Files
ioccc/2020/carlini/index.html
T

439 lines
22 KiB
HTML
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- START: two lines up starts content from: inc/top.default.html -->
<!-- END: this line ends content from: inc/top.default.html -->
<!-- START: this line starts content from: inc/head.default.html -->
<head>
<link rel="stylesheet" href="../../ioccc.css">
<link href="https://fonts.googleapis.com/css2?family=Outfit:wght@100..900&display=swap" rel="stylesheet">
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes">
<title>2020/carlini - Best of show - abuse of libc</title>
<link rel="icon" type="image/x-icon" href="../../favicon.ico">
<meta name="description" content="2020 IOCCC entry carlini - Best of show - abuse of libc">
<meta name="keywords" content="IOCCC, 2020, IOCCC 2020, IOCCC entry, carlini, Best of show - abuse of libc">
</head>
<!-- !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! -->
<!-- !!! DO NOT MODIFY THIS FILE - This file is generated by a tool !!! -->
<!-- !!! DO NOT MODIFY THIS FILE - This file is generated by a tool !!! -->
<!-- !!! DO NOT MODIFY THIS FILE - This file is generated by a tool !!! -->
<!-- !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! -->
<!-- END: this line ends content from: inc/head.default.html -->
<!-- -->
<!-- This web page was formed via the tool: bin/readme2index.sh -->
<!-- The content of main section of this web page came from: 2020/carlini/README.md -->
<!-- -->
<!-- !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! -->
<!-- !!! Do not modify this web page, instead modify the file: 2020/carlini/README.md !!! -->
<!-- !!! Do not modify this web page, instead modify the file: 2020/carlini/README.md !!! -->
<!-- !!! Do not modify this web page, instead modify the file: 2020/carlini/README.md !!! -->
<!-- !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! -->
<!-- Markdown content was converted into HTML via the tool: bin/md2html.sh -->
<!-- START: this line starts content from: inc/body.default.html -->
<body>
<!-- END: this line ends content from: inc/body.default.html -->
<!-- START: this line starts content from: inc/topbar.default.html -->
<div class="theader">
<nav class="topbar">
<div class="container">
<div class="logo">
IOCCC
</div>
<div class="topbar-items">
<div class="item">
<span class="item-header">
Home
</span>
<div class="sub-item">
<div class="outfit-font"><a href="../../index.html">IOCCC Home</a></div>
<div class="outfit-font"><a href="../../years.html">Winning Entries</a></div>
<div class="outfit-font"><a href="../../authors.html">People who have won</a></div>
<div class="outfit-font"><a href="../../location.html">Location of authors</a></div>
</div>
</div>
<div class="item">
<span class="item-header">
News
</span>
<div class="sub-item">
<div class="outfit-font"><a href="../../news.html">IOCCC News</a></div>
<div class="outfit-font"><a href="../../status.html">Contest status</a></div>
<div class="outfit-font"><a href="../../next/index.html">Rules and Guidelines</a></div>
<div class="outfit-font"><a href="../../faq.html#submit">How to enter the IOCCC</a></div>
<div class="outfit-font"><a href="../../faq.html">FAQ</a></div>
</div>
</div>
<div class="item">
<span class="item-header">
Bugs
</span>
<div class="sub-item">
<div class="outfit-font"><a href="../../bugs.html">Bugs &amp; (mis)features</a></div>
<div class="outfit-font"><a href="../../faq.html#fix_an_entry">Fixing IOCCC entries</a></div>
<div class="outfit-font"><a href="../../faq.html#fix_web_site">Fixing the web site</a></div>
<div class="outfit-font"><a href="../../faq.html#fix_author">Fixing author info</a></div>
