// COMPLETE THREAD

No Subject

7 expanded posts · every known parent and child

NODE e091f979No Subject Anonymous <anon@anon.efga.org>Mon, 10 Nov 1997 13:53:55 +0800

In the grand tradition of RSA-in-3-lines-of-perl, we present
Crash-A-Pentium-in-44-characters:

   main(){int i=0xc8c70ff0;void (*f)()=&i;f();}

- f00fie

NODE a35626ffsmaller f00f.c Adam Back <aba@dcs.ex.ac.uk>Sat, 15 Nov 1997 00:39:01 +0800

f00fie writes:
> In the grand tradition of RSA-in-3-lines-of-perl, we present
> Crash-A-Pentium-in-44-characters:
> 
>    main(){int i=0xc8c70ff0;void (*f)()=&i;f();}

Hey, challenge is on:

main(){int i=0xc8c70ff0;void (*f)()=&i;f();} /* f00fies 44 char */
main(){((int(*)())"\360\017\307\310")();}
main(){int i=0xc8c70ff0,(*f)()=&i;f();}
main(i){int(*f)()=&i;i=0xc8c70ff0;f();}
main(i){i=0xc8c70ff0;((int(*)())&i)();}
(*f)();main(i){f=&i;i=0xc8c70ff0;f();}
(*f)()="\360\017\307\310";main(){f();}       /* 38 chars */

Compiled with gcc.

(Note that I haven't tested them because I have an AMD k5 which
doesn't suffer from this bug -- perhaps someone with an Intel pentium
could try them).

Adam

NODE c9414d04Re: smaller f00f.c Michael Stutz <stutz@dsl.org>Sat, 15 Nov 1997 01:26:49 +0800

On Fri, 14 Nov 1997, Adam Back wrote:

> f00fie writes:
> > In the grand tradition of RSA-in-3-lines-of-perl, we present
> > Crash-A-Pentium-in-44-characters:
> > 
> >    main(){int i=0xc8c70ff0;void (*f)()=&i;f();}
> 
> Hey, challenge is on:
> 
> main(){int i=0xc8c70ff0;void (*f)()=&i;f();} /* f00fies 44 char */
> main(){((int(*)())"\360\017\307\310")();}
> main(){int i=0xc8c70ff0,(*f)()=&i;f();}
> main(i){int(*f)()=&i;i=0xc8c70ff0;f();}
> main(i){i=0xc8c70ff0;((int(*)())&i)();}
> (*f)();main(i){f=&i;i=0xc8c70ff0;f();}
> (*f)()="\360\017\307\310";main(){f();}       /* 38 chars */
> 
> Compiled with gcc.


How about:

long main[]={0xc8c70ff0};

or even

main[]={0xc8c70ff0}; /* 21 chars */

Compiles with gcc, but I haven't tested it.

NODE 9a019f62Re: smaller f00f.c Jeff Barber <jeffb@issl.atl.hp.com>Sat, 15 Nov 1997 02:13:14 +0800

Michael Stutz writes:
> On Fri, 14 Nov 1997, Adam Back wrote:
> > f00fie writes:
> > > In the grand tradition of RSA-in-3-lines-of-perl, we present
> > > Crash-A-Pentium-in-44-characters:
> > > 
> > >    main(){int i=0xc8c70ff0;void (*f)()=&i;f();}
> > 
> > Hey, challenge is on:
> > 
> > main(){int i=0xc8c70ff0;void (*f)()=&i;f();} /* f00fies 44 char */
> > main(){((int(*)())"\360\017\307\310")();}
> > main(){int i=0xc8c70ff0,(*f)()=&i;f();}
> > main(i){int(*f)()=&i;i=0xc8c70ff0;f();}
> > main(i){i=0xc8c70ff0;((int(*)())&i)();}
> > (*f)();main(i){f=&i;i=0xc8c70ff0;f();}
> > (*f)()="\360\017\307\310";main(){f();}       /* 38 chars */

> How about:
> 
> long main[]={0xc8c70ff0};
> 
> or even
> 
> main[]={0xc8c70ff0}; /* 21 chars */
> 
> Compiles with gcc, but I haven't tested it.

No need for an array, so my entry is:

int main=0xc8c70ff0; /* 20 chars */


Compiles and runs, core dumping with illegal instruction on my
Linux box (obviously, it's not a Pentium).


-- Jeff

NODE 68b2bc21Re: smaller f00f.c Michael Stutz <stutz@dsl.org>Sat, 15 Nov 1997 02:28:08 +0800

On Fri, 14 Nov 1997, Jeff Barber wrote:

> No need for an array, so my entry is:
> 
> int main=0xc8c70ff0; /* 20 chars */

Cool. This also compiles:

main=0xc8c70ff0; /* 14 chars */

Just as many chars as the assembly code, f00f.s:

lock cmpxch8b

[can unknown intructions like this be force compiled?]

NODE d5e7148fRe: smaller f00f.c Bryce <bryce@digicash.com>Sat, 15 Nov 1997 05:31:07 +0800

> > > main(i){int(*f)()=&i;i=0xc8c70ff0;f();}
> > > main(i){i=0xc8c70ff0;((int(*)())&i)();}
> > > (*f)();main(i){f=&i;i=0xc8c70ff0;f();}
> > > (*f)()="\360\017\307\310";main(){f();}       /* 38 chars */
> 
> > How about:
> > 
> > long main[]={0xc8c70ff0};
> > 
> > or even
> > 
> > main[]={0xc8c70ff0}; /* 21 chars */
> > 
> > Compiles with gcc, but I haven't tested it.
> 
> No need for an array, so my entry is:
> 
> int main=0xc8c70ff0; /* 20 chars */


On a DOS box, no need to compile.  Cut-n-paste the magic words
into a file.  Name the file "foof.com".  Run it.


4 bytes.  I win.  :-)


Bryce

P.S.  Not original with me.  Attribution lost in the mists of 
comp.sys.intel.

NODE 67aea1c5Re: smaller f00f.c ichudov@algebra.com (Igor Chudov @ home)Sat, 15 Nov 1997 13:05:34 +0800

int main=0xc8c70ff0;


igor

Adam Back wrote:
> 
> 
> 
> f00fie writes:
> > In the grand tradition of RSA-in-3-lines-of-perl, we present
> > Crash-A-Pentium-in-44-characters:
> > 
> >    main(){int i=0xc8c70ff0;void (*f)()=&i;f();}
> 
> Hey, challenge is on:
> 
> main(){int i=0xc8c70ff0;void (*f)()=&i;f();} /* f00fies 44 char */
> main(){((int(*)())"\360\017\307\310")();}
> main(){int i=0xc8c70ff0,(*f)()=&i;f();}
> main(i){int(*f)()=&i;i=0xc8c70ff0;f();}
> main(i){i=0xc8c70ff0;((int(*)())&i)();}
> (*f)();main(i){f=&i;i=0xc8c70ff0;f();}
> (*f)()="\360\017\307\310";main(){f();}       /* 38 chars */
> 
> Compiled with gcc.
> 
> (Note that I haven't tested them because I have an AMD k5 which
> doesn't suffer from this bug -- perhaps someone with an Intel pentium
> could try them).
> 
> Adam
> 



	- Igor.