Heyyy, so remember how I scanned all those x86-64 pkgs to see if they changed the behavior of floating point math related to handling of subnormal/denormals? And how I didn't bother to check other CPU archs because surely it was a weird x86 thing? Well...
Let's just take a quick look through the gcc source to see if there are any other implementations of crtfastmath.c, just to be safe. Oh. Oh no.
Well, probably they aren't setting CPU floating point state right? Let's just look at them one by one. How about sparc?
My sparc is a little rusty so let's check the manual to find out what "nonstandard" means... well this looks familiar.
How about MIPS? Also enables flush-to-zero via a hardware register.
Alpha? Same story. Maps denorms to zero as well as underflowed outputs.
Itanium was Intel's famously ambitious (and failed) attempt to redesign an architecture from the ground up. Did they take the opportunity to fix this bit of global state? Nope.
[The comment above that constant is my own annotation; the original was undocumented, so I had to go to the IA64 manual to decode the bitfield.]
Loongson is a CPU architecture from China, that is pretty similar to MIPS, and indeed it is similar in this respect too:
But enough with all these old and weird obscure CPUs. How about ARM, which had shipped 100 billion chips as of 2017? I bet you can guess whether it, too, sets FTZ. (community.arm.com/arm-community-…)
Well, ARM is a product of its time (1985) and really a victim of its own success. When they had a chance to redo things in the move to 64-bit (AArch64), maybe they changed this? Welp.
In conclusion, I wish I hadn't looked
• • •
Missing some Tweet in this thread? You can try to
force a refresh
OpenAI: pip install openai and set OPENAI_API_KEY
Anthropic: yea same but s/openai/anthropic/g
Google: oh boy. ok so you have a GCP account? no? ok go set that up. and a payment method. now make a "project". SURVEY POPUP! k now gcloud auth. wait you have the gcloud CLI right–
I haven't even mentioned the odd step of "enable the Vertex API in your project", or that when you finally get to "install the Python library" it kicks off another sidequest of installing something called the Vertex Python SDK and writing extra code to initialize it??
The gcloud CLI installer is now trying to con me into letting it install its own Python version. NICE TRY BUDDY
Here's a quick tour through one of my favorites, where @XBOW not only solved the benchmark (a Jenkins RCE) but then went for style points by debugging a slightly broken benchmark setup to get the flag!
I gave Claude 3 the entire source of a small C GIF decoding library I found on GitHub, and asked it to write me a Python function to generate random GIFs that exercised the parser. Its GIF generator got 92% line coverage in the decoder and found 4 memory safety bugs and one hang.
Here's the fuzzer Claude wrote, along with the program it analyzed, its explanation, and a Makefile: gist.github.com/moyix/02029770…
1. Rent a bigger EC2 server. I was using a T2.micro which seemed like more than enough while I was testing. But with a bunch of teams hammering at it, the fact that it has only one CPU started to make things slow.
2. Kill the child procs (one is started for each new connection on the main port) after some idle time. As it was if there was a dangling connection it could sit there indefinitely; during the competition the load on the server went above 20 and I had to manually kill some procs.
Will still try to do a blog post on my @CSAW_NYUTandon CTF challenge, NERV Center, but for now here's a thread explaining the key mechanics. I put a lot of work into the aesthetics, like this easter egg credit sequence (all ANSI colors+unicode text) that contains key hints:
@CSAW_NYUTandon (Note the karaoke subtitles timed to the credits at the bottom 😁)
@CSAW_NYUTandon First, the vulnerability. If you read the man page for select(), you'll see this warning: select() is limited to monitoring file descriptors numbered less than 1024. But modern systems can have many more open files, and importantly the kernel select() interface is NOT limited.