2015 DEFCON 23 - Chris Domas - Repsych: Psychological Warfare in Reverse Engineering https://www.youtube.com/watch?v=HlUe0TUHOIc

And a paper by him: https://www.cl.cam.ac.uk/~sd601/papers/mov.pdf

https://kirschju.re/demov

http://cr.yp.to/qhasm/20050129-portable.txt

Repo includes a good set of slides: https://github.com/xoreaxeaxeax/movfuscator/blob/master/slid...

Indirect memory accesses serve for conditional execution

Here's the macro for boolean and: https://github.com/xoreaxeaxeax/movfuscator/blob/master/poc/...

If you expanded your question to hardware in the computer, then yes you can easily cause damage. BIOS’s can be flashed to make the system unbootable or overclock/stress components. Back in the bad old days of Linux, you could easily damage your monitor with the wrong xorg.conf settings.

Your question got me thinking what’s the MTBF of modern CPUs? My google-fu failed me finding any reliable source of this, but I’m sure it’s long, 10+ years.

You could also damage a floppy drive making it read/write, for many times, few sectors outer the common limits. Being there, done that.

But after so many discussions on online forums that it was impossible to cause physical damage using software (other than overwriting firmwares), I gave up and kept this (and the asm code) deep inside my heart.

And bringing it up still gives me chills that those discussions will return right now...

http://www.catb.org/jargon/html/W/walking-drives.html

Probably decreasing, and soon not much longer than warranty period... the transistors have gotten so small that they're on the threshold of barely working even in normal operation.

As for older CPUs, they could definitely last many decades because of the lower stresses of larger process sizes, and they were designed with much higher margins.

(IANAEE)

Back when a certain kind of line printer was commonplace (has a circulating ribbon with the typeface repeated, and n hammers in a line going across the entire width) programmers could sabotage the printer by printing the pattern on the ribbon. This would cause all of the hammers to fire at once, which the machine wasn't designed to withstand.

I've also heard of monitors being broken by having the speaker output the resonant frequency of the glass cover. However, I can't vouch for this one.

* Modem

* Dot matrix printer

* DEC Line printer

    > Back in the bad old days of Linux, you could
    > easily damage your monitor with the wrong
    > xorg.conf settings.

It's so long that probably nobody bothers to measure it.

So it turns out that if a transistor is kept on continuously its threshold voltage gradually increases (Negative-Bias Temperature-Instability (NBTI)), increasing the switching delay. This attack targets transistors along the critical path, increasing the path's delay until it exceeds the allowed tolerance (guardband). Turning the transistor off "heals" it; as a workaround they suggest periodically executing certain nop instructions to ensure critical path transistors spend at least 0.05% of their time turned off. They perform simulations using models of 45nm high-k PMOS transistors to produce their results. A good quote about processor reliability:

   Guardbanding  is  the  current  industrial  practice  to  cope  with  transistor  aging  and
   voltage droops [Agarwal et al. 2007]. It entails slowing down the clock frequency (i.e.,
   adding timing margin during design) based on the worst degradation the transistors
   might experience during their lifetime. The guardbands ensure that enough current
   passes through the processor to keep it above the threshold voltage and in turn ensure
   that the processor functionality is intact for an average period of 5 to 7 years [Tiwari
   and Torrellas 2008]. However, inserting wide guardbands degrades performance and
   increases energy consumption. Hence, processor design companies usually have small
   guardbands, typically 10% [Agarwal et al. 2007]. However, the MAGIC-based attack
   can deteriorate the critical path by 11% and cause erroneous results in 1 month.

[1] https://www.researchgate.net/profile/Naghmeh_Karimi/publicat...

http://x86.renejeschke.de/html/file_module_x86_id_176.html

I know! Lookup tables!

Further reading - http://www.cl.cam.ac.uk/%7Esd601/papers/mov.pdf

I see your point though. I'm not very experienced on this and I'm sure some patterns can easily be recovered, but until someone goes through the effort it's still a considerable effort compared to being able to read the program normally, and even when someone does it's questionable whether the original can be recovered with some simple 1:1 translation.

https://github.com/jbangert/trapcc

Not knowing anything about GPU programming, isn't it similar to Movfuscator in some respects? Both branches are taken and run simultaneously?

One instruction set computers (OISC) are more than a joke, I suppose, but I didn't dig far into theoretical computer science and can't say, what's important about them.

I read a comment the other day, that stipulated neurons would be akin to massively parallel single instruction computers.

They're for highly parallel programable SIMD number crunching. The OISC would allow for easily fabricating a whole heaping bunch of ALUs.

At about 7 minutes in he is chatting about it but all is a good watch - could only find the YT link sorry