> I know in C it is possible to pass an address
of a function to a
Ron> function, that's not really what I mean.
I think the answer is "usually not". C is an exception, as you
noted.
There were/are C interpreters, too - Gimpel C-terp comes to mind,
which I used under DOS way back in 1895 - oh wait - 1985 or so.
I can't remember if it had such a self-modifying extension.
- John
1 Oct
1 Oct
11:51 a.m.
I think a lot of this discussion missed the point, that 'stored
program' refers to what we (still) call HARDWARE.
I'm not convinced that all that many people really know what a
computer is (in Wittgenstein's direction) vs. what a computer
DOES (in Bill Gates' eyes)!
11:55 a.m.
Tom Jennings wrote:
I think a lot of this discussion missed the point,
that 'stored
program' refers to what we (still) call HARDWARE.
I'm not convinced that all that many people really know what a
computer is (in Wittgenstein's direction) vs. what a computer
DOES (in Bill Gates' eyes)!
Gates Computers = $$$
people You work on computers to make $$$
Classic users you make $$$ to collect computers
28 Sep
28 Sep
4:12 p.m.
Ron Hudson wrote:
...
Can you create self modifying code in any high level
language, the kind
of code
where the application program actually changes it's own instructions?
Back in high school I learned to program on a Wang 2200, which has only
BASIC, interpreted in microcode. Just for the entertainment value, I
wrote a program that would allow you to enter an arbitrary function as a
string and then would graph that function over the range specified.
It would have been possible to interpret that string to evaluate the
function at each point, but I did something relevant to the above question.
The 2200 had a block oriented tape system that allowed programs to read,
write, and step through blocks arbitrarily. I took the string that the
user hand entered, tokenized it, and wrote it out as a one line program
to the three blocks on the tape immediately following the graphing
program (program header block, program block, program trailer block).
The program would then OPEN the program just written, which would change
line 1000 which was something like
1000 DEFFNY(X)=X
but with the right hand side replaced with the desired function.
Although writing out the function and reading it back in took four or
five seconds, the speed of the graphing more than made up for it.
This was about the time that I figured out that the only difference
between "protected" programs (can be run but not saved, listed, or
modified) was a single bit at the start of the block header. It took
about five lines of code to open a block, flip the bit, and write it
back, thereby defeating the protection.
6:48 p.m.
It was thus said that the Great Ron Hudson once stated:
Can you create self modifying code in any high level language, the kind of
code where the application program actually changes it's own instructions?
Any high level language? Depends upon the language. Something like
Haskel or ML, not at all.
I know in C it is possible to pass an address of a
function to a function,
that's not really what I mean.
It violates ANSI C, and it certainly isn't portable, but yes, it can be
done. Maybe. And when you get it working (I didn't, but I'm not going to
waste much time on this), make sure you remember how you compiled it,
because any changes in compiler options will set you back to square one.
-spc (Below is my first attempt ... probably have the wrong location)
#include <stdlib.h>
#define UP_OPCODE 0x77
#define DOWN_OPCODE 0x72
void sort(int *array,size_t size)
{
size_t i;
size_t j;
int t;
for (i = 0 ; i < size ; i++)
{
for (j = i + 1 ; j < size ; j++)
{
if (array[i] > array[j])
{
t = array[i];
array[i] = array[j];
array[j] = t;
}
}
}
}
void sort_ascending(int *array,size_t size)
{
unsigned char *f;
f = (unsigned char *)sort;
f[0x16] = UP_OPCODE;
sort(array,size);
}
void sort_descending(int *array,size_t size)
{
unsigned char *f;
f = (unsigned char *)sort;
f[0x16] = DOWN_OPCODE;
sort(array,size);
}
int main(void)
{
int data[256];
sort_ascending(data,256);
sort_descending(data,256);
return(0);
}
6:56 p.m.
It was thus said that the Great Sean 'Captain Napalm' Conner once stated:
Okay, figured out why my code didn't work, and it's not due to writing to
the wrong location (although I suspect that still is a problem) but that
under Unix the code pages are marked read-only so of course it core dumped.
