IRC log for #botpark on 20080229

00:16.42*** join/#botpark catfacts (n=catfacts@fullcirclemagazine/developer/catfacts)
01:52.16*** join/#botpark Ruffy (n=Ruffy@unaffiliated/rockermono/bot/xando) [NETSPLIT VICTIM]
01:52.17*** join/#botpark SafeTcl (n=SafeTcl@unaffiliated/skiidoo/bot/safetcl) [NETSPLIT VICTIM]
02:51.16*** join/#botpark sysdef (n=sysdef@debiancenter/founder.developer/cacert.assurer.sysdef)
02:51.20sysdefre
03:17.45*** join/#botpark chirpsalot (n=calvin@unaffiliated/chirpsalot)
03:18.51sysdefchirpsalot: not 24/7, but most of the time. this time it's a bit silent
03:19.03sysdefpurl: seen perlbot
03:19.05purlperlbot is currently on #botpark (19h 9m 54s), last said: '(fact) : tell (who) about (what) : (what) > (who) : learn (what) as (info) : relearn (fact) as (info) : phone (phone #) : shorten (url) : shorten it : search (keyword) : cpan (module) : docs (module) : perldoc -f (function) : jargon (term) : math (expr): fortune : flip : host (type) (record) : ...
03:20.38chirpsalotah ok sysdef
03:20.46chirpsalotbut thanks :D
03:20.58chirpsalotalways feel awkward asking for help in #python
03:21.21sysdefRockerMONO is about to write a bot in py afaik
03:22.01chirpsalotafaik?
03:26.31sysdefafaik == as far as i know
03:26.40chirpsalotah
03:27.09sysdefi have to get some sleep
03:27.22sysdefpurl: good night
03:27.23purlGood night, good! Have a cookie... oh no! The cookie jar is dry!
03:31.41*** join/#botpark sco50000 (n=scott@unaffiliated/sco50000)
04:22.37*** join/#botpark Sargun (n=Sargun@atarack/staff/sargun)
04:27.59*** join/#botpark The_Master (i=ttech@unaffiliated/ttech/bot/themaster)
04:27.59Anna^hiya The_Master
04:31.00*** join/#botpark ricer4 (n=fs@server3.maserver.com)
04:42.15*** join/#botpark xbmodder__ (n=Sargun@76.191.201.198)
05:02.45Shirik(23:27:14) (Anna^) hiya The_Master
05:02.45Shirik(23:27:15)  -› Join: The_Master (i=ttech@unaffiliated/ttech/bot/themaster)
05:02.46Shiriko.o
05:02.48Shirikimpressive.
05:03.38sco50000not on my screen...
05:03.43sco50000[22:27] * The_Master (i=ttech@unaffiliated/ttech/bot/themaster) has joined #botpark
05:03.43sco50000[22:27] <Anna^> hiya The_Master
05:03.58*** join/#botpark Sargun (n=Sargun@atarack/staff/sargun)
05:04.09Shirikobviously your connection is faulty
05:04.23Shirikbetter go get that checked out
05:06.46sco50000lol
05:24.23Shirik--> local f = rawset; setfenv(f, {_G = nil})
05:24.23batbotShirik: @ [string " local f = rawset; setfenv(f, {_G = nil})"]:1: cannot change secure functions environment
05:24.56batricklol
05:27.27Shirik--> local f = function(...) return rawset(...) end; setfenv(f, {_G = nil}); rawset(_G, {})
05:27.30Shirikhm
05:27.51Shirik--> for k,v in pairs(_G) do print(k,v) end
05:27.51batbotShirik: tempg  table: 0x8092828foo  4rap  function: 0x8136288string  table: 0x8106668xpcall  function: 0x8130430color  function: 0x812b8b8tostring  function: 0x80ff708_VERSION  Lua 5.1os  table: 0x8105828unpack  function: 0x808cbb8points  f...(tldr)
05:28.24Shirik--> local f = function(...) return rawset(...) end; setfenv(f, {_G = nil}); return rawget(_G, "rawget")
05:28.25batbotShirik: > function: 0x8130368
05:29.09Shirik--> local f = function(...) return rawset(...) end; setfenv(f, {_G = nil}); rawset(_G, "rawget", function() return "Hi batrick!" end); return rawget()
05:29.09batbotShirik: @ [string " local f = function(...) return rawset(...)..."]:1: cannot perform rawset on protected variables
05:29.15Shirik*@&#%(
05:30.38Shirik--> local f = function(fenv, ...) assert(fenv == _G) return rawset(...) end; setfenv(f, {_G = nil}); rawset(_G, _G, "_G", {})
05:31.07Shirik--> local f = function(fenv, ...) assert(fenv == _G) assert(fenv == getfenv(rawset)) return rawset(...) end; setfenv(f, {_G = nil}); rawset(_G, _G, "_G", {})
05:31.25Shirikooookay...
05:31.38Shirik--> local f = function(fenv, ...) assert(fenv == _G) assert(fenv == getfenv(rawset)) return rawset(...) end; setfenv(f, {_G = nil}); rawset(_G, _G, "_G", {}); for k,v in pairs(_G) do print(k,v) end
05:31.38batbotShirik: tempg  table: 0x8092828foo  4rap  function: 0x8136288table: 0x8092828  _Gstring  table: 0x8106668xpcall  function: 0x8130430color  function: 0x812b8b8tostring  function: 0x80ff708_VERSION  Lua 5.1os  table: 0x8105828unpack  function...(tldr)
05:31.44Shirikwtf...
05:32.24*** join/#botpark Gokee2 (n=gokee2@24-113-12-97.wavecable.com)
05:32.47Shirik--> local f = function(fenv, ...) assert(fenv == _G) assert(fenv == getfenv(rawset)) setmetatable(_G, {}) return rawset(...) end; setfenv(f, {_G = nil}); rawset(_G, _G, "_G", {}); for k,v in pairs(_G) do print(k,v) end
05:32.48batbotShirik: tempg  table: 0x8092828foo  4rap  function: 0x8136288table: 0x8092828  _Gstring  table: 0x8106668xpcall  function: 0x8130430color  function: 0x812b8b8tostring  function: 0x80ff708_VERSION  Lua 5.1os  table: 0x8105828unpack  function...(tldr)
05:32.55Shirikohhhhh
05:33.10Shirikwait, no. I go back to my earlier statement.
05:33.12Shirikwtf.
05:33.17batricklmfao
05:33.43Shirik--> f = function(...) return _G end; setfenv(f, {_G = nil}) return f()
05:33.43batbotShirik: > nil
05:33.45batrickall you did was change the environment of f, and then change >its< value for _G in >its< environment
05:35.13batrick--> local f = function(fenv, ...) assert(fenv == _G) assert(fenv == getfenv(f)) setmetatable(_G, {}) return  rawset(...) end; setfenv(f, {_G = nil}); rawset(_G, _G, "_G", {}); for k,v in pairs(_G) do print(k,v) end
05:35.13batbotbatrick: f  function: 0x8137290tempg  table: 0x8092828foo  4rap  function: 0x8136288table: 0x8092828  _Gstring  table: 0x8106668xpcall  function: 0x8130430color  function: 0x812b8b8tostring  function: 0x80ff708_VERSION  Lua 5.1os  table: 0x...(tldr)
05:35.24Shirik--> f = function(t, k, v) rawset(t, k, v); return t; end; return f(setmetatable(_G, {__index = nil}))
05:35.24batbotShirik: @ [string " f = function(t, k, v) rawset(t, k, v); ret..."]:1: cannot change a protected metatable
05:35.26batrickoops
05:35.30Shiriker
05:35.33batrick--> local f; f = function(fenv, ...) assert(fenv == _G) assert(fenv == getfenv(f)) setmetatable(_G, {}) return  rawset(...) end; setfenv(f, {_G = nil}); rawset(_G, _G, "_G", {}); for k,v in pairs(_G) do print(k,v) end
05:35.33batbotbatrick: f  function: 0x812fda0tempg  table: 0x8092828foo  4rap  function: 0x8136288table: 0x8092828  _Gstring  table: 0x8106668xpcall  function: 0x8130430color  function: 0x812b8b8tostring  function: 0x80ff708_VERSION  Lua 5.1os  table: 0x...(tldr)
05:35.42batricko well
05:36.26ShirikI don't even remember where I was going with this
05:36.38ShirikOh right
05:36.39Shirikright
05:37.05batrick--> local f = function(fenv, ...) assert(fenv == _G) assert(fenv == getfenv(f)) setmetatable(_G, {}) return  rawset(...) end; setfenv(f, {_G = nil}); f(_G, _G, "_G", {}); for k,v in pairs(_G) do print(k,v) end
05:37.05batbotbatrick: @ [string " local f = function(fenv, ...) assert(fenv ..."]:1: attempt to call global 'assert' (a nil value)
05:37.13batrickhaha
05:37.29batrickso oyou were calling the wrong function =)
05:39.27batrick--> debug.setfenv(_G, {})
05:39.27batbotbatrick: @ ./sandbox.lua:80: 'setfenv' cannot change environment of given object
05:39.39batrick--> debug.setfenv("", {})
05:39.39batbotbatrick: @ ./sandbox.lua:80: 'setfenv' cannot change environment of given object
05:40.06batrick--> local a; return debug.upvalue(function() return a end, 1) --, {})
05:40.06batbotbatrick: > userdata: 0x806eba8
05:40.28Shirik--> debug.getlocal(print, 1)
05:40.28batbotShirik: @ ./sandbox.lua:106: bad argument #1 to 'getlocal' (number expected, got function)
05:40.51Shirik--> debug.getupvalue(pairs, 1)
05:40.51batbotShirik: @ cannot access secure functions' upvalues
05:41.19Shirikthis is hurting my head
05:41.21Shirikbut I know it's here!
