The exploit successfully changes my MIDI settings and adds search paths, but unfortunately it crashes with a completely wiped stack before showing me the Tk dialog :-(
On 31.08.2021 14:33, IOhannes m zmoelnig wrote:
On 8/31/21 1:05 PM, IOhannes m zmoelnig wrote:
¹ i wonder whether it would be possible (with Pd>=0.42) to create a patch that creates a gui-plugin on the fly. if this is true, then you can already do everything that [file] allows you to do - and much more.
like with the attached patch.
i've tested this on Linux, macOS and Windows (where i have an msys installation and some folders that might make the exploit work - but which might not be present on your machine).
running the patch will add a few search-paths to your preferences and probably modify your MIDI-settings. apart from that, it shouldn't do any harm (though i wouldn't recommend to run it if you have a show tonight). use at your own risk.
gmasdr IOhannes
Pd-list@lists.iem.at mailing list UNSUBSCRIBE and account-management -> https://lists.puredata.info/listinfo/pd-list
On 8/31/21 3:12 PM, Christof Ressi wrote:
The exploit successfully changes my MIDI settings and adds search paths, but unfortunately it crashes with a completely wiped stack before showing me the Tk dialog :-(
you mean, it successfully creates an exploit-plugin.tcl but cannot run it? (if so could you send me the created file?)
the exploit actually works like this: - user runs exploit.pd - this writes a GUI-plugin to your harddisk - and adds the GUI-plugin's path to the search paths - exploit.pd then forcefully quites Pd (so the user is triggered to restart Pd) - on Pd's restart, the new search-paths are searched, and the GUI-plugin is found and executed - i earn plenty of money
gmasdr IOhannes
Writing to "C:/" and "C:/Windows" silently fails. "/tmp" obviously doesn't exist on Windows. "C:/Temp" should be "C:/Windows/Temp" - then it works!
However, it would only show the dialog for a split second and the crash. I ran it in a debugger and just get a completely wiped stack. If I remove the "quit" message, it works.
So how do I pay the money?
Christof
On 31.08.2021 15:49, IOhannes m zmoelnig wrote:
On 8/31/21 3:12 PM, Christof Ressi wrote:
The exploit successfully changes my MIDI settings and adds search paths, but unfortunately it crashes with a completely wiped stack before showing me the Tk dialog :-(
you mean, it successfully creates an exploit-plugin.tcl but cannot run it? (if so could you send me the created file?)
the exploit actually works like this:
- user runs exploit.pd
- this writes a GUI-plugin to your harddisk - and adds the GUI-plugin's path to the search paths
- exploit.pd then forcefully quites Pd (so the user is triggered to
restart Pd)
- on Pd's restart, the new search-paths are searched, and the
GUI-plugin is found and executed
- i earn plenty of money
gmasdr IOhannes
Pd-dev mailing list Pd-dev@lists.iem.at https://lists.puredata.info/listinfo/pd-dev
On 8/31/21 4:10 PM, Christof Ressi wrote:
Writing to "C:/" and "C:/Windows" silently fails. "/tmp" obviously doesn't exist on Windows. "C:/Temp" should be "C:/Windows/Temp" - then it works!
right. i had a C:\tmp\ directory on my system, that's why it works for me.
However, it would only show the dialog for a split second and the crash. I ran it in a debugger and just get a completely wiped stack. If I remove the "quit" message, it works.
you only have to run the exploit.pd once (and it will always quit Pd). the next time you simply start Pd, you should get the dialog.
So how do I pay the money?
just click on "Pay". the rest is automagic.
dfmdras IOhannes
Em ter., 31 de ago. de 2021 às 11:28, IOhannes m zmoelnig zmoelnig@iem.at escreveu:
So how do I pay the money?
just click on "Pay". the rest is automagic.
clicking 'pay' crashes Pd on macOS 10.14.6 (Pd 0.51-4)
On 8/31/21 4:45 PM, Alexandre Torres Porres wrote:
Em ter., 31 de ago. de 2021 às 11:28, IOhannes m zmoelnig zmoelnig@iem.at escreveu:
So how do I pay the money?
just click on "Pay". the rest is automagic.
clicking 'pay' crashes Pd on macOS 10.14.6 (Pd 0.51-4)
the important part is, that the money has been transferred. i don't really care whether it crashes or not.
gfmasdr IOhannes
nice, now every time I open a new Pd patch, I get this window, I have to click pay so the window closes and the patch opens. Is there any way out of this curse? :)
Em ter., 31 de ago. de 2021 às 11:45, Alexandre Torres Porres < porres@gmail.com> escreveu:
Em ter., 31 de ago. de 2021 às 11:28, IOhannes m zmoelnig zmoelnig@iem.at escreveu:
So how do I pay the money?
just click on "Pay". the rest is automagic.
clicking 'pay' crashes Pd on macOS 10.14.6 (Pd 0.51-4)
On 8/31/21 4:49 PM, Alexandre Torres Porres wrote:
nice, now every time I open a new Pd patch, I get this window, I have to click pay so the window closes and the patch opens. Is there any way out of this curse? :)
:-P
remove the new paths from the settings and delete the exploit-plugin.tcl (found in any of these paths; on macOS that would be /tmp/)
make sure to click "Pay" before you do so.
gf,madsr IOhannes
However, it would only show the dialog for a split second and the crash. I ran it in a debugger and just get a completely wiped stack. If I remove the "quit" message, it works.
you only have to run the exploit.pd once (and it will always quit Pd). the next time you simply start Pd, you should get the dialog.