-spc (Another reason why self-modifying code is hard to do in C 8-P
I know in C it is possible to pass an address of
a function to a function,
that's not really what I mean.
It violates ANSI C, and it certainly isn't portable, but yes, it can be
done. Maybe. And when you get it working (I didn't, but I'm not going to
waste much time on this), make sure you remember how you compiled it,
because any changes in compiler options will set you back to square one.
6:53 p.m.
On Sat, Feb 11, 2006 at 11:39:25PM -0500, Sean 'Captain Napalm' Conner wrote:
Okay, figured out why my code didn't work, and
it's not due to writing to
the wrong location (although I suspect that still is a problem) but that
under Unix the code pages are marked read-only so of course it core dumped.
-spc (Another reason why self-modifying code is hard to do in C 8-P
But there are C compilers for the 68000, 6502, etc., for OSes that do _not_
require an MMU or other enforcement hardware (like AmigaDOS), let alone for
standalone programs for embedded environments (we had a C compiler for the
68000 for our COMBOARDs - 100% of the code was our own - no OS).
Some variant of your technique would work in any of those environments; the
'restriction' in this case is a UNIX one, not a C one.
-ethan
--
Ethan Dicks, A-130-S Current South Pole Weather at 29-Sep-2004 03:50 Z
South Pole Station
PSC 468 Box 400 Temp -55.2 F (-48.5 C) Windchill -99 F (-72.8 C)
APO AP 96598 Wind 23.1 kts Grid 011 Barometer 683.1 mb (10508. ft)
Ethan.Dicks(a)amanda.spole.gov http://penguincentral.com/penguincentral.html
7:05 p.m.
Okay, figured out why my code didn't work, and
it's not due to writing to
the wrong location (although I suspect that still is a problem) but that
under Unix the code pages are marked read-only so of course it core dumped.
I wonder if this is true in Winders. Seriously -- is it?
--
---------------------------------- personal: http://www.armory.com/~spectre/ --
Cameron Kaiser, Floodgap Systems Ltd * So. Calif., USA * ckaiser(a)floodgap.com
-- Actually, we can overcome gravity (just not the paperwork involved). -------
7:26 p.m.
It was thus said that the Great Cameron Kaiser once stated:
It may be (a function of the Intel processor), but you can get around this
my mapping those pages elsewhere with read/write access (well, in ring 0).
-spc (But I'm not terribly interested in the answer for Windows ... )
Okay, figured out why my code didn't work,
and it's not due to writing to
the wrong location (although I suspect that still is a problem) but that
under Unix the code pages are marked read-only so of course it core dumped.
I wonder if this is true in Winders. Seriously -- is it?
8:49 p.m.
> > Okay, figured out why my code didn't
work, and it's not due to writing to
> > the wrong location (although I suspect that still is a problem) but that
> > under Unix the code pages are marked read-only so of course it coredumped.
> I wonder if this is true in Winders. Seriously --
is it?
It may be (a function of the Intel processor), but you
can get around this
my mapping those pages elsewhere with read/write access (well, in ring 0).
-spc (But I'm not terribly interested in the answer for Windows ... )
The only reason why I asked was it might be another exploit method.
--
---------------------------------- personal: http://www.armory.com/~spectre/ --
Cameron Kaiser, Floodgap Systems Ltd * So. Calif., USA * ckaiser(a)floodgap.com
-- Imagination is the one weapon in the war against reality. -- de Gaultier ---
7234
days inactive
7237
days old
22 comments
15 participants
participants (15)
-
als＠thangorodrim.de -
bfranchuk＠jetnet.ab.ca -
dickset＠amanda.spole.gov -
dvcorbin＠optonline.net -
dwight.elvey＠amd.com -
frustum＠pacbell.net -
jfoust＠threedee.com -
julesrichardsonuk＠yahoo.co.uk -
pkoning＠equallogic.com -
ron.hudson＠sbcglobal.net -
spc＠conman.org -
spectre＠floodgap.com -
tomj＠wps.com -
vcf＠siconic.com -
zmerch＠30below.com