|
|
|
| Authored by: Anonymous on Monday, October 15 2012 @ 06:50 PM EDT |
Good point. A lisp interpreter for example can very easily define it's own
functions derived from content or representations in its dataset. Hmmmm. You
merge the notions of content and software instructions. Your suggestion
certainly adds a very interesting consideration.
A buffer overflow exploit possible on machines executing software compiled by a
C or C++ compiler, is performed by submitting data (user content in its most
traditional sense), to a vulnerable machine executing instructions that does not
properly perform content length validations. When the data is written to memory
it will fill its allocated space and "overflow" into the heap (or
instruction stack I can't remember exactly). When the machine process returns
from its prior call, it encounters a 32 bit value that originates from the user
submitted data as it's next instruction, a value introduced by the user that had
overwritten a previous original value.
That value permits the machine to execute one foreign instruction, that
instruction could be to JMP followed by an segment address within the core (ram
in windows speak), if you can define the 32 bit address location using ascii
character representations to an address that pops the instruction stack once
again, the processor will execute the remainder of the user submitted data as
though it where native code. So this is another example where specially build
"content" is actually the equivalent of a lamda call except written in
pure machine code that can get executed outside the specifications of the
original machine. The machine now permits is executing software that has been
introduced into the machine through the exploitation of a design flaw in the
original software...
I now agree that content can be machine instructions and it does not even need
to be of an origin native to the machine.[ Reply to This | Parent | # ]
|
| |
| Authored by: RMAC9.5 on Tuesday, October 16 2012 @ 12:55 AM EDT |
You can't logically distinguish between 'program' and 'data'. It's
all just data.
I completely agree!
Data in one program
can be the instructions for another program. Consider programs that use
input data symbols to create output data symbols in the from of executable
programs code (i.e. programs which create programs). Also, consider self
modifying programs that alter their instruction logic as they execute. Whether
the bits being processed by the CPU at any specific moment are instructions or
data depends on their context; how they are being used at that moment. [ Reply to This | Parent | # ]
|
|
|
|
|