<div class="outfit-font"><a href="../../thanks-for-help.html">Thanks for the help</a></div>
</div>
</div>
<div class="item">
<span class="item-header">
Judges
</span>
<div class="sub-item">
<div class="outfit-font"><a href="../../judges.html">The IOCCC Judges</a></div>
<div class="outfit-font"><a href="../../contact.html">Contacting the IOCCC</a></div>
</div>
</div>
</div>
</div>
</nav>
</div>
<!-- END: this line ends content from: inc/topbar.default.html -->
<!-- START: this line starts content from: inc/header.default.html -->
<div class="header">
<img src="../../png/ioccc.png" alt="IOCCC image by Matt Zucker" width=300 height=110>
<h1>The International Obfuscated C Code Contest</h1>
<h2>2020/carlini - Best of show - abuse of libc</h2>
</div>
<!-- END: this line ends content from: inc/header.default.html -->
<!-- START: this line starts content from: inc/navbar.mid.html -->
<div class="navbar">
<a class="Left" href="../burton/index.html">&larr; burton</a>
<a class="Left" href="../index.html">&uarr; 2020 &uarr;</a>
<a class="Left" href="../endoh1/index.html">endoh1 &rarr;</a>
<a class="Right" href="https://github.com/ioccc-src/temp-test-ioccc/blob/master/2020/carlini/prog.c">C code</a>
<a class="Right" href="https://github.com/ioccc-src/temp-test-ioccc/blob/master/2020/carlini/Makefile">Makefile</a>
<a class="Right" href="#inventory">Inventory</a>
<a class="Right" href="https://validator.w3.org/nu/?doc=https%3A%2F%2Fioccc-src.github.io%2Ftemp-test-ioccc%2F2020%2Fcarlini%2Findex.html">&#x2713;</a>
</div>
<!-- END: this line ends content from: inc/navbar.mid.html -->
<!-- START: this line starts content from: inc/before-content.default.html -->
<div class="content" id="content">
<!-- END: this line ends content from: inc/before-content.default.html -->
<!-- START: this line starts content for HTML phase 20 by: bin/output-index-author.sh via bin/md2html.sh -->
<!-- START: this line starts content generated by: bin/output-index-author.sh -->
<h2 id="author">Author:</h2>
<ul>
<li>Name: <a href="../../authors.html#Nicholas_Carlini">Nicholas Carlini</a><br>
Location: <a href="../../location.html#US">US</a> - <em>United States of America</em> (<em>United States</em>)</li>
</ul>
<!-- END: next line ends content generated by: bin/output-index-author.sh -->
<!-- END: this line ends content for HTML phase 20 by: bin/output-index-author.sh via bin/md2html.sh -->
<!-- START: this line starts content for HTML phase 21 by: bin/pandoc-wrapper.sh via bin/md2html.sh -->
<!-- BEFORE: 1st line of markdown file: 2020/carlini/README.md -->
<h2 id="to-build">To build:</h2>
<pre><code> make</code></pre>
<h3 id="bugs-and-misfeatures">Bugs and (Mis)features:</h3>
<p>The current status of this entry is:</p>
<pre><code> STATUS: INABIAF - please **DO NOT** fix</code></pre>
<p>For more detailed information see <a href="../../bugs.html#2020_carlini">2020 carlini bugs</a>.</p>
<h2 id="to-use">To use:</h2>
<pre><code> ./prog</code></pre>
<h2 id="try">Try:</h2>
<pre><code> ./try.sh</code></pre>
<p>Or if you actually want to play:</p>
<pre><code> # Play with a friend, real or imagined, P1 and P2, squares are numbered 1..9
./prog</code></pre>
<h2 id="judges-remarks">Judges’ remarks:</h2>
<p>This program consists of a single <code>printf(3)</code> statement wrapped in a <code>while</code>
loop. You would not think that this would amount to much, but you would be very,
very wrong. A clue to what is happening and how this works is encoded in the
ASCII art of the program source.</p>
<h2 id="authors-remarks">Author’s remarks:</h2>
<p>HOW ABOUT A NICE GAME OF <del>CHESS</del>TIC-TAC-TOE?</p>
<h3 id="usage">USAGE</h3>
<pre><code> cc -o prog prog.c
./prog</code></pre>
