Introducing Weird Machines: ROP Differently Explaining part 1 - bin 0x29

[@thatanimeweirdo]

it took you 4 years to finally talk about your channels slogan? :P

[@zooeey]

*notices weird machine* o Wo what's this

[@jit_rs]

oWo

[@someone-rq3fm]

Oooooh I get it :D

[@qxtr5853]

It's Hell

[@qxtr5853]

Memory :3

[@kevinjohansson3923]

Damn, this is such an elegant introduction to this topic. And an amazing way to tie some ends like your slogan. Love it!

[@lhhn7245]

You did that oWo on purpose didn't you

[@renakunisaki]

It's just how the memory had to be laid out, honest!

[@floatingblaze8405]

Yey! The binary exploitation series is back!

[@renakunisaki]

Another weird machine you might find interesting (nothing to do with ROP though): the CIC "lockout chip" in the Nintendo Entertainment System. It's a very low-end microcontroller. What makes it interesting are two features: 1. The PC doesn't count linearly. Apparently to reduce cost, they used a shifter instead. So the addresses it will execute (without jumps) are 1, 2, 4, 8, 16... If it reaches 0 (and I think 127?) it will be stuck there. 2. The same chip exists in console and cartridge. They both send signals to eachother and expect a corresponding reply (sort of challenge response). To do this the two ROMs must execute in perfect lockstep so that one reads precisely when the other writes. The programs are carefully structured to ensure both sides of each branch take the same number of cycles. The ROMs are out there, I don't remember where, but probably on nesdev?

[@Anonymouspock]

Edited? :(

[@angelaD93]

I just learned about the existence of ROP while I was studing for my operating system exam this week and now this video pops up. What kind of wizardry is this? Perfect timing :)

[@LStranck]

7:12 But first, we need to talk about parallel universes

[@liambrennan2380]

Not gonna lie, did not expect to find a reference to that on Liveoverflow

[@LiveOverflow]

uhm... I don't understand this reference :D edit: googled it. And I remember where it was from. that video is sooooo frckn amazing!

[@unflexian]

*T J H E N R Y Y O S H I*

[@thatanimeweirdo]

shoutouts to simpleflips

[@renakunisaki]

Look at all those A presses though.

[@motokokusanagi1147]

ROP and gadgets were developed much earlier than 1997 and were broadly used at least in 1984. May be earlier. Some microcomputers of the days used ROM-based firmware for external devices or even the operating system. The ROM-based code was somewhat "priviledged" - major address bus bits, corresponding only to the ROM region were used to map some ports or even buffers to the address space. User code was placed in the addresses, that locked out hardware specific things so there was no direct control over them. But "gadgets" found and executed in the ROM via stack modification made direct hardware ports and buffers hacking possible. I personally used this to make Sinclair ZX-Spectum TR-DOS system do things, original firmware could not do. Also it was buggy, never updated and this was the only way to make some thing work anyway.

[@renakunisaki]

A similar exploit can be used to dump the Nintendo DS BIOS. Only code within the BIOS region can read it, but you can just craft a stack frame and jump blindly into the end of a function that will just read an arbitrary address and return.

[@motokokusanagi1147]

That's right, it's a common technic in console hacking, especially the old ones with little to no RAM. The same goes for embedded hacking. My point was to let people know that smart hackers were there decades ago. I hope it'll motivate some one to dig deeper and surpass the ancestors, not just become on par =^_^=

[@motokokusanagi1147]

Actually, TR-DOS mapped it's ROM over the main ZX-Spectrum firmware just in the moment CPU jumped to specific address range that had no executable code in it (there was a font or text resources, I do not recall now). So the firmware was "visible" only for itself. A common technic of the days. Nowdays iit s common to trick a device with a request, supposed to return some data, but force it to return a part of firmware dump or something. Hope we will see something like that here too/

[@quantumbracket6995]

THE BIN SERIES IS BACK!!!

[@chuckberry6650]

I just wanna say that your KZbin channel is truly one of the most beautiful things on the internet

[@小张同学-v6i]

sometimes you have to look back and enjoy what you have done -- cheers from 2019!

[@fotisalexandridis5831]

So long we have waited for a proper rop explaination :)

[@keanu_]

4:38 The answer to live the universe and everything.

[@AtlasMTBRider]

the probability of it being a coincidence is being calculated.

[@therawmeatball6883]

could you add the invoice program and the compiler to the descriptions section? I'd like to use it...

[@alexisramirez2007]

This is why bounds checking is critical, especially for any input. ROP vulnerabilities sometimes happen when a programmer doesn't take the time to secure their program design, OS security features can't prevent insecure programs.

[@TimLF]

This is why using rust, java, etc is critical.

