Comments for Stupid Compiler

Comment on Differential Reversing (or some better name) by I'm not dead yet… « Stupid Compiler

I'm not dead yet… « Stupid Compiler — Sun, 14 Feb 2010 04:42:05 +0000

[...] with the taint information). You can see the old test version of it in a screen shot from the DiffCov blog. Evidently Shmoocon will be streaming the talks, so if your timezone permits, you can heckle me [...]

Comment on I'm not dead yet… by apridgen

apridgen — Sun, 07 Feb 2010 03:19:45 +0000

Hey man. I saw the talk at shmoocon, and I am interested in taking a look at the code for BSO4. Please let me know when it is posted. I might be able to contribute a little to the development :)

Comment on I'm not dead yet… by dan

dan — Tue, 19 Jan 2010 14:30:00 +0000

congrats :)
I can’t wait to put my hands on the pintool!

Comment on Getting Pointers from Leaky Interpreters by dionthegod

dionthegod — Fri, 27 Nov 2009 04:25:24 +0000

anon, s7ephen: Thanks!

Jordan: Right. I’ve made the edit, thanks.

Comment on Getting Pointers from Leaky Interpreters by Jordan

Jordan — Thu, 19 Nov 2009 02:33:59 +0000

So neat. Also, there’s a small typo in the sample above. It will still work great normally, but the error condition itself won’t work correctly. ;-)

@@ -49,3 +49,3 @@
if (oddPrev + 8 + 9 != evenPrev) {
- print(“[-] Something went wrong ” + oldPrev + “, ” + evenPrev);
+ print(“[-] Something went wrong ” + oddPrev + “, ” + evenPrev);
}

Comment on Getting Pointers from Leaky Interpreters by Stephen A. Ridley

Stephen A. Ridley — Fri, 30 Oct 2009 18:51:42 +0000

Nice one bruv!

Comment on Getting Pointers from Leaky Interpreters by anon

anon — Fri, 30 Oct 2009 04:10:58 +0000

Nice work!

Though similar ideas probably pop into people’s heads every now and again. Some guys from Core did a presentation a few years ago at Blackhat about using crafted inserts via web applications to leak data via timing analysis against MySQL (no code was ever released), which has nothing to do with this at all, but they introduced the idea by talking about the usefulness of being able to sort a list of usernames by password, and then insert users with crafted passwords and see where they fit in.

Comment on Differential Reversing (or some better name) by dionthegod

dionthegod — Tue, 27 Oct 2009 21:56:30 +0000

Halvar:
That’s a fair point. I’m not a student. Any use I have would be to make money (say, exploit development or reversing for auditing purposes) — I was trying to make the point that I am priced out of them for the limited use I would make (but I could be wrong). I can certainly understand the prices and they would seem to be well worth it were I reversing large programs on contract (i.e. extended use for a guaranteed profit).

Regardless, I’m sure others could (and should) take advantage of that offer.

Comment on Differential Reversing (or some better name) by Halvar

Halvar — Tue, 27 Oct 2009 20:45:16 +0000

Hey there,

just a brief note: You don’t necessarily need a rich uncle to get a copy of BinNavi or BinDiff. If you’re a student (or otherwise can’t afford a license) we offer the following:

1) You propose a cool project that you want to use our tools for
2) You promise that you’ll write a paper on what you’re doing that we can put on our webpage
3) We provide the software to you, subject to the restriction that your license expires if you don’t write the paper

Drop me mail for more info.

Comment on Differential Reversing (or some better name) by dionthegod

dionthegod — Mon, 05 Oct 2009 03:37:56 +0000

NeO:
I figured the build is so simple with Visual Studio Express. That is what I use on 2 of my dev. machines — I know it works well with that. Note that the result of the build is a shared library (not an executable) which gets loaded by pin.exe found in the Pin distribution. I also figured people would certainly want to start tweaking the pintool, so having the source in a buildable state would be useful.

Let me know if you have any issues with the compilation. I’d be glad to help you get your build working.