simonlindholm

struct N {
	int x = 0;
};

struct Mont {
	int Mod, R1Mod, R2Mod, NPrime;

	Mont(int mod);

	N redc(int a, int b);

simonlindholm

#define _GNU_SOURCE
#include <bits/stdc++.h>
using namespace std;

/* mfbt basic SIMD wrappers. */

#include <math.h>
#include <stdint.h>

// Figure out how to get access to SIMD on the current compiler.

simonlindholm

full
hål
krona
hund
kniv
snöre
häst
eka
klocka
matta

simonlindholm

// Async, for use in WebExtensions. CC0.

function* gifDecoder($) {
	var size, r, len;

	// Header
	if ($.avail < 6) yield $.Ensure(6);
	var header = $.read(6);
	if (header[0] != 0x47 || header[1] != 0x49 || header[2] != 0x46)
		return $.Error("not a gif");

simonlindholm

// g++ -O2 -Wall -Wextra -shared -fPIC -o replace.so replace.cpp -I /opt/jdk/include/ -I /opt/jdk/include/linux/ -std=c++11 -L /opt/jdk/lib/server/ -ljvm -Wl,-rpath,/opt/jdk/lib/server/
// LD_PRELOAD=./replace.so java -classpath .:../battlecode/java Player

#include <unistd.h>
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
#include <dlfcn.h>
#include <link.h>
#include <atomic>

simonlindholm

Last year's Battlecode engine did JVM instrumentation to sandbox players on the same team from each other, and to limit the amount of computation they were allowed to do. We found two fun vulnerabilities related to the latter part.

The first vulnerability

The process by which the bytecode instruction limitation was done was by decompiling .class files, adding in instruction-counting instructions in relevant places, and them re-compiling them and running the modified executable. More concretely, say the program contained a method like:

simonlindholm

/**
 * Author: Simon Lindholm
 * Date: 2018-07-19
 * License: CC0
 * Source: own work
 * Description: Euclidean minimum spanning tree.
 * Add an "index" member to Point if you need indices returned.
 * Usage:
 * Q q; q.ps = ...;
 * q.init(0,0,1 << 30); // if 0 <= x,y < 2^30

simonlindholm

#!/usr/bin/env python3

import sys
import struct
import argparse
from collections import namedtuple

REG = {
    "zero":0,
    "at":1,

simonlindholm

Keybase proof

I hereby claim:

• I am simonlindholm on github.
• I am simonlindholm (https://keybase.io/simonlindholm) on keybase.
• I have a public key ASDb0pN28sqNZe8GMR2mkeenn3ctqeYgFfLO7SMSvOwKAQo

To claim this, I am signing this object:

simonlindholm

var fs = require("fs");
var Kattio = {
	_buf: new Buffer(1 << 14),
	_bufPos: 0,
	_bufLen: 0,
	_ensure: function() {
		if (this._bufPos === this._bufLen) {
			this._bufPos = 0;
			this._bufLen = fs.readSync(0, this._buf, 0, this._buf.length, null);
		}