[@alexisramirez2007]

@@TimLF But I need to be closer to the bare metal hardware with full control of memory so it will be tedious, so C/C++/Assembly only.

[@TimLF]

@@alexisramirez2007 what exactly do you think you can't do with rust? ( at the very least the user interface part of every application should be rust with bindings to whatever assembly/C is required)

[@alexisramirez2007]

@@TimLF You have a point, I mostly program Linux applications with C and ASM for security challenges or niche pet-projects. I have neglected exploring practical languages for applications, such as rust.

[@gyroninjamodder]

If you have dependent types you can make the lack of bounds checking a compile time error. For simple cases where the size of the array is static, the compiler can just do the bounds checking at compile time instead of requiring you to write it. This means you don't have to pay for bounds checking if you don't need it. Also, these bounds checks don't have to happen at access time. You can check the size of an array at the start of a function with a check and the compiler can use that single check for all your accesses. This technique has no runtime overhead (unless you are counting insecure applications which don't bounds check dynamic sized arrays)

[@HimanshuPal-li7nj]

Damn, why didn't I find this channel before. It's so good

[@yuxin7440]

This is so interesting, I can't wait to watch the further explanation for it!

[@dekrain]

10:10 Looking at this screen I noticed that 'invoice' looks very much like 'invoke', which is a cool easter-egg.

[@4.0.4]

This is your best video yet imho.

[@keyboard-slayer]

Wow, that's insane you show me something new, this thing seems amazing

[@jameswait2934]

YES feed me your knowledge. I love this.

[@pimtrouerbach8753]

Super excited to see the next video!

[@Thiago1337]

Beautiful indeed, being able to map a kernel driver is VERY BEAUTIFUL.

[@X3eRo0]

Amazing Video As always

[@nivmoshe5536]

Hey LiveOverFlow. in 6:47 when you mentioned that both the stack and the heap are not executable, does the DEP mechanism responsible for that?

[@LiveOverflow]

Yep, exactly

[@nivmoshe5536]

@@LiveOverflow Thanks for the reply, great video btw

[@secureitmania]

Eagerly waiting for part 2

[@DanielDugovic]

Very much looking forward to your ROP video! I'm curious to what extent American Fuzzy Lop and/or other fuzzers can be used to generate weird machines.

[@pedroricci1]

Can't wait for the next video!

[@DarkLegends2008]

OMG! Simply amazing ! I surprise how wierd it's and how amazing and full of oportunits to do what ever you want... TKS From BRAZIL :-)

[@philipgoh9142]

It's so beautiful. They should have sent a poet.

[@AlbySilly]

Can't wait for part 2

[@osenseijedi]

This is so inspiring! Thanks so much for sharing!

[@SapphFire]

I'll forever keep seeing the _o Wo_ in hello world after this.

[@TheKaruso33]

I always thought your slogan read "explore weird mechanics". Reading does not seem to be my strong suit...

[@jeancasse-couilles4081]

I can't wait for the next video!!

[@maxinator80ify]

Do you prefer a patreon pledge or KZbin membership?

[@LiveOverflow]

Hey, I don’t really have a preference. Thanks for even considering it! Whatever you prefer - I explain my thoughts with both systems in a Video you can also find on the Patreon page or my channel. Please watch that first :)

[@Anonymouspock]

YT membership might have a higher commission taken by the platform relative to what the creator gets, or maybe I'm misremembering.

[@Verrisin]

Can it really execute anything? Can you install, ... say keylogger, if you are only able to supply input for the invoice program?

[@megumin6456]

This time, you really impressed me!

[@4.0.4]

Even "rld!" Makes sense on its own, the scene group Reloaded.

[@elijahkulpinski4983]

This is so beautiful.

[@codebeard]

Can this execute conditional jumps? Otherwise it's not turing complete

[@heller166]

love this. keep it coming

[@anon0815de]

Wonderful! I'm hooked!

[@mjdev-i1p]

You should check out OSGI Equinox for creating Programming languages :)

[@VaradMahashabde]

Those AAAAAs, is this a segmentation fault triggered code injection?

[@luckyverri3374]

Thats it, you've done it.

[@Verrisin]

interpreter? .... ooh, I really hoped you had made a python compiler to machine code, that would have been damn impressive

[@Verrisin]

oooh, ok, the interpreter is actually pretty cute ^^ (or, the exploit / compiled ... 'weird machine')

[@pyguy9915]

👏 very cool

[@Jagnathbaba]

You are saying that you are not executing your own code but it is being executed. Can you elaborate?? Also what is "shell code" ?