<p>Alternates between P1 and P2. Enter a digit [1-9] to move:</p>
<pre><code> 1 | 2 | 3
---------
4 | 5 | 6
---------
7 | 8 | 9</code></pre>
<p>The game ends if:</p>
<ul>
<li>A player completes three in a row; that player wins.</li>
<li>All squares are taken; neither player wins.</li>
<li>A player makes an illegal move; their opponent wins.</li>
</ul>
<h3 id="limitations">LIMITATIONS</h3>
<p>Bad things may happen if the entered move is outside of the range [1..9]</p>
<p>While the game will stop if one player tries to overwrite another player’s move,
it will happily allow a player to move on top of themself. However, given that
this is an effective no-op and guarantees a loss to a competent opponent, if you
do this you probably deserve to lose.</p>
<p>Your terminal may beep at you every turn. We’ll call this a feature that …
the program … is hard at work processing your move! That is! Please be
patient.</p>
<p>After macro expansion the format string is roughly 100K. This makes some
compilers unhappy, and others slow. (For example, passing GCC the flags <code>-Wall -Wextra -pedantic</code> will result in a warning about oversized strings.)</p>
<p>Under some terminals the program may exit early. The following should always work:</p>
<pre><code> echo &quot;1 2 3 4 5 6 7&quot; | ./prog</code></pre>
<h3 id="obfuscation">OBFUSCATION</h3>
<p>The entirety of the program consists of a single iterated call to <code>printf(3)</code>.</p>
<pre><code> int main() {
while(*d) printf(fmt, arg);
}</code></pre>
<p>Here, <code>fmt</code> is a single string, and <code>arg</code> is a series of arguments to
<code>printf(3)</code>.</p>
<p>While its primary purpose is to serve as The One True Debugger, <code>printf(3)</code> also happens
to be Turing complete. (See “Control-Flow Bending: On the Effectiveness of Control-Flow
Integrity” where we introduced this in an actual, published, academic paper. The
things you can get away with sometimes.)</p>
<p>We <del>ab</del>use this fact to implement the logic of tic-tac-toe entirely within
this one <code>printf(3)</code> call (and a call to <code>scanf(3)</code> to read user input).</p>
<p>Here’s (briefly) how it works.</p>
<h4 id="preliminaries">Preliminaries</h4>
<p>This program uses three <code>printf(3)</code> format specifiers.</p>
<ul>
<li><p><code>%d</code> takes an integer argument and prints it.</p></li>
<li><p><code>%s</code> takes a string argument and prints it.</p></li>
<li><p><code>%n</code> takes a pointer and writes (!!) the number of bytes printed so far.</p></li>
</ul>
<p>Okay, everyone probably knows this. Let’s get a bit more advanced.</p>
<p>Format specifiers can take extra “arguments”.</p>
<ul>
<li><p><code>"%hhn"</code>: store the number of bytes written mod 256 to the <code>char</code> pointer.</p></li>
<li><p><code>"%2$d"</code>: print argument 2 to <code>printf(3)</code> (and not the sequentially next argument).</p></li>
<li><p><code>"%8d"</code>: pad the printed integer to 8 characters.</p></li>
<li><p><code>"%3$.*4$d"</code>: print argument 3 to <code>printf(3)</code> with as many zeros as in argument 4.</p></li>
</ul>
<p>For example, the following expression</p>
<pre><code> printf(&quot;%1$.*2$d%3$hhn&quot;, 5, 10, &amp;x)</code></pre>
<p>will have the same effect as if we had written</p>
<pre><code> x = 10;</code></pre>
<p>because it will print out <code>0000000005</code> (5 padded to size 10) and then write the
number of bytes written to <code>x</code>.</p>
<h4 id="printf3-oriented-programming"><code>printf(3)</code> Oriented Programming</h4>
<p>Alright, now we can get to the real fun.</p>
<p>We perform arbitrary computation with <code>printf(3)</code> treating memory as a binary