As I said, it would only show the dialog for a split second and then crash, unless I remove the "quite" message. This is *after* the first time (otherwise it wouldn't show the dialog). I'm wondering what's causing the crash... GDB says "no stack" :-)
i wonder whether it would be possible (with Pd>=0.42) to create a patch that creates a gui-plugin on the fly. if this is true, then you can already do everything that [file] allows you to do - and much more
yes, but [file] will be extremely useful in the "-nogui" and libpd contexts.
BTW, and about the "exploits", I'm wondering if this would be feasible to implement a safety lock callable from a libpd based application, that would restrict the write permission (of every Pd object) to a given list of directories.
Le mar. 31 août 2021 à 15:12, Christof Ressi info@christofressi.com a écrit :
The exploit successfully changes my MIDI settings and adds search paths, but unfortunately it crashes with a completely wiped stack before showing me the Tk dialog :-( On 31.08.2021 14:33, IOhannes m zmoelnig wrote:
On 8/31/21 1:05 PM, IOhannes m zmoelnig wrote:
¹ i wonder whether it would be possible (with Pd>=0.42) to create a patch that creates a gui-plugin on the fly. if this is true, then you can already do everything that [file] allows you to do - and much more.
like with the attached patch.
i've tested this on Linux, macOS and Windows (where i have an msys installation and some folders that might make the exploit work - but which might not be present on your machine).
running the patch will add a few search-paths to your preferences and probably modify your MIDI-settings. apart from that, it shouldn't do any harm (though i wouldn't recommend to run it if you have a show tonight). use at your own risk.
gmasdr IOhannes
_______________________________________________Pd-list@lists.iem.at mailing list UNSUBSCRIBE and account-management -> https://lists.puredata.info/listinfo/pd-list
Pd-dev mailing list Pd-dev@lists.iem.at https://lists.puredata.info/listinfo/pd-dev
On 8/31/21 4:37 PM, Antoine Rousseau wrote:
i wonder whether it would be possible (with Pd>=0.42) to create a patch that creates a gui-plugin on the fly. if this is true, then you can already do everything that [file] allows you to do - and much more
yes, but [file] will be extremely useful in the "-nogui" and libpd contexts.
yes definitely. and much more. i didn't write [file] to write exploits but to be useful.
BTW, and about the "exploits", I'm wondering if this would be feasible to implement a safety lock callable from a libpd based application, that would restrict the write permission (of every Pd object) to a given list of directories.
we could probably restrict `sys_open` and friends. however, externals are free to *not* use `sys_open` so that could be easily circumvented.
mfgasdr IOhannes
What a fun thread.
It does raise the old trust issue (I prefer that word to "security")
[shell] was always the obvious tool for mischief.
In the end Pd is a programming language - caveat emptor
Sandboxing has already been mentioned. It's not so easy to make cross platform, but a chrooted or cgroups constrained (semi-containerised) install should be possible for linux. Maybe that could be an install choice, for a "hardened Pd".
Careful code signing and review for Deken is probably a better future, and Pd community is small enough to manage that I think.
On Tue, Aug 31, 2021 at 04:51:00PM +0200, IOhannes m zmoelnig wrote:
On 8/31/21 4:37 PM, Antoine Rousseau wrote:
i wonder whether it would be possible (with Pd>=0.42) to create a patch that creates a gui-plugin on the fly. if this is true, then you can already do everything that [file] allows you to do - and much more
yes, but [file] will be extremely useful in the "-nogui" and libpd contexts.
yes definitely. and much more. i didn't write [file] to write exploits but to be useful.
BTW, and about the "exploits", I'm wondering if this would be feasible to implement a safety lock callable from a libpd based application, that would restrict the write permission (of every Pd object) to a given list of directories.
we could probably restrict `sys_open` and friends. however, externals are free to *not* use `sys_open` so that could be easily circumvented.
mfgasdr IOhannes
Pd-dev mailing list Pd-dev@lists.iem.at https://lists.puredata.info/listinfo/pd-dev
however, externals are free to *not* use `sys_open` so that could be easily circumvented
yes. I was mostly concerned about user written Pd patches that would be opened by a libpd app, like Pd(Droid)Party, MobMuPlat or so. If the developer of the app could lock the write permission to a predefined user directory, it would be safer to try opening patches from other users... In the worst case you only could lose other patches or related data.
Thinking a bit more: actually most mobile APIs already provide such a security...
Le mar. 31 août 2021 à 16:51, IOhannes m zmoelnig zmoelnig@iem.at a écrit :
On 8/31/21 4:37 PM, Antoine Rousseau wrote:
i wonder whether it would be possible (with Pd>=0.42) to create a patch that creates a gui-plugin on the fly. if this is true, then you can already do everything that [file] allows
you
to do - and much more
yes, but [file] will be extremely useful in the "-nogui" and libpd
contexts.
yes definitely. and much more. i didn't write [file] to write exploits but to be useful.
BTW, and about the "exploits", I'm wondering if this would be feasible to implement a safety lock callable from a libpd based application, that
would
restrict the write permission (of every Pd object) to a given list of directories.
we could probably restrict `sys_open` and friends. however, externals are free to *not* use `sys_open` so that could be easily circumvented.
mfgasdr IOhannes
Pd-dev mailing list Pd-dev@lists.iem.at https://lists.puredata.info/listinfo/pd-dev
-
Alexandre Torres Porres -
Andy Farnell -
Antoine Rousseau -
Christof Ressi -
IOhannes m zmoelnig