05:42.19Shirik--> debug.getinfo(pcall)
05:42.19batbotShirik: > table: 0x811ee78
05:42.25Shirik--> debug.getinfo(pcall).nups
05:42.25batbotShirik: > 3
05:42.29Shirikok.
05:44.47batrickfor i = 1, debug.getinfo(pcall).nups do print(debug.upvalue(pcall, i) ) end
05:44.51batrick-->for i = 1, debug.getinfo(pcall).nups do print(debug.upvalue(pcall, i) ) end
05:44.51batbotbatrick: userdata: 0x80bc1c0userdata: 0x81302c8userdata: 0x81302e8
05:44.56Shiriko_o
05:45.10batrickI'm pretty sure you won't be able to exploit that :)
05:45.21Shirikbut...
05:45.25Shirikthat's not the point
05:45.42batrickwhat's the point then
05:45.55ShirikI'm trying to find it
05:45.57batrickbtw: http://lua-users.org/lists/lua-l/2008-02/msg01173.html
05:46.00Shirikit's like this fricking recursive problem
05:46.07batrickthat's where those functions came from
05:46.18Shirikthe problem is the question
05:46.20Shiriker
05:46.23Shirikthe answer is the question
05:46.24Anna^[lua-users.org] Differentiating upvalues and sharing
05:46.29ShirikI just need to find the right hole
05:46.37batrickthe hell
05:46.50ShirikAnna^ summarizes links you post :)
05:46.56batrickthat could be construed as sexual
05:47.07Shirik....
05:47.28batrickheh
05:47.29batrickuh
05:47.31ShirikI KNOW it's here
05:47.35batrickk
05:47.58batrickshirik do you find my code easy to read?
05:48.06batrickit's always hard to judge that yourself
05:48.10Shirik--> for = 1, debug.getinfo(debug.setlocal) do print(debug.upvalue(debug.setlocal, i)) end
05:48.10batbotShirik: @ [string " for = 1, debug.getinfo(debug.setlocal) do print(debug.upvalue(..."]:1: '<name>' expected near '='
05:48.30Shirik--> for i = 1, debug.getinfo(debug.setlocal).nups do print(debug.upvalue(debug.setlocal, i)) end
05:48.30batbotShirik: userdata: 0x8124330userdata: 0x81054d8userdata: 0x81054f8userdata: 0x8105518
05:48.33Shirikjr,
05:48.36Shirikhrm
05:48.42Shirikwhy is it not here...
05:49.11Shirik--> co = coroutine.create(debug.getinfo); print(debug.getlocal(co, 1))
05:49.11batbotShirik: @ [string " co = coroutine.create(debug.getinfo); prin..."]:1: bad argument #1 to 'create' (Lua function expected)
05:49.12batrickwhat are you looking for
05:49.17batrickand answer my question pls :)
05:49.32ShirikI am looking for the hole that stems from you relying on specific globals
05:49.46batrickno
05:49.52batrick22:47:58 < batrick> shirik do you find my code easy to read?
05:49.52batrick22:48:06 < batrick> it's always hard to judge that yourself
05:49.57Shirikthe code is actually quite clear
05:50.06batrickk thanks :)
05:50.08Shiriksome of it is a bit strange
05:50.14batrickwhich parts?
05:50.21Shirikand it needs more comments :P
05:50.25ShirikBut I think I overuse comments
05:50.25*** part/#botpark chirpsalot (n=calvin@unaffiliated/chirpsalot)
05:50.46Shiriklike this:
05:50.47Shirikif (!(1 <= n && n <= p->sizeupvalues)) return NULL;
05:50.57batricko
05:51.00Shirikif (1 > n || n > p->sizeupvalues)
05:51.10batrickI was referring to my sandbox code but you could talk about that too
05:51.19ShirikI also don't like your naming convention :P
05:51.19batricktechnically I didn't write that segment
05:51.30batrickI jacked that from aux_upvalue in lapi.c
05:51.38batrickmost of it I wrote
05:51.56ShirikI like camelCaseVariables
05:52.00Shirikbut that's a personal opinion
05:52.06Shirikbut yeah it's easy to read
05:54.31Shirikwhy the hell is securef not an upvalue of debug.setlocal?
05:54.45batrickIt is
05:54.53batrickyou're looking at the pointer to the upvalue of debug.setlocal
05:54.54Shirikuh
05:55.11Shirikoh wow, I didn't realize that's what it returned
05:55.11batrickthe whole point is:
05:55.16Shirikwtf am I supposed to do with that!
05:55.41batrick--> local a; local b; a, b = "hi", "hi"; f1 = function() return a end f2 = function() return b end;
05:55.53batrick--> debug.upvalue(f1, 1), debug.upvalue(f2, 1)
05:55.53batbotbatrick: > userdata: 0x80e0e60, userdata: 0x8115720
05:55.59batricksee they're not the same =)
05:56.03Shirik--> debug.getupvalue(debug.setlocal, 1)
05:56.03batbotShirik: @ cannot access secure functions' upvalues
05:56.04batrickeven though the value is the same
05:56.15Shirik--> local t = _G; _G = nil; debug.getupvalue(debug.setlocal, 1)
05:56.15batbotShirik: @ [string " local t = _G; _G = nil; debug.getupvalue(d..."]:1: cannot modify secure global variables
05:56.21ShirikYES I CAN DAMNIT
05:57.02batrickShirik: the point of debug.upvalue is distinguishing whether two functions share the same upvalue
05:57.12batricknot whether the upvalues have the same value
05:57.22ShirikI have a different point of debug.getupvalue right now
05:57.32Shirikan unusual one
05:59.20Shirik--> local t = _G; local f = function(t) return debug.getupvalue(t.debug.setlocal); end setfenv(v, {_G = {debug= {getupvalue = debug.getupvalue}}}); return f(t)
05:59.20batbotShirik: @ ./sandbox.lua:327: bad argument #1 to 'setfenv' (number expected, got nil)
05:59.29Shirik--> local t = _G; local f = function(t) return debug.getupvalue(t.debug.setlocal); end setfenv(f, {_G = {debug= {getupvalue = debug.getupvalue}}}); return f(t)
05:59.29batbotShirik: @ [string " local t = _G; local f = function(t) return..."]:1: attempt to index global 'debug' (a nil value)
05:59.38ShirikI'm so close!!