array–one bit per pair of bytes:</p>
<ul>
<li><p>The zero bit is represented by the sequence <code>00 00</code>.</p></li>
<li><p>The one-bit is represented by the sequence <code>xx 00</code> where <code>xx</code> is any non-zero byte.</p></li>
</ul>
<p>We can use format strings to compute the OR/NOT of arbitrary “bits”.</p>
<p>We’ll start with the simplest, OR:</p>
<pre><code> printf(&quot;%1$s%2$s%3$hhn&quot;, a, b, c)</code></pre>
<p>will compute</p>
<pre><code> *c = strlen(a) + strlen(b)</code></pre>
<p>but given that <code>strlen(x)</code> is <code>1</code> for a 1-bit and <code>0</code> for a 0-bit, we have</p>
<pre><code> *c = a | b</code></pre>
<p>Computing the NOT of a single value is also easy:</p>
<pre><code> printf(&quot;%1$255d%1$s%hhn&quot;, a, b)</code></pre>
<p>will compute</p>
<pre><code> *b = (strlen(a)+255)%256 = strlen(a)-1</code></pre>
<p>and again, because <code>strlen(x)</code> is either <code>1</code> or <code>0</code> we have</p>
<pre><code> *c = !b</code></pre>
<p>From here we can compute any binary circuit. Doing something efficient,
though, still takes work.</p>
<h4 id="tic-tac-toe">Tic-Tac-Toe</h4>
<p>The game itself is represented as a board of 18 bits, 9 bits per player, along
with a turn counter that alternates between player 1 and player 2.</p>
<p>To detect who has won, we implement the following logic. Let <code>A</code>, <code>B</code>, and <code>C</code> be
pointers to three squares in a row to test, and <code>D</code> be where to save if there is a
win or not.</p>
<pre><code> &quot;%A$s%B$s%C$s%1$253d%11$hhn&quot; // r11 = !(*A &amp; *B &amp; *C)
ZERO
&quot;%11$s%1$255d%11hhn&quot; // r11 = !r11
ZERO
&quot;%11$s%D$s%D$hhn&quot; // *D = *D | r11</code></pre>
<p>That is, we set <code>*D</code> to <code>1</code> if there is a three-in-a-row. We repeat this for all
possible three-in-a-row configurations, for both players.</p>
<p>The ZERO macro ensures that the number of bytes written out is 0 mod 256 with
the following expression</p>
<pre><code> &quot;%1$hhn%1$s&quot; (repeated 256 times)</code></pre>
<p>where argument 1 is a pointer to a temporary variable followed by a NUL byte.</p>
<p>This works because if the current count is 0 mod 256, then <code>"%1$hhn"</code> will write
zero to argument 1 and then <code>"%1$s"</code> will never emit any text. If, on the other
hand, the count is not 0 mod 256, a length-1 string will be written to argument
1, and then <code>"%1$s"</code> will increment the count by one. By repeating this 256
times we’re eventually going to reach 0 mod 256.</p>
<p>Checking if there has been an invalid move is achieved similarly.</p>
<p>In order to decide what to print out, we have to cast the “in-memory” array of
bits to Xs and Os to print out. This is actually rather straightforward. Given
in <code>1$</code> the pointer to player 1’s square, and <code>2$</code> the pointer to player 2’s, and
in <code>3$</code> the pointer to the board string, we can compute</p>
<pre><code> &quot;%1$s&quot; (repeated 47 times) &quot;%2$s&quot; (repeated 56 times) %1$32d%3$hhn&quot;</code></pre>
<p>which will, in effect, compute</p>
<pre><code> *r3 = (*r1) * 47 + (*r2) * 56 + 32</code></pre>
<p>which will output <code>' '</code> if neither are true, <code>'X'</code> if <code>r1</code> is true, or <code>'O'</code> if
<code>r2</code> is true.</p>
<h4 id="further-obfuscations">Further Obfuscations</h4>
<p>In order to be able to finally display the board, while still only using one
<code>printf(3)</code> statement, we finish the statement with</p>
<pre><code> &quot;\n\033[2J\n%26$s&quot;</code></pre>
<p>which is the escape sequence to clear the screen, and then prints argument 26.
