The UNIX and Linux Forums  

Go Back   The UNIX and Linux Forums > Top Forums > High Level Programming
Google UNIX.COM


High Level Programming Post questions about C, C++, Java, SQL, and other programming languages here.

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
Wrapping Your Brain Around Oracle + Python iBot Oracle Updates (RSS) 0 04-06-2008 02:10 AM

Reply
 
Submit Tools LinkBack Thread Tools Display Modes
  #29  
Old 05-11-2007
Perderabo's Avatar
Unix Daemon
 

Join Date: Aug 2001
Location: Washington DC Area
Posts: 8,616
Well then blowtorch could open the executable for writing and truncate it to zero bytes. That would not be "storing data".
Reply With Quote
Forum Sponsor
  #30  
Old 05-11-2007
kahuna's Avatar
Registered User
 

Join Date: Apr 2007
Posts: 148
Quote:
Originally Posted by Perderabo
Well then blowtorch could open the executable for writing and truncate it to zero bytes. That would not be "storing data".
Yes, truncating sounds as valid as the unlink/rm file solution. But a lot depends on how you parse the challenge. You could parse the challenge to mean that any file access is forbidden. But if that is the case, I don't think it is solvable.
Reply With Quote
  #31  
Old 05-11-2007
Perderabo's Avatar
Unix Daemon
 

Join Date: Aug 2001
Location: Washington DC Area
Posts: 8,616
Quote:
Originally Posted by kahuna
Yes, truncating sounds as valid as the unlink/rm file solution. But a lot depends on how you parse the challenge. You could parse the challenge to mean that any file access is forbidden. But if that is the case, I don't think it is solvable.
If your going to play word games like that, then you could also parse it it such that:
main() { printf("hello, world\n"); }
is a solution. The program only gives the output once and then it never does anything else. And as requested you must compile the program first. I see no verbage about preventing a rerun of the program.
Reply With Quote
  #32  
Old 05-11-2007
blowtorch's Avatar
Supporter
 
Join Date: Dec 2004
Location: Singapore
Posts: 2,326
Quote:
Originally Posted by Perderabo
Well then blowtorch could open the executable for writing and truncate it to zero bytes. That would not be "storing data".
Oh yeah, I tried this. It dies with a bus error and a dumped core. This shouldn't be happening. If Solaris is going to open a running executable for writing, then it should be able to truncate it as well. If it has to be consistent, it should either allow me to carry out any write related operation, or it should prevent me from performing any write related operation.

-Edit
I just tested this on FreeBSD (I use m-net.arbornet.org for this), and the unlink shown by Vino works, but my attempt to open the file for writing doesn't.
Reply With Quote
  #33  
Old 05-11-2007
Perderabo's Avatar
Unix Daemon
 

Join Date: Aug 2001
Location: Washington DC Area
Posts: 8,616
There are some other approaches to this. A smart perl script could call time() to get the current time. Then it would output a c program that would refuse to run after the next two seconds pass. That should be enough time to compile and run it once. After the output, the c prgram would sleep for 2 seconds to ensure that a second run is impossible. The perl script could also obtain the pid of the current login shell. The C program would refuse to run if the login shell has a different pid. The C program would output the string, sleep a few seconds, then kill the login shell. For added security these approaches could be combined.
Reply With Quote
  #34  
Old 05-12-2007
kahuna's Avatar
Registered User
 

Join Date: Apr 2007
Posts: 148
Quote:
Originally Posted by Perderabo
There are some other approaches to this. ...
A very creative approach. Excellent! And without touching any files!
Reply With Quote
  #35  
Old 08-03-2008
Registered User
 

Join Date: Aug 2008
Location: Portugal
Posts: 212
There's a more complex way of doing it.

We could open (argv[0], O_RDONLY), then unlink(argv[0]), and then re-open open(argv[0], O_RDWR).

Like that, you could read the content of your program before it was unlinked ('cause the kernel still holds the reference upon unlink() if the file is open by any process) and write a new content after it was unlinked.

Now, from here you could go to very funny stuff like changing the ELF format on-the-fly (something like changing the .comment section) and then have something on your file that says "if the .comment section has a certain sha1 hash that matches whatever, the program should run, otherwise it won't run". Be aware that someone could strip the comment section very easily lol.

Another way would also be very funny like creating an assembly program that just makes your program exit, then, extracting the hex opcodes (machine-language) of that program using something like objdump and injecting those opcodes on your other program's main function. Of course you would have to know the right offset to mmap() to, etc. With this, you could actually alter the way that your program feeds back after the first execution, because you could also inject write()'s, etc. (a lot more work would be needed)
Reply With Quote
Google The UNIX and Linux Forums
Reply

Tags
linux

Thread Tools
Display Modes




All times are GMT -7. The time now is 06:56 AM.


Powered by: vBulletin, Copyright ©2000 - 2006, Jelsoft Enterprises Limited.
The UNIX and Linux Forums Content Copyright ©1993-2008. All Rights Reserved.Ad Management by RedTyger Visit The Complex Event Processing Blog

Content Relevant URLs by vBSEO 3.2.0