05:59.39ShirikSO CLOSE
06:00.11Shirikoh
06:00.11batrickhmm
06:00.12ShirikI see it
06:00.13ShirikI SEE IT
06:00.34batricklol
06:01.25Shirik--> local t = _G; local f = function(t) return debug.getupvalue(t.debug.setlocal) end; setfenv(f, {debug=debug, _G = 4, type = function() return "nil" end}) return f(debug.setlocal)
06:01.25batbotShirik: @ [string " local t = _G; local f = function(t) return..."]:1: attempt to index local 't' (a function value)
06:01.34Shirik--> local t = _G; local f = function(t) return debug.getupvalue(debug.setlocal) end; setfenv(f, {debug=debug, _G = 4, type = function() return "nil" end}) return f(debug.setlocal)
06:01.34batbotShirik: @ cannot access secure functions' upvalues
06:01.42Shirik--> local t = _G; local f = function(t) return debug.getupvalue(t) end; setfenv(f, {debug=debug, _G = 4, type = function() return "nil" end}) return f(debug.setlocal)
06:01.42batbotShirik: @ cannot access secure functions' upvalues
06:01.46ShirikSCREW YOU BATBOT
06:01.51batrickhaha
06:03.39Shirik--> f = function(s) return type(s); end; t = function(s) return f(s); end; setfenv(t, {f=f, type=function() return "nil" end}); return t("foo")
06:03.40batbotShirik: > string
06:03.43Shirikok so that's the problem.
06:03.48Shirikyou lied before.
06:04.15Shirikor something lied before
06:04.19Shirikhrm
06:04.30Shirikhow can I pull this off. I know what I need to do.
06:05.57batricki'm surprised you didn't find the derefrencing NULL bug in my patch :(
06:06.07ShirikHaven't really looked at your patch much sorry!!
06:06.25batricko well
06:06.57ShirikI guess it's not there
06:07.03ShirikI'm just... so close, it's so heartbreaking
06:08.19ShirikWhat I was trying to do, batrick, is to trick your code into thinking I'm not modifying the global table
06:09.38Shirikuh batrick
06:09.49Shirikare you missing a lua_unlock in lua_shareupvalue?
06:11.06batrickyes and no
06:11.17batrickI saw it but didn't feel it was worth sending to them
06:12.15batrickassuming there are no nested locks, the lock is removed in auxl_upvalue
06:12.21batrickbut even then
06:12.32batrickin vanilla Lua, lua_lock/unlock does nothing
06:12.46Shirik--> return debug.upvalue(nil)
06:12.46batbotShirik: @ [string " return debug.upvalue(nil)"]:1: bad argument #1 to 'upvalue' (function expected, got nil)
06:13.09ShirikI don't see that check...
06:14.00batrickI think the idea of lua_lock is to allow Lua to be multithreaded in some way
06:14.05Shirikyeah
06:14.09batrickbut it's already reentrant
06:14.12Shirikbatrick, where's the check for debug.upvalue?
06:14.18batrickI think it's just artifacts of an older version
06:14.43Shirikwell no it's not really reentrant
06:14.51batrickhuh?
06:14.56batrickall of Lua is reentrant
06:14.56Shirikyou have one critical problem: Two threads operating on the stack at the same time
06:15.00batrickno
06:15.06batrickI mean the library is reentrant
06:15.08Shirikoh
06:15.10Shirikthis is true
06:15.22Shirikbut since you lock a state, I think that's what it's for
06:15.32Shirikto prevent you from having two threads operating on the same stack at the same time
06:15.35batrick#define lua_lock(L)     ((void) 0)
06:15.35batrick#define lua_unlock(L)   ((void) 0)
06:15.39Shirikwell yeah
06:15.39batrickso basically they do nothing
06:15.41Shirikyou have to define them :P
06:15.53batricklike I said, they're artifacts of an older version
06:15.56ShirikI've heard rici recommend that to me before; they don't define them for you
06:16.01Shirikbut you can define them on your own, and that's intended
06:16.10batrickyou simply can't have two threads operating on the same lua_State
06:16.17Shiriksure you can, if you lock them :)
06:16.30batrickoperating at the same time*
06:16.33Shirikmay not be very efficient
06:16.48Shirik--> upvalue
06:16.48batbotShirik: > nil
06:16.54Shirikbatrick, what is lua_upvalue?
06:16.56Shirikis that debug.upvalue?
06:17.09batrickessentially
06:17.14Shirikwhy does this work?
06:17.20Shirik--> return debug.upvalue(nil)
06:17.20batbotShirik: @ [string " return debug.upvalue(nil)"]:1: bad argument #1 to 'upvalue' (function expected, got nil)
06:17.27Shirikimo that should segfault
06:17.34batricklook at the binding
06:17.37batrickdb_upvalue
06:17.47Shirikgot it
06:18.30Shirik--> return debug.upvalue(function() end, 200)
06:18.31batbotShirik: > nil
06:19.06batrickdon't bother
06:19.14Shirikhaha
06:19.16batrickI'm 99.999999% sure that's not going to have any problems
06:19.24Shiriketurn (void *) *(auxl_upvalue(L, funcindex, n));
06:19.27ShirikI don't like that
06:19.31batrick=)
06:19.34Shirikauxl_upvalue can return NULL
06:19.38batrickI fixed it later
06:19.40batrickbut ya
06:19.40Shirikah
06:19.48batrickthat woulda seg faulted in my earlier version
06:20.07batrickhttp://lua-users.org/lists/lua-l/2008-02/msg01205.html
06:20.08Anna^[lua-users.org] Re: Differentiating upvalues and sharing
06:20.27Shirikhaha
06:20.28Shiriknice ternary
06:20.42Shirikthough I think
06:20.53Shirikreturn u ? (void *) *u : u; // would be better
06:21.04Shiriku should already be in a register, you would be saving a little processing
06:21.08Shirikbut that's micro-optimization
06:21.16batrickit's really unnecessary
06:21.19Shirikit really is
06:21.34batrickregister declaration is only a good idea if the coimpiler is really fucking up
06:23.11ShirikThat's a nice little tool
06:23.16ShirikI like the function
06:27.39Shirikbtw
06:27.44Shirikhave you looked at my updater's code at all
06:27.46Shirikit's so ugly lol
06:28.21batrickfuck
06:28.30batrickcoffee house is close now
06:30.34Shirik?
06:31.55batrickcloses at 11 QQ
06:32.15Shirikoh :<
06:34.57batrickman
06:35.03batrickgcc does some odd stuff
06:35.12batrick<PROTECTED>
06:35.12batrick<PROTECTED>
06:35.14Shirikyeah like "Warning: No newline at end of file"
06:35.15Shirik@&#($#@4
06:35.18batrickwhat the hell is that
06:35.21Shirikis that the trinary?
06:35.26Shirikternary*
06:35.42batrickhuh/
06:35.46Shirikwhere is that from?
06:36.03Shirikoh god, fcmov
06:36.21ShirikThat is why I don't do x86 assembly
06:36.22Shirikright there
06:36.26Shirikbecause of that instruction
06:37.03batrickthat's not the instruction
06:37.07batrickinstruction is mov
06:37.15Shirikoh haha
06:37.17Shirikok
06:37.21Shirikbecause fcmov is an instruction
06:37.27Shirikand it confuses me every time I see it
06:37.48batrickso anyway
06:37.52ShirikOh hahahah
06:37.56ShirikWtf is that?
06:38.02ShirikNow I see why you were like "wtf"
06:38.08batrickI wanted to see what gcc would compile for that return u ? (void * ) u : u; code
06:38.12batrick<PROTECTED>
06:38.12batrick<PROTECTED>
06:38.12batrick<PROTECTED>
06:38.12batrick<PROTECTED>
06:38.13batrick<PROTECTED>
06:38.15batrick<PROTECTED>
06:38.17batrick<PROTECTED>
06:38.20batrick<PROTECTED>
06:38.22batrickthat's what it does
06:38.28batrickit knows it's never null :(
06:38.35batrickfucking clever aye
06:38.46batrickbut those two mov functions are whack
06:38.53ShirikI think that's hilarious
06:39.05Shiriklet me see how VS compiles it
06:39.35ShirikI know how VS typically does ternary operators
06:39.42Shirikit finds some common ground between the two and acts on it
06:41.04Shiriklike in b==4?5:6
06:41.16Shirikit would test b!=4, if so add one, then add 5
06:43.43batrickO shit
06:43.44Shirikgd it
06:43.47Shirikvisual studio inlined this
06:44.00batrickI forgot to dereference 'u'
06:44.07batrickthe new code looks much better haha
06:44.11Shirikuh
06:44.19Shirikoh right, you need to dereference it yeah
06:44.25Shirikoh haha
06:44.29Shirikso it was essentially "return u"
06:44.35Shirikgg.