Argument 26 is a pointer to a <code>char*</code> in memory, that initially is undefined,
but within the <code>printf(3)</code> statement we will construct this string to look like a
tic-tac-toe board.</p>
<p>After the board, we need to print one of the following strings:</p>
<pre><code> P1&gt;_
P2&gt;_
P1 WINS
P2 WINS
P1 TIES
P2 TIES</code></pre>
<p>Depending on if it’s P1 or P2’s turn to move, the game is over and someone
won, or the game is over and it is a draw.</p>
<p>This turns out not to be as hard as it might look. Using the same trick as
before, we set byte four to be</p>
<pre><code> *byte4 = is_win * &#39;W&#39; + is_tie * &#39;T&#39;</code></pre>
<p>The byte <code>'I'</code> and <code>'S'</code> can always be the same, and we do the same for <code>'E'</code>/<code>'N'</code>.</p>
<p>We do this same on-the-fly creation of the <code>scanf(3)</code> format string, but for a
different reason. We first want to run <code>printf(3)</code> to show the first board, and
then alternate between runs to <code>scanf(3)</code> and <code>printf(3)</code> reading and then
displaying moves. Importantly, we <em>do not</em> want a final <code>scanf(3)</code> when the game
ends. It should just exit.</p>
<p>One option would be to implement the logic as</p>
<pre><code> printf()
while (*ok) {
scanf();
printf();
}</code></pre>
<p>but this would DOUBLE the number of calls to <code>printf(3)</code> we require. So instead we
implement it like this</p>
<pre><code> while (*ok) {
scanf();
printf();
}</code></pre>
<p>(In reality we actually pass <code>scanf(3)</code> as an argument to avoid the extra
statement, but it has the same effect.)</p>
<p>Notice there is now no initial <code>printf(3)</code>. In order make sure the program doesn’t
block before the first <code>printf(3)</code>, we initialize the <code>scanf(3)</code> format to the NUL
string so that it returns right away without blocking. The first time the
<code>printf(3)</code> call runs, it writes out <code>"%hhd"</code> to create the <code>scanf(3)</code> format string.</p>
<!--
Copyright © 1984-2024 by Landon Curt Noll. All Rights Reserved.
You are free to share and adapt this file under the terms of this license:
Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)
For more information, see:
https://creativecommons.org/licenses/by-sa/4.0/
-->
<!-- AFTER: last line of markdown file: 2020/carlini/README.md -->
<!-- END: this line ends content for HTML phase 21 by: bin/pandoc-wrapper.sh via bin/md2html.sh -->
<!-- START: this line starts content for HTML phase 22 by: bin/output-index-inventory.sh via bin/md2html.sh -->
<!-- START: this line starts content generated by: bin/output-index-inventory.sh -->
<div id="inventory">
<h1 id="inventory-for-2020carlini">Inventory for 2020/carlini</h1>
</div>
<p><a href="#top">Jump to top</a></p>
<h2 id="primary-files">Primary files</h2>
<ul>
<li><a href="https://github.com/ioccc-src/temp-test-ioccc/blob/master/2020/carlini/prog.c">prog.c</a> - entry source</li>
<li><a href="https://github.com/ioccc-src/temp-test-ioccc/blob/master/2020/carlini/Makefile">Makefile</a> - entry Makefile</li>
<li><a href="https://github.com/ioccc-src/temp-test-ioccc/blob/master/2020/carlini/prog.orig.c">prog.orig.c</a> - original source</li>
<li><a href="https://github.com/ioccc-src/temp-test-ioccc/blob/master/2020/carlini/try.sh">try.sh</a> - how to run</li>
</ul>
<h2 id="secondary-files">Secondary files</h2>
<ul>
<li><a href="2020_carlini.tar.bz2">2020_carlini.tar.bz2</a> - download entry tarball</li>
