On: Movfuscator: Compile C into only mov instructions

[jsnell]

The canonical repo is at https://github.com/xoreaxeaxeax/movfuscator

Previous submissions with significant discussion:

- https://news.ycombinator.com/item?id=18991404

- https://news.ycombinator.com/item?id=16218872

- https://news.ycombinator.com/item?id=12372242

- https://news.ycombinator.com/item?id=10021259

- https://news.ycombinator.com/item?id=9751312

[grawprog → jsnell]

From the top link:

https://news.ycombinator.com/item?id=18992556

>The mov-only DOOM renders approximately one frame every 7 hours, so playing this version requires somewhat increased patience.

https://github.com/xoreaxeaxeax/movfuscator/tree/master/vali...

I have to say, reading through the github for the movfuscator was pretty damn amusing. I honestly burst out laughing at the control flow graphs. But I'm curious, is this actually practical for anything?

Running Doom at 1 Frame per 7 hours is, pretty unreasonable. Would text based software even be usable with this?

Either way, I do enjoy cleverly, overly engineered, possibly useless things created just because someone thought it would be funny.

[schoen → grawprog]

> Would text based software even be usable with this?

I just wrote a quick C program to find the primes less than 100000 and compiled it with gcc and movcc. I wouldn't say it's, you know, fast, but I'm impressed at how it does finish in an amount of time that I was willing to wait.

  $ time ./primes.gcc  | wc -l
  9592
  
  real 0m0.035s
  user 0m0.031s
  sys 0m0.012s
  $ time ./primes.movcc  | wc -l
  9592
  
  real 0m10.511s
  user 0m8.289s
  sys 0m2.228s

It looks like the reason that it spent so much time in syscalls is that it somehow uses signals for control flow. (I'm not quite sure how that works.)

[eadler → schoen]

movccc uses a faulting mov instruction to complete the execution loop. without this a jmp is required for infinite execution.

see https://github.com/xoreaxeaxeax/movfuscator/blob/master/movf... and https://github.com/xoreaxeaxeax/movfuscator/blob/master/movf...

[diydsp → eadler]

Could that tbeoretically be replaced with a conditional move to recoup?

[lanbanger → grawprog]

I laughed at the flow control graph as well, properly hilarious.

I liken the motivations behind things like Movfuscator to mountain climbing: they do it because it's there to be done.

[mro_name → lanbanger]

yes, both are related to art – just without the need for an audience. It's play.

[vgel → grawprog]

Could maybe be useful for malware obfuscation?

[quietbritishjim → vgel]

Or for license check / DRM (I appreciate some might consider one or both of these to be a type of malware).

As someone else noted, a large block of mov instructions would be quite easy to spot so you'd have to tie it into a bit of core application / algorithm logic. But that doesn't mean the whole program needs to be written that way.

[teddyh → quietbritishjim]

All software which does something that the user (owner of the device) would rather it didn’t do, is malware.

[foldor → teddyh]

That's yoo generous of a definition. I would prefer if the software I used didn't crash, or have any bugs, but mistakes get made sometimes. By your definition, that's malware. I would say malware is software who's primary focus is to do things the user wouldn't like. A game checking DRM licenses isn't malware as it's not the primary purpose, just an annoying aspect.

[teddyh → foldor]

You’re right, my definition was too broad; intention should matter. But DRM would still count; it intentionally does something which the user or device owner would rather it did not do.

[Wowfunhappy → teddyh]

So every software with a license check is malware? That doesn't necessarily mean it verifies with an external server, it might just locally check a code and use some bits contained therein to print "Registered to XXXX" on the about screen.

What about a one-time screen kindly asking for a donation?

[teddyh → Wowfunhappy]

> So every software with a license check is malware?

Yes? Obviously?

> What about a one-time screen kindly asking for a donation?

If it doesn’t have a “don’t show this again” checkbox, then I would have to say “yes”.

[jandrese → vgel]

As long as you don't need your malware to actually accomplish anything.

Also, a chunk of code that is just a long string of MOV instructions is going to be really easy to spot for an antivirus program.

[vgel → jandrese]

What do you mean? Movcc can call external functions (with a jmp, tbf)

[jandrese → vgel]

Mostly that it's terribly slow.

[grawprog → vgel]

That was about the only thing I could think of.