06:45.11Shirik1>.\SemTest.cpp(27) : error C2100: illegal indirection
06:45.17Shirikreturn u ? (void * ) *u : u;
06:45.23Shirikbecause in C++ it's illegal to do that :P
06:46.07batrickya, things like that is why i don't like c++ =)
06:46.32batricktechnically there's nothing wrong with it
06:46.36batrickpretty stupid
06:46.42Shirikwow wtf are you doing VS
06:46.50Shirikbatrick: Makes sense to me :P
06:46.53Shirikvoid*s are evil anyway
06:46.56Shirik00000015 test esi,esi
06:46.57Shirik00000017 je 0000001E
06:46.58Shirik00000019 nop
06:46.59Shirik0000001a mov ebx,dword ptr [esi]
06:47.00Shirik0000001c jmp 00000020
06:47.01Shirik0000001e mov ebx,esi
06:47.01batrickShirik:
06:47.02Shirik00000020 mov edi,ebx
06:47.06batricko wait nvm
06:47.22ShirikI don't get the nop
06:47.36batrickthat is pretty fucking unreadable
06:48.10batrickmy only complaint with gcc thus far is this:
06:48.28batrick<PROTECTED>
06:48.38batrickthey should just give a fucking absolute address
06:48.44batrickor put a comment... SOMETHING
06:48.52ShirikVS is kind enough to actually tell you what things are
06:49.07Shirik(except in the above example, it gets confused because it's inlined)
06:49.35batricko
06:49.38batrickI'm a fuckign idiot
06:49.43batrickje     804836c <test+0x1e>
06:49.48batrick<PROTECTED>
06:49.53batrickthere's the absolute address
06:49.57batricklmfao
06:49.59Shirikgg.
06:50.11batrickI obsessed over the <test+0x1e> part :(
06:50.31Shirikanyway, I <3 68HCS12 assembly
06:50.34Shiriknone of this extra crap
06:50.43ShirikAND WE MOST CERTAINLY DO NOT PUT NOPS IN OUR CODE INTENTIONALLY
06:50.44batrickI'm doing some work on an fpga and ppc assembly
06:50.52batrick32 registers is too much for me >.>
06:50.55Shirikrofl
06:51.03ShirikI have one accumulator
06:51.05Shirikit's fun to work with
06:51.16Shirikwell actually I have two 8 bit accumulators, but they're combined into a single 16-bit one
06:51.19batrickthey have this count register in ppc
06:51.25batrickfor for loops
06:51.33batrickI really don't know why they even have it
06:51.39Shirikaccumulator D is A:B (A and B are 8 bit accumulators, D is a 16-bit accumulator)
06:51.44batrickunless there are some rediculous optimizations on it
06:51.50Shirikah we have a cool one like that too
06:51.54ShirikX
06:52.03Shirikand you can do something like "dbne X, address"
06:52.13Shirikand once X hits 0, it continues on (basically a decrementing loop)
06:52.42Shirikor iblt X, n, address
06:52.48Shirikfor a for loop going from initial value of X to n
06:52.57Shirikit's kinda nice
06:53.13Shirikthough X is actually an index register
06:53.22Shirikbut it's used for counting loops and has some nice opcodes for that as well
06:53.26batrickI dunno
06:53.32batrickalso ppc has this really annoying thing
06:53.40batrickit has 32 registers, r0 through r31
06:53.42Shirikdbne is very nice because it prevents race conditions naturally
06:53.43batrickproblem is
06:54.01batrickanything that does base addressing assumes when you put r0, to be 0x0 as the abse address
06:54.04Shiriksame with "bts"
06:54.04batrickit's so fuckign dumb.
06:54.16Shirikbts == mutex without an OS
06:54.22Shirikit's beautiful
06:54.53Shirikbts address; sets Z to 1 if it acquired the mutex at location address, 0 if it could not
06:55.07Shirikacquiring the mutex is (1) making sure it's 0, and (2) setting it to 1
06:55.16Shirikand since it's one instruction, no race conditions exist
06:55.23Shirikbecause it's atomic
06:56.14Shirikanyway
06:56.21ShirikI like your code batrick
06:56.30batrickthanks :)
06:57.09batrick"You know you're a computer engineer when you feel most assembly language doesn't warrant commenting"
06:57.24batrickimo
06:57.39batrickI had a professor grilling me for not commenting every line
06:57.53batrickbut it's fucking obvious what it does!
06:58.23batrickbbl
11:27.21Shirik--> f = loadstring(string.dump(debug.getlocal))
11:28.38Shirik--> setfenv(f, setmetatable({type = function() return "nil" end}, {__index = _G}); return debug.getlocal(f, 1)
11:28.38batbotShirik: @ [string " setfenv(f, setmetatable({type = function() return "nil" end}, ..."]:1: ')' expected near ';'
11:29.09Shirik--> setfenv(f, setmetatable({type = function() return "nil" end}, {__index = _G})); return debug.getlocal(f, 1)
11:29.09batbotShirik: @ ./sandbox.lua:106: bad argument #1 to 'getlocal' (number expected, got function)
11:30.15Shirik--> setfenv(f, setmetatable({type = function() return "nil" end}, {__index = _G})); return f(0, 1)
11:30.15batbotShirik: @ ./sandbox.lua:106: attempt to call upvalue 'getlocal' (a nil value)
11:30.43Shirikdamn, I lose the upvalues in the conversion
11:30.46ShirikCURSE YOU BATRICK
11:30.48ShirikI was so close
11:33.07Shirik--> f = loadstring(string.dump(debug.getfenv)); setfenv(f, setmetatable({}, {__index = _G}));
11:33.07batbotShirik: @ [string " f = loadstring(string.dump(debug.getfenv))..."]:1: unable to dump given function
11:36.01Shirik--> t = setmetatable({}, {__metatable = "foo"}) debug.setmetatable(t, {__metatable = "bar"}); return getmetatable(t)
11:36.01batbotShirik: > bar
11:36.50Shirikoh hey here's a bug, kinda useless one but it's there
11:37.07Shirik--> t = setmetatable({}, {__metatable = "foo"}); return debug.getmetatable(t)
11:37.07batbotShirik: > table: 0x8131b08
11:37.37Shirikoh you used debug.getmetatable boo
11:39.44Shirikbatrick: Ping
11:40.09batrickwut
11:40.20ShirikI would encourage you to not allow dumping of secure functions
11:40.37ShirikI haven't found a hole yet, but I'm sure it's only a matter of time. I need to find the right tool.
11:40.55batrickI dunno, i'll leave it for you to find for now
11:41.00batrick=)
11:41.12Shirikyou used too many upvalues ><
11:41.37ShirikThat's the problematic side effect for me
11:41.51Shirikthat, while dumping lets me remove upvalues.... it makes me remove ALL upvalues
11:43.05Shirik--> f = loadstring(string.dump(pcall))
11:43.11Shirik--> setfenv(f, {})
11:43.11batbotShirik: > function: 0x81833f0
11:43.32Shirik--> function foo() f(foo) end foo()
11:43.33batbotShirik: @ ./sandbox.lua:285: attempt to compare number with nil
11:44.05Shirik--> setfenv(f, {npcalls = -10000})
11:44.05batbotShirik: > function: 0x81833f0
11:44.12Shirik--> function foo() f(foo) end foo()
11:44.12batbotShirik: @ ./sandbox.lua:285: attempt to compare number with nil
11:44.49Shirik--> debug.getupvalue(foo, 1)
11:44.52Shirik--> debug.getupvalue(foo, 2)
11:44.54Shirik--> debug.getupvalue(foo, 3)
11:45.20Shirik--> debug.setupvalue(foo, 1, -100000)
11:45.30Shirik--> foo()
11:45.30batbotShirik: @ ./sandbox.lua:285: attempt to compare number with nil
11:46.08Shirik--> foo = function(...) local npcalls = -100000; loadstring(string.dump(pcall))(...) end
11:46.41Shirik--> foo = function(...) local npcalls = -100000; loadstring(string.dump(pcall))(...) setfenv(foo, setmetatable({}, {__index = _G}) end
11:46.41batbotShirik: @ [string " foo = function(...) local npcalls = -100000; loadstring(string..."]:1: ')' expected near 'end'
11:46.49Shirik--> foo = function(...) local npcalls = -100000; loadstring(string.dump(pcall))(...) setfenv(foo, setmetatable({}, {__index = _G})) end
11:47.03Shirik-- function bar() foo(bar) end
11:47.06Shirik--> function bar() foo(bar) end
11:47.11Shirik--> function bar() foo(bar) end bar()
11:47.11batbotShirik: @ ./sandbox.lua:285: attempt to compare number with nil
11:47.13Shirik#@*%#@
11:51.54Shirik--> for k,v in pairs(debug.getinfo(foo)) do print(k,v) end
11:51.54batbotShirik: nups  0what  Luafunc  function: 0x80e89c8lastlinedefined  1source   foo = function(...) local npcalls = -100000; loadstring(string.dump(pcall))(...) setfenv(foo, setmetatable({}, {__index = _G})) endcurrentline  -1namewhat  linedefined...(tldr)
12:03.08Shirik--> f = loadstring(string.dump(pcall))
12:03.29Shirik--> debug.getupvalue(f, 1)
12:03.29batbotShirik: > npcalls, nil
12:03.32Shirik--> debug.getupvalue(f, 2)
12:03.32batbotShirik: > nmpcalls, nil
12:03.58batrick--> debug.getupvalue(f, 3)
12:03.58batbotbatrick: > lpcall, nil
12:04.06batrickthat's what you need and you'll never find it!