<li><a href="https://github.com/ioccc-src/temp-test-ioccc/blob/master/2020/carlini/README.md">README.md</a> - markdown source for this web page</li>
<li><a href="https://github.com/ioccc-src/temp-test-ioccc/blob/master/2020/carlini/.entry.json">.entry.json</a> - description of entry in JSON</li>
<li><a href="https://github.com/ioccc-src/temp-test-ioccc/blob/master/2020/carlini/.gitignore">.gitignore</a> - list of files that should not be committed under git</li>
<li><a href="https://github.com/ioccc-src/temp-test-ioccc/blob/master/2020/carlini/.path">.path</a> - directory path from top directory</li>
<li><a href="index.html">index.html</a> - this web page</li>
</ul>
<!-- END: next line ends content generated by: bin/output-index-inventory.sh -->
<!-- END: this line ends content for HTML phase 22 by: bin/output-index-inventory.sh via bin/md2html.sh -->
<!-- START: this line starts content from: inc/after-content.default.html -->
</div>
<!-- END: this line ends content from: inc/after-content.default.html -->
<!-- START: this line starts content from: inc/footer.default.html -->
<!--
Copyright © 1984-2024 by Landon Curt Noll. All Rights Reserved.
You are free to share and adapt this file under the terms of this license:
Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)
For more information, see:
https://creativecommons.org/licenses/by-sa/4.0/
-->
<div class="footer">
<div id="copyright"><h2>Copyright and CC BY-SA 4.0 License</h2></div>
<p>All IOCCC content including this file and web page are:</p>
<b>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Copyright &copy; 1984-2024 by Landon Curt Noll. <a href="https://creativecommons.org/faq/#what-does-some-rights-reserved-mean">Some Rights Reserved</a>.</b>
<p>This work is licensed by Landon Curt Noll under:</p>
<p><b><a href="https://creativecommons.org/licenses/by-sa/4.0/?ref=chooser-v1"
target="_blank" rel="license noopener noreferrer" style="display:inline-block;">&nbsp;&nbsp;&nbsp;&nbsp;CC BY-SA 4.0
<img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;"
src="../../png/cc.png"
alt="cc inside circle symbol">
<img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;"
src="../../png/by.png"
alt="person inside circle symbol">
<img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;"
src="../../png/sa.png"
alt="arrow looping back on itself inside circle symbol">
</a></b></p>
<p>The <b>CC BY-SA 4.0 LEGAL CODE</b> for this license is found under:</p>
<p>&nbsp;&nbsp;&nbsp;<b><a href="https://creativecommons.org/licenses/by-sa/4.0/legalcode.en">
https://creativecommons.org/licenses/by-sa/4.0/legalcode.en</a></b></p>
<p>You should <b>carefully review</b> all of the terms and conditions of the
<a href="https://creativecommons.org/licenses/by-sa/4.0/legalcode.en">actual license</a>
before using the licensed material.</p>
<p>You may wish to review the <b><a href="../../license.html">highlights of some of the key
features and terms</a></b> of the <a href="https://creativecommons.org/licenses/by-sa/4.0/legalcode.en">actual license</a>.</p>
<h2>Coda</h2>
<p><a href="https://validator.w3.org/nu/?doc=https%3A%2F%2Fioccc-src.github.io%2Ftemp-test-ioccc%2F2020%2Fcarlini%2Findex.html">Nu HTML check this web page</a></p>
<p><a href="#top">Jump to top</a> <a href="#content">Jump to Content</a> <a href="#inventory">Jump to Inventory</a></p>
</div>
<!-- END: this line ends content from: inc/footer.default.html -->
<!-- START: this line starts content from: inc/bottom.default.html -->
</body>
</html>
<!-- END: this line ends content from: inc/bottom.default.html -->