[@LiveOverflow]

Those gadgets and code snippets are already inside the program. We did not inject those. We just use/abuse them to construct our own programs. Shellcode would be, if we create assembler code, get it via input into the program‘s memory, and jump to it. But I think you should checkout the basics of buffer overflows in the binary exploitaion playlist first :)

[@Scoopta]

You spend so much time in Linux it always surprises me that you use macOS on your computer.

[@sijsu]

I love your content!

[@arsen3783]

well I'm excited

[@ali-azizimayer-peters6686]

That is really mindblowing LiveOverflow. So you basically exploit a program in that way, that you can create a whole programming language upon this fucked up environment ? That just insane ! That's twisted insane..... No Words for that :D Oh, by the way a philosophic question: " Is not every machine a weird machine ? " I bet you can abuse any program, hardware, microcontroller in a way nobody thinks of.

[@Verrisin]

5:00 - I'm not convinced, until I see at least BRANCH

[@Verrisin]

I would call this a 'macro' language (as in, vim macros) - it just executes a static sequence of builtin commands

[@joemann4643]

Nice , perfect example of chaos theory, random norse theroy. Murphy's law hey. 👍

[@TheBigHolox]

See what you did there with the CTF challenge :P

[@damejelyas]

Man i love you

[@rmoretto]

Great video, and beautiful concept! Do you plan to release the source code for you compiler?

[@dabagz18]

You're the BEST

[@AkhmedEvil]

Can u make video about code injection ?

[@MikeTrieu]

**Go go gadget exploit!**

[@filipstamcar6553]

Where to download Weird language and Weird machine? 🤩

[@nettowaku1252]

*LiveOverflow released a video* "var4 What's this?"

[@shubhamingle5728]

Brain: wait! what? Kabooom [»_«]

[@Raj_darker]

Hii Everyone.. How to download "Hopper Disassembler for mac free full version" I have been searching for crack of it, but didn't get yet.. So Is there any way to get it free or otherwise I have to purchase it.

[@LiveOverflow]

Purchase it!

[@Raj_darker]

@@LiveOverflow I am student, I don't have additional Resource of Income, Can you please help me out, any how?? And I need that software for Binary Exploitation..

[@LiveOverflow]

Checkout free Ghidra!

[@Raj_darker]

@@LiveOverflow Yaa, I am using Ghidra, but I am beginner for CTFs And Hopper's Interface is more convenient than Ghidra. THANKS for your all videos and knowledge. It's all worth to watch. I am following your channel For CTFs. Again Thanks you so much.

[@marioguglia4928]

Lol at the middle of the video I Just wanted to run away

[@telnobynoyator_6183]

Yaas !

[@sobertillnoon]

RIP instruction pointer.

[@kebien6020]

I thought just this while watching

[@Ziandris]

I'm a script kiddie does anyone know where I can start so I can evolve.

[@MeepMu]

What. I always thought it said "Explore Weird Mechanics".

[@j3r3miasmg]

Hello Weird!

[@0x77dev]

wow

[@Saghetti]

rip instruction pointer

[@Verrisin]

interesting, to me a return oriented programming would have meant the opposite of a language purely based on CPS

[@ari_archer]

I remember "don't be a script kiddie" lol

[@u0000-u2x]

ghost in the shell

[@Tristan-mr3pk]

❤

[@telnobynoyator_6183]

I once tried to do something like that

[@dadisuperman3472]

If you want get more advanced in security then check this guy, i learned a lot from him. Christopher Domas

[@randomname3669]

0:49 oWo

[@Mempler]

1:00 OwO

[@MenkoDany]

❤!

[@SimonNitzsche]

Am i the only one who thought the first program would create an Overflow because the string never ends? (no 0x00 at the end of the string)

[@Tuguldur]

Some early comment. Hi everyone

[@kaskrex]

NICEEEE

[@nem64]

o Wo whats this

[@dutchgh0st540]

What if your compiler also is a weird machine in itself...and the produces outmout a weird machine in itself as well.... Its weird machines all the way down..

[@JOELwindows7]

Security hole Security patch

[@hopehowdoyoufeel]

I thought a weird machine is Hannah Montana Linux

[@glitchxx0]

Rop dying ?

[@Wowthatsfail]

OwO

[@hgmlle]

o Wo

[@billigerfusel]

What's this

[@Maric18]

o Wo ... whats this? pomf

[@retnikt1666]

what?

[@hazel6221]

HellOwO

[@eleganteatinginjapan659]

< 3

[@comradestinger]

owo

[@recency_bias]

:D

[@picklerick814]

i understand everything but one thing: W H Y ?

[@Donkydong]

how you get kali linux

[@damejelyas]

Google it

[@letsplaymassyhd]

hack the nsa and steel it from theirs servers

[@AdriGDev]

www.kali.org/downloads/

[@Donkydong]

nvm I found it on online