12:04.07batrick:P
12:04.11batricknight
12:05.34Shirik--> debug.setupvalue(f, 1, -10000); debug.setupvalue(nmpcalls, f); debug.setupvalue(lpcall, pcall);
12:05.34batbotShirik: @ ./sandbox.lua:160: bad argument #2 to 'setupvalue' (number expected, got function)
12:05.50Shirik--> debug.setupvalue(f, 1, -10000); debug.setupvalue(f, 2, f); debug.setupvalue(f, 3, pcall);
12:06.12Shirik--> function foo() f(pcall, foo) end
12:06.15Shirik--> foo()
12:06.21Shirik--> return foo()
12:06.38Shirik--> function foo() local s, e = f(pcall, foo) end; return foo()
12:06.48Shirik--> "Hi"
12:06.48batbotShirik: > Hi
12:08.12Shirik--> debug.setupvalue(f, 2, function() end)
12:08.12batbotShirik: > nmpcalls
12:08.22Shirik--> debug.getupvalue(f, 1)
12:08.22batbotShirik: > npcalls, 11
12:08.30Shirik--> debug.setupvalue(f, -100000000)
12:08.43Shirik--> debug.setupvalue(f, 1, -10000000000)
12:08.43batbotShirik: > npcalls
12:09.02Shirik--> debug.setupvalue(f, pcall)
12:09.02batbotShirik: @ ./sandbox.lua:160: bad argument #2 to 'setupvalue' (number expected, got function)
12:09.06Shirik--> debug.setupvalue(f, 2,pcall)
12:09.06batbotShirik: > nmpcalls
12:09.11Shirik--> debug.setupvalue(f, 3,pcall)
12:09.11batbotShirik: > lpcall
12:09.17Shirik--> debug.setupvalue(f,2,function() end)
12:09.17batbotShirik: > nmpcalls
12:10.19Shirik--> function foo() debug.setupvalue(f, -10000000000); local s,e = f(pcall, foo) return s,e; end
12:10.22Shirik--> foo()
12:10.22batbotShirik: > nil, nil
12:10.44Shirik--> debug.getupvalue(f, 1)
12:10.44batbotShirik: > npcalls, -9999999994
12:14.06Shirik--> function test() end; function foo() local s, e = pcall(test); if not s then pcall(foo) else foo(); end
12:14.06batbotShirik: @ [string " function test() end; function foo() local s, e = pcall(test); ..."]:1: 'end' expected near '<eof>'
12:14.11Shirik--> function test() end; function foo() local s, e = pcall(test); if not s then pcall(foo) else foo(); end end foo()
12:20.30Shirik--> foo = loadstring(string.dump(debug.getupvalue))
12:20.54Shirik--> for x = 1, debug.getinfo(foo).nups print(debug.getupvalue(foo, x)) end
12:20.54batbotShirik: @ [string " for x = 1, debug.getinfo(foo).nups print(debug.getupvalue(foo,..."]:1: 'do' expected near 'print'
12:20.59Shirik--> for x = 1, debug.getinfo(foo).nups do print(debug.getupvalue(foo, x)) end
12:20.59batbotShirik: securef  nilgetupvalue  nil
12:23.52Shirik--> setfenv("0", {})
12:23.58Shirik--> setfenv("0", {}) print("Foo")
12:23.58batbotShirik: Foo
12:24.02Shirik--> setfenv("1", {}) print("Foo")
12:24.02batbotShirik: Foo
12:24.06Shirik--> setfenv("-1", {}) print("Foo")
12:24.06batbotShirik: @ ./sandbox.lua:322: attempt to call global 'type' (a nil value)
12:26.39Shirik--> setfenv("-1", setmetatable({type = function() return "nil" end}, {__index = _G})) return debug.getupvalue(pcall, 1)
12:26.40batbotShirik: @ ./sandbox.lua:322: attempt to call global 'type' (a nil value)
12:26.46Shirik--> print("test")
12:26.46batbotShirik: test
12:27.01Shirik--> setfenv("-1", setmetatable({type = function() return "number" end}, {__index = _G})) return debug.getupvalue(pcall, 1)
12:27.02batbotShirik: @ ./sandbox.lua:322: attempt to call global 'type' (a nil value)
12:28.00Shirik--> setfenv("-1", setmetatable({type = function() return "number" end}, {__index = _G})) function reset() debug.setupvalue(pcall, 1, -100000); end; function foo() reset(); pcall(foo) end; foo()
12:28.00batbotShirik: @ ./sandbox.lua:322: attempt to call global 'type' (a nil value)
12:28.08Shirik--> setfenv("-2", setmetatable({type = function() return "number" end}, {__index = _G})) function reset() debug.setupvalue(pcall, 1, -100000); end; function foo() reset(); pcall(foo) end; foo()
12:28.08batbotShirik: @ ./sandbox.lua:322: attempt to call global 'type' (a nil value)
12:29.01Shirik--> setfenv(1, {})
12:29.01batbotShirik: @ ./sandbox.lua:322: attempt to call global 'type' (a nil value)
12:29.40Shirik--> getfenv(1)
12:29.40batbotShirik: > table: 0x8092828
12:29.44Shirik--> getfenv(0)
12:29.45batbotShirik: > table: 0x8092828
12:29.50Shirik--> setfenv(1, {})
12:29.51batbotShirik: @ ./sandbox.lua:322: attempt to call global 'type' (a nil value)
12:30.16Shirik--> setfenv(1, {type=4})
12:30.16batbotShirik: @ ./sandbox.lua:322: attempt to call global 'type' (a nil value)
12:30.24Shirik--> setfenv(2, {type=4})
12:30.24batbotShirik: @ ./sandbox.lua:322: attempt to call global 'type' (a nil value)
12:30.28Shirik--> setfenv(3, {type=4})
12:30.28batbotShirik: @ ./sandbox.lua:322: attempt to call global 'type' (a nil value)
12:30.31Shirik--> setfenv(-1, {type=4})
12:30.31batbotShirik: @ ./sandbox.lua:322: attempt to call global 'type' (a nil value)
12:30.44Shirik--> newenv()
12:30.50Shirik--> setfenv(1, {})
12:30.50batbotShirik: @ ./sandbox.lua:322: attempt to call global 'type' (a nil value)
12:31.45Shirik--> function foo() end; setfenv(foo, {})
12:31.45batbotShirik: @ ./sandbox.lua:322: attempt to call global 'type' (a nil value)
12:33.14Shirik--> getfenv(setfenv)
12:33.14batbotShirik: > table: 0x81957b8
12:33.22Shirik--> for k,v in pairs(getfenv) do print(k,v) end
12:33.22batbotShirik: @ [string " for k,v in pairs(getfenv) do print(k,v) en..."]:1: bad argument #1 to 'pairs' (table expected, got function)
12:33.32Shirik--> for k,v in pairs(getfenv(setfenv)) do print(k,v) end
12:33.43Shirik--> for k,v in pairs(getfenv(debug.setfenv)) do print(k,v) end
12:33.43batbotShirik: foo  function: 0x816e3c0string  table: 0x8106668xpcall  function: 0x8130430color  function: 0x812b8b8tostring  function: 0x80ff708_VERSION  Lua 5.1os  table: 0x8105828unpack  function: 0x808cbb8points  function: 0x80e4d78getfenv  fun...(tldr)
12:34.07Shirikdebug.setfenv(setfenv, getfenv(debug.setfenv))
12:34.09Shirik--> debug.setfenv(setfenv, getfenv(debug.setfenv))
12:34.09batbotShirik: @ cannot change secure functions environment
12:36.13Shirik--> debug.setfenv("-1", setmetatable({type = function() return "nil" end}, {__index = _G}))
12:36.13batbotShirik: @ ./sandbox.lua:80: 'setfenv' cannot change environment of given object
12:36.24Shirik--> debug.setfenv("-2", setmetatable({type = function() return "nil" end}, {__index = _G}))
12:36.24batbotShirik: @ ./sandbox.lua:80: 'setfenv' cannot change environment of given object
12:37.02Shirik--> debug.setfenv("0", setmetatable({type = function() return "nil" end}, {__index = _G}))
12:37.02batbotShirik: @ ./sandbox.lua:80: 'setfenv' cannot change environment of given object
12:39.47Shirik--> getfenv(setfenv).type = function() return "nil" end
12:39.57Shirik--> setfenv(1, {})
12:39.57batbotShirik: > function: 0x81303f0
12:42.18Shirik--> setfenv("-2", setmetatable({type = function() return "nil" end}, {__index = _G})); function reset() debug.setupvalue(pcall,1, -10000) end; function foo() reset() pcall(foo) end; foo()
12:42.18batbotShirik: @ ./sandbox.lua:322: attempt to call global 'type' (a nil value)
12:42.32Shirik--> print("test")
12:42.32batbotShirik: test
12:42.45Shirik--> for k,v in pairs(getfenv(setfenv)) do print(k,v) end
12:43.18Shirik--> for k,v in pairs(getfenv(debug.setupvalue)) do print(k,v) end
12:43.18batbotShirik: foo  function: 0x816e3c0string  table: 0x8106668xpcall  function: 0x8130430color  function: 0x812b8b8tostring  function: 0x80ff708_VERSION  Lua 5.1os  table: 0x8105828unpack  function: 0x808cbb8points  function: 0x80e4d78getfenv  fun...(tldr)
12:44.01Shirik--> getfenv(debug.setupvalue).type = function() return "nil" end; function reset() debug.setupvalue(pcall,1, -10000) end; function foo() reset() pcall(foo) end; foo()
12:44.01batbotShirik: @ [string " getfenv(debug.setupvalue).type = function(..."]:1: cannot modify secure global variables
12:45.17Shirik--> return getfenv(setfenv).type()
12:45.17batbotShirik: @ [string " return getfenv(setfenv).type()"]:1: attempt to call field 'type' (a nil value)
12:45.30Shirik--> getfenv(setfenv).type = function() return "nil" end
12:45.36Shirik--> getfenv(setfenv).type()
12:45.37batbotShirik: > nil
12:46.16Shirik--> debug.setfenv("0", setmetatable({type = function() return "nil" end}, {__index = _G}));
12:46.16batbotShirik: @ ./sandbox.lua:80: 'setfenv' cannot change environment of given object
12:46.24Shirik--> setfenv("0", setmetatable({type = function() return "nil" end}, {__index = _G}));
12:46.29Shirik--> type()
12:46.29batbotShirik: @ [string "return  type()"]:1: bad argument #1 to 'type' (value expected)
12:46.34Shirik--> type("test")
12:46.34batbotShirik: > string
12:46.45Shirik--> setfenv("0", setmetatable({type = function() return "nil" end}, {__index = _G})); return type("test")
12:46.45batbotShirik: > string
12:47.10Shirik--> setfenv("-0", setmetatable({type = function() return "nil" end}, {__index = _G})); return type("test")
12:47.10batbotShirik: > string
12:47.47Shirik--> setfenv("-2", setmetatable({type = function() return "number" end}, {__index = _G})) function reset() debug.setupvalue(pcall, 1, -100000); end; function foo() reset(); pcall(foo) end; foo()
12:47.47batbotShirik: @ ./sandbox.lua:327: bad argument #1 to 'setfenv' (level must be non-negative)
12:48.44Shirik--> setfenv("0", {}); print(type)
12:48.44batbotShirik: function: 0x80e4860
12:48.59Shirik--> setfenv("-1", {}); print(type)
12:48.59batbotShirik: @ ./sandbox.lua:327: bad argument #1 to 'setfenv' (level must be non-negative)
12:49.18Shirik--> setfenv("1", {}); print(type)
12:49.18batbotShirik: function: 0x80e4860
12:49.23Shirik--> setfenv("-1", {}); print(type)
12:49.23batbotShirik: @ ./sandbox.lua:322: attempt to call global 'type' (a nil value)
12:49.53Shirikgetfenv(setfenv).type = function() return "nil" end
12:49.56Shirik--> getfenv(setfenv).type = function() return "nil" end
12:50.03Shirik--> getfenv(setfenv).type()
12:50.03batbotShirik: > nil
12:50.22Shirik--> type("string")
12:50.22batbotShirik: > string
12:50.52Shirik--> function foo() return type("foo"); end; setfenv(foo, getfenv(setfenv)) foo()
12:50.56Shirik--> function foo() return type("foo"); end; setfenv(foo, getfenv(setfenv)) return foo()
12:50.56batbotShirik: > nil
12:56.22Shirik--> setfenv(0, {})
12:56.27Shirik--> return print;
12:56.27batbotShirik: > function: 0x8130308
12:56.36Shirik--> setfenv(-1, {})
12:56.36batbotShirik: @ ./sandbox.lua:327: bad argument #1 to 'setfenv' (level must be non-negative)
12:58.16Shirik--> setfenv("0", setmetatable({type = function() return "nil" end}, {__index = _G}))
12:58.22Shirik--> print(type)
12:58.22batbotShirik: function: 0x80e4860
12:58.28Shirik--> type("test")
12:58.28batbotShirik: > string
12:59.00Shirik--> setfenv("-1", setmetatable({type = function() return "nil" end}, {__index = _G})); print(type("test"))
12:59.00batbotShirik: @ ./sandbox.lua:327: bad argument #1 to 'setfenv' (level must be non-negative)
12:59.06Shirik--> setfenv("0", setmetatable({type = function() return "nil" end}, {__index = _G})); print(type("test"))
12:59.06batbotShirik: string
12:59.18Shirik--> getfenv(setfenv).type()
12:59.18batbotShirik: > nil
13:03.16Shirik--> return debug.getlocal("0", 1)
13:03.16batbotShirik: > (*temporary), 0
13:03.19Shirik--> return debug.getlocal("0", 2)
13:03.19batbotShirik: > (*temporary), 2
13:03.39Shirik--> for x=1,20 do print(debug.getlocal("0", x)) end
13:03.39batbotShirik: (*temporary)  0(*temporary)  2(*temporary)  nilnilnilnilnilnilnilnilnilnilnilnilnilnilnilnilnilnil
13:09.38Shirik--> for k,v in pairs(getfenv(3)) do print(k,v) end
13:09.38batbotShirik: @ [string " for k,v in pairs(getfenv(3)) do print(k,v)..."]:1: bad argument #1 to 'getfenv' (invalid level)
13:09.43Shirik--> for k,v in pairs(getfenv(2)) do print(k,v) end
13:09.44batbotShirik: @ [string " for k,v in pairs(getfenv(2)) do print(k,v)..."]:1: bad argument #1 to 'getfenv' (invalid level)
13:09.48Shirik--> for k,v in pairs(getfenv("2")) do print(k,v) end
13:09.48batbotShirik: @ [string " for k,v in pairs(getfenv("2")) do print(k,..."]:1: bad argument #1 to 'getfenv' (invalid level)
13:09.53Shirik--> for k,v in pairs(getfenv(1)) do print(k,v) end
13:09.53batbotShirik: foo  function: 0x80ec458string  table: 0x8106668xpcall  function: 0x8130430color  function: 0x812b8b8tostring  function: 0x80ff708_VERSION  Lua 5.1os  table: 0x8105828unpack  function: 0x808cbb8points  function: 0x80e4d78getfenv  fun...(tldr)
13:11.00Shirik--> for k,v in pairs(getfenv("-1")) do print(k,v) end
13:11.00batbotShirik: @ [string " for k,v in pairs(getfenv("-1")) do print(k..."]:1: bad argument #1 to 'getfenv' (level must be non-negative)
13:11.35Shirik--> setfenv("0", {type = function() return "nil" end})
13:11.41Shirik-->print(4)
13:11.41batbotShirik: 4
13:11.50Shirik--> setfenv("0", {type = function() return "nil" end}) print(4)
13:11.50batbotShirik: 4
13:11.57Shirik--> setfenv(0, {type = function() return "nil" end}) print(4)
13:11.57batbotShirik: 4
13:12.04Shirik--> setfenv(1, {type = function() return "nil" end}) print(4)
13:12.04batbotShirik: 4
13:12.09Shirik--> setfenv(2, {type = function() return "nil" end}) print(4)
13:12.09batbotShirik: @ [string " setfenv(2, {type = function() return "nil"..."]:1: attempt to call global 'print' (a nil value)
13:12.19Shirik--> setfenv(3, {type = function() return "nil" end}) print(4)
13:12.19batbotShirik: @ ./sandbox.lua:327: bad argument #1 to 'setfenv' (invalid level)
13:13.00Shirik--> for k,v in pairs(debug.getinfo(2)) do print(k,v," ")
13:13.01batbotShirik: @ [string " for k,v in pairs(debug.getinfo(2)) do print(k,v," ")"]:1: 'end' expected near '<eof>'
13:13.03Shirik--> for k,v in pairs(debug.getinfo(2)) do print(k,v," ") end
13:13.03batbotShirik: @ [string " for k,v in pairs(debug.getinfo(2)) do prin..."]:1: bad argument #1 to 'pairs' (table expected, got nil)
13:13.12Shirik--> for k,v in pairs(debug.getinfo(1)) do print(k,v," ") end
13:13.12batbotShirik: nups  0   what  main   func  function: 0x81385f0   lastlinedefined  0   source   for k,v in pairs(debug.getinfo(1)) do print(k,v," ") end   currentline  1   namewhat     linedefined  0   short_src  [string " for k,v in pairs(debug.get...(tldr)
13:16.03Shirik--> getfenv(setfenv).type()
13:16.04batbotShirik: > nil
13:17.34Shirik--> setfenv(debug.getupvalue, getfenv(setfenv))
13:17.34batbotShirik: @ ./sandbox.lua:325: attempt to call global 'error' (a nil value)
13:18.02Shirik--> getfenv(setfenv).error = function(s) error(s) end
13:18.06Shirik--> setfenv(debug.getupvalue, getfenv(setfenv))
13:18.07batbotShirik: @ [string " getfenv(setfenv).error = function(s) error..."]:1: cannot change secure functions environment
13:18.25Shirik--> setfenv(debug.getupvalue, getfenv(setfenv))
13:18.25batbotShirik: @ [string " getfenv(setfenv).error = function(s) error..."]:1: cannot change secure functions environment
13:18.40Shirikheh...
13:18.42Shirikokay...
13:18.54Shirik--> debug.getupvalue(pcall, 1)
13:18.54batbotShirik: @ cannot access secure functions' upvalues
13:24.22Shirik--> setfenv()
13:24.22batbotShirik: @ ./sandbox.lua:327: bad argument #2 to 'setfenv' (table expected, got nil)
13:24.32Shirik--> setfenv(1)
13:24.32batbotShirik: @ ./sandbox.lua:327: bad argument #2 to 'setfenv' (table expected, got nil)
13:24.35Shirik--> setfenv(2)
13:24.35batbotShirik: @ ./sandbox.lua:327: bad argument #2 to 'setfenv' (table expected, got nil)
13:24.40Shirik--> setfenv(function() end)
13:24.40batbotShirik: @ ./sandbox.lua:327: bad argument #2 to 'setfenv' (table expected, got nil)
13:24.49Shirik--> setfenv(pcall)
13:24.49batbotShirik: @ [string " getfenv(setfenv).error = function(s) error..."]:1: cannot change secure functions environment
13:29.32Shirik--> pcall(debug.getlocal, "1", 1)
13:29.32batbotShirik: > true, thread, 1
13:29.38Shirik--> pcall(debug.getlocal, "2", 1)
13:29.38batbotShirik: > true, nil
13:29.46Shirik--> pcall(debug.getlocal, "3", 1)
13:29.46batbotShirik: > true, arg, nil
13:29.54Shirik--> pcall(debug.getlocal, "3", 2)
13:29.54batbotShirik: > true, (*temporary), function: 0x80cec98
13:29.56Shirik--> pcall(debug.getlocal, "3", 3)
13:29.56batbotShirik: > true, nil
13:29.59Shirik--> pcall(debug.getlocal, "3", 4)
13:29.59batbotShirik: > true, nil
13:30.08Shirik--> pcall(debug.getlocal, "2",1)
13:30.08batbotShirik: > true, nil
13:30.11Shirik--> pcall(debug.getlocal, "2",2)
13:30.11batbotShirik: > true, nil
13:30.15Shirik--> pcall(debug.getlocal, "1",2)
13:30.16batbotShirik: > true, level, 2
13:30.19Shirik--> pcall(debug.getlocal, "1",3)
13:30.19batbotShirik: > true, lcl, nil
13:31.58Shirik--> pcall(debug.getlocal, "0",1)
13:31.59batbotShirik: > true, (*temporary), 0
13:32.03Shirik--> pcall(debug.getlocal, "0",2)
13:32.03batbotShirik: > true, (*temporary), 2
13:32.05Shirik--> pcall(debug.getlocal, "0",3)
13:32.05batbotShirik: > true, (*temporary), nil
13:36.03Shirik--> foo = select(3,pcall(debug.getlocal, "3",1)); foo(foo)
13:36.04batbotShirik: @ [string " foo = select(3,pcall(debug.getlocal, "3",1..."]:1: attempt to call global 'foo' (a nil value)
13:36.14Shirik--> foo = select(3,pcall(debug.getlocal, "3",2)); foo(foo)
13:36.20Shirik--> foo = select(3,pcall(debug.getlocal, "3",2)); foo(foo) print("OK")
13:36.21batbotShirik: OK
13:36.49Shirik--> function foo() select(3,pcall(debug.getlocal, "3",2))(foo) end foo()
13:37.33Shirik--> local pcall = select(3, pcall(debug.getlocal, "3", 2)); function foo() pcall(foo) end foo()
13:38.52Shirik--> pcall(debug.getlocal("4", 1)
13:38.52batbotShirik: @ [string " pcall(debug.getlocal("4", 1)"]:1: ')' expected near '<eof>'
13:38.56Shirik--> pcall(debug.getlocal("4", 1))
13:38.57batbotShirik: @ ./sandbox.lua:106: bad argument #1 to 'getlocal' (level out of range)
13:39.04Shirik--> pcall(debug.getlocal("3", 1))
13:39.04batbotShirik: @ ./sandbox.lua:106: bad argument #1 to 'getlocal' (level out of range)
13:39.12Shirik--> pcall(debug.getlocal, "4", 1)
13:39.13batbotShirik: > true, nil
13:39.15Shirik--> pcall(debug.getlocal, "4", 2)
13:39.16batbotShirik: > true, nil
13:39.24Shirik--> pcall(debug.getlocal, "5", 1)
13:39.24batbotShirik: > false, ./sandbox.lua:106: bad argument #1 to 'getlocal' (level out of range)
13:39.27Shirik--> pcall(debug.getlocal, "3", 1)
13:39.27batbotShirik: > true, arg, nil
13:39.44Shirik--> pcall(debug.getlocal, "2", 1)
13:39.45batbotShirik: > true, nil
13:39.47Shirik--> pcall(debug.getlocal, "2", 2)
13:39.48batbotShirik: > true, nil
13:43.56Shirik--> co = coroutine.create(pcall);
13:43.59Shirik--> print(co)
13:43.59batbotShirik: thread: 0x80d3b00
13:44.03Shirik--> debug.getinfo(co)
13:44.03batbotShirik: @ [string "return  debug.getinfo(co)"]:1: bad argument #2 to 'getinfo' (function or level expected)
13:47.21Shirik--> co = coroutine.create(debug.setmetatable); return coroutine.resume(co, _G, {})
13:47.21batbotShirik: > false, cannot modify protected metatable
13:47.34Shirik--> debug.getlocal(co, "1", 1)
13:47.34batbotShirik: > object, table: 0x8092828
13:47.40Shirikheh.
13:48.00Shirik--> debug.getlocal(co, "1", 1).__protected = false;
13:48.00batbotShirik: @ [string " debug.getlocal(co, "1", 1).__protected = f..."]:1: attempt to index a string value
13:48.14Shirik--> select(2,debug.getlocal(co, "1", 1)).__protected = false;
13:48.26Shirik--> select(2,debug.getlocal(co, "1", 1)).__metatable = nil;
13:48.32Shirik--> getmetatable(_G)
13:48.32batbotShirik: > leave this alone
13:48.52Shirik--> debug.getmetatable(_G)
13:48.53batbotShirik: @ cannot access protected metatable
13:49.20Shirikwhoops
13:49.25Shirik--> debug.getlocal(co, "1", 3)
13:49.25batbotShirik: > m, table: 0x80dc9c8
13:49.29Shirikthere we are.
13:49.37Shirik--> select(2,debug.getlocal(co, "1", 3)).__protected = false;
13:49.44Shirik--> select(2,debug.getlocal(co, "1", 3)).__metatable = nil
13:50.03Shirik--> print(getmetatable(_G))
13:50.03batbotShirik: table: 0x80dc9c8
13:50.25Shirik--> getmetatable(_G).__metatable = "Shirik wins."
13:50.46Shirik--> select(2,debug.getlocal(co, "1", 3)).__metatable = nil
13:51.10Shirik--> print(getmetatable(_G).__index)
13:51.10batbotShirik: table: 0x80fee20
13:52.21Shirik--> getmetatable(_G).__index.type = function() return "nil" end
13:52.55Shirik--> debug.getupvalue(pcall, 1)
13:52.55batbotShirik: > npcalls, -4
13:52.59Shirikthere you are.
13:53.37Shirik--> function reset() debug.setupvalue(pcall, -100000) end; function foo() reset(); pcall(foo); end foo()
13:53.47Shirik--> function reset() debug.setupvalue(pcall, -100000) end; function foo() reset(); pcall(foo); end foo() print("OK!")
13:53.47batbotShirik: OK!
13:55.43Shirik--> function reset() debug.setupvalue(pcall, -100000) end; function foo() reset(); local s, e = pcall(foo); return s,e; end return foo();
13:55.43batbotShirik: > true, true
13:56.19Shirik--> function reset() debug.setupvalue(pcall, 1, -100000) end; function foo() reset(); pcall(foo); end foo()
13:57.51ShirikSorry for the spam in here :) batrick wanted me to check something since I warned him about it and he couldn't find it.
13:57.55ShirikTook me 2 hours but I found it :P
15:13.29*** join/#botpark eagle-101 (n=eagle@fullcircle/developer/eagle-101)
19:02.55*** join/#botpark The_Master (i=ttech@unaffiliated/ttech/bot/themaster)
19:25.55*** join/#botpark BS|Bot (n=nnscript@unaffiliated/brightsilence/bot/bsbot)
19:50.30RockerMONOhi
21:04.09*** join/#botpark batbot (n=batbot@c-68-35-67-18.hsd1.nm.comcast.net)
21:46.30*** join/#botpark batbot (n=batbot@c-68-35-67-18.hsd1.nm.comcast.net)
21:48.56*** join/#botpark wbot (n=wbot@unaffiliated/chuck/bot/wbot)
21:58.09*** join/#botpark eau (n=eagle@fullcircle/developer/eagle-101)
22:05.11*** join/#botpark wbot (n=wbot@unaffiliated/chuck/bot/wbot)
22:18.52*** join/#botpark RockerMONO (n=RockerMO@ip72-209-217-139.dc.dc.cox.net)
22:53.28*** join/#botpark catfacts (n=catfacts@fullcirclemagazine/developer/catfacts)
22:54.29Shirik--> debug.getlocal(co, "1", 1)
22:54.29batbotShirik: > a, nil
22:54.35Shirikgood batrick :)
22:54.49RockerMONO--> debug.getlocal(co, "1", 1)
22:54.49batbotRockerMONO: > a, nil
22:58.02RockerMONO--> debug.getlocal(co, "2", 1)
22:58.03batbotRockerMONO: @ ./sandbox.lua:97: bad argument #2 to 'getlocal' (level out of range)
22:58.12RockerMONO--> debug.getlocal(co, "1", 2)
22:58.13batbotRockerMONO: > nil
22:58.17RockerMONO--> debug.getlocal(co, "1", 54)
22:58.18batbotRockerMONO: > nil
22:58.22RockerMONO--> debug.getlocal(co, "1", 0)
22:58.23batbotRockerMONO: > nil
22:58.26RockerMONO--> debug.getlocal(co, "2", -1)
22:58.26batbotRockerMONO: @ ./sandbox.lua:97: bad argument #2 to 'getlocal' (level out of range)
22:58.30RockerMONO--> debug.getlocal(co, "1", -1)
22:58.31batbotRockerMONO: > nil
22:58.35RockerMONO--> debug.getlocal(co, "1", 1)
22:58.35batbotRockerMONO: > a, nil
22:58.47Shirikhaha
22:58.53RockerMONOlol
22:58.56RockerMONObrb
23:00.54RockerMONOback
23:00.58RockerMONOShirik: what *does* it do? =P
23:01.12Shirikgets a local :D
23:01.50Shirik--> co = coroutine.create(function() local a = 1; end); return debug.getlocal(co, "1", 1)
23:01.50batbotShirik: @ ./sandbox.lua:97: bad argument #2 to 'getlocal' (level out of range)
23:01.57Shirik--> co = coroutine.create(function() local a = 1; end); return debug.getlocal(co, "0", 1)
23:01.57batbotShirik: @ ./sandbox.lua:97: bad argument #2 to 'getlocal' (level out of range)
23:02.06Shirik--> co = coroutine.create(function() local a = 1; end); return debug.getlocal(co, 1, 1)
23:02.06batbotShirik: @ ./sandbox.lua:97: bad argument #2 to 'getlocal' (level out of range)
23:02.09Shirikthat's odd
23:02.12Shirik--> co = coroutine.create(function() local a = 1; end); return debug.getlocal(co, 0, 1)
23:02.13batbotShirik: @ ./sandbox.lua:97: bad argument #2 to 'getlocal' (level out of range)
23:02.17Shirik--> co = coroutine.create(function() local a = 1; end); return debug.getlocal(co, -1, 1)
23:02.17batbotShirik: > (*temporary), function: 0x80f73e0
23:02.23Shirik--> co = coroutine.create(function() local a = 1; end); return debug.getlocal(co, -1, 2)
23:02.23batbotShirik: > nil
23:02.46Shirikok well
23:02.58Shirik--> local a = 1; return debug.getlocal(0, 1)
23:02.59batbotShirik: > (*temporary), 0
23:03.01Shirik--> local a = 1; return debug.getlocal(1, 1)
23:03.01batbotShirik: > nil
23:03.05Shirik--> local a = 1; return debug.getlocal(0, 2)
23:03.05batbotShirik: > (*temporary), 2
23:03.07Shirik--> local a = 1; return debug.getlocal(0, 3)
23:03.07batbotShirik: > (*temporary), nil
23:03.09Shirik--> local a = 1; return debug.getlocal(0, 4)
23:03.09batbotShirik: > nil
23:03.14Shirik....
23:03.21ShirikI give up, I think I'm too tired and I need to take a shower
23:03.30Shirikbut basically, RockerMONO, it gets a variable that you're not supposed to have access to
23:03.34Shirikreasoning is for things like debugging
23:03.36RockerMONOlol
23:03.44Shirikchecking a variable (or setting a variable) that's out of scope
23:04.01Shirikunfortunately batrick didn't protect it quite right, and I modified variables in his sandbox
23:04.16Shirikthese modified variables allowed me to then segfault by resetting the limit on call
23:04.19Shirik(stack overflow)
23:05.24Shirikanyway I have to go take a shower and head out
23:05.25Shiriktake care
23:05.30RockerMONOcya

Generated by irclog2html.pl Modified by Tim Riker to work with infobot.