TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with...
Transcript of TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with...
![Page 1: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/1.jpg)
1
TOP SECRET
CONFIDENTIAL
![Page 2: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/2.jpg)
2
TOP SECRET
WITCHCRAFT SECRETS
CONFIDENTIAL
![Page 3: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/3.jpg)
Witchcraft Secrets
...from a reverse-engineer
Alyssa Rosenzweig
![Page 4: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/4.jpg)
4
Starswirl’s First Law
Magic can neither be created nor destroyed…
![Page 5: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/5.jpg)
5
Starswirl’s First Law
Magic can neither be created nor destroyed…
….only transformed.
![Page 6: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/6.jpg)
6
Starswirl’s First Law
![Page 7: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/7.jpg)
7
Starswirl’s First Law
![Page 8: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/8.jpg)
8
Starswirl’s First Law
![Page 9: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/9.jpg)
9
Witchcraft
![Page 10: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/10.jpg)
10
OPEN SORCERY
![Page 11: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/11.jpg)
11
STEPS
![Page 12: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/12.jpg)
12
Steps - trivial
● Write a test● Trace baseline input● Trace with single “interesting” change● Diff the traces● Single change? Lucky.
![Page 13: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/13.jpg)
13
Spelling convention
![Page 14: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/14.jpg)
14
Steps - nontrivial
● Write a test● Trace many inputs● Record results● Find a pattern● Deduce f● Rewrite for
![Page 15: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/15.jpg)
15
Steps - nontrivial
● Write a test● Trace many inputs● Record results● Find a pattern● Deduce f● Rewrite for
![Page 16: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/16.jpg)
16
TRACING
![Page 17: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/17.jpg)
17
![Page 18: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/18.jpg)
18
![Page 19: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/19.jpg)
19
Steps - nontrivial
● Write a test● Trace many inputs● Record results● Find a pattern● Deduce f● Rewrite for
![Page 20: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/20.jpg)
20
TECHNIQUES
![Page 21: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/21.jpg)
21
Waiting
● Cuss on IRC.● Wait for a draconequus to whisper f to you.
Works 20% of the time
![Page 22: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/22.jpg)
22
Law of Parsimaney● Simple f are more likely than complex f.
● Simple for the hardware, not for you!
● Think like a hardware designer (gate count).
![Page 23: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/23.jpg)
23
Properties● Alignment?
● Monotonicity?
● Linear? Almost linear?
● Bitwise complements?
● Powers of two?
![Page 24: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/24.jpg)
24
Information entropy● Input entropy vs output bit count
● Equal entropy: just shuffling
● More in input: incomplete encoding (pigeonhole)
● More in output: incomplete input (Occam's Razor)
![Page 25: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/25.jpg)
25
Graphs
![Page 26: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/26.jpg)
26
Calculus● Discrete derivatives (backwards differencing)
● Sometimes modeling f’ is easier than f.
● Integrate f’ to recover f (summation)
Useful for near-linear f
![Page 27: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/27.jpg)
27
Classes of f● What kind of function could satisfy the properties?
● Closed-form algebraic?
● Bitwise manipulation?
● Try some.
![Page 28: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/28.jpg)
28
Purpose● Every field has a reason for being.
● Your job: figure out why.
![Page 29: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/29.jpg)
29
Purpose
struct texture {unsigned width;unsigned unknown;unsigned depth;...
![Page 30: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/30.jpg)
30
Purpose
struct texture {unsigned width;unsigned height;unsigned depth;...
![Page 31: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/31.jpg)
31
Purpose
Proximate fields have proximate purposes.
![Page 32: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/32.jpg)
32
Info drops● Know the hardware, know the purpose.
● Conference slides.
● Vendor blogs.
● Code drops (kernel)
● Google is your friend.
![Page 33: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/33.jpg)
33
XDC Hallway Track
[redacted]
![Page 34: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/34.jpg)
34
If all else fails...● Move on.
● Lots of seaponies in the sea.
![Page 35: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/35.jpg)
35
EXAMPLE
![Page 36: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/36.jpg)
36
1if (vColor.x < 0.5) discard;
flt r31.w, r0.x, #0.5br.discard.true
![Page 37: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/37.jpg)
37
2 - ANDif (vColor.x < 0.5 && vColor.y < 0.75) discard;
flt r31.w, r0.y, #0.75flt r31.w, r0.x, #0.5brx.discard.unk8888
![Page 38: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/38.jpg)
38
2 - ORif (vColor.x < 0.5 || vColor.y < 0.75) discard;
flt r31.w, r0.y, #0.75flt r31.w, r0.x, #0.5brx.discard.unkEEEE
![Page 39: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/39.jpg)
39
2 - NANDif (!(vColor.x < 0.5 && vColor.y < 0.75)) discard;
flt r31.w, r0.y, #0.75flt r31.w, r0.x, #0.5brx.discard.unk1111
![Page 40: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/40.jpg)
40
2 - NORif (!(vColor.x < 0.5 || vColor.y < 0.75)) discard;
flt r31.w, r0.y, #0.75flt r31.w, r0.x, #0.5brx.discard.unk7777
![Page 41: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/41.jpg)
41
Expression Code
(A && B) 8888
(A || B) EEEE
!(A && B) 7777
!(A || B) 1111
![Page 42: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/42.jpg)
42
3?if (vColor.x < 0.5 && vColor.y < 0.75 &&
vColor.z == 1.0) discard;
flt r31.x, r0.y, #0.75feq r31.w, r0.z, #1flt r31.w, r0.x, #0.5brx.discard.unk8080
![Page 43: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/43.jpg)
43
4?if (vColor.x < 0.5 && vColor.y < 0.75 &&
vColor.z == 1.0 && vColor.w == 0.0) discard;
feq r31.w, r0.z, #1feq r31.w, r0.w, #0flt r31.x, r0.y, #0.75flt r31.w, r0.x, #0.5brx.discard.unk8000
![Page 44: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/44.jpg)
44
5?if (vColor.x < 0.5 && vColor.y < 0.75 &&
vColor.z == 1.0 && vColor.w == 0.0 && vColor.x > vColor.y) discard;
...iand r31.w, r0.z, r0.wbrx.discard.unk8000
![Page 45: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/45.jpg)
45
Expression Code
(A && B) 8888
(A || B) EEEE
!(A && B) 7777
!(A || B) 1111
(A && B) && C 8080
(A && B) && C && D 8000
![Page 46: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/46.jpg)
46
Mathemagics
![Page 47: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/47.jpg)
47
Expression Code
(A && B) 8888
(A || B) EEEE
!(A && B) 7777
!(A || B) 1111
(A && B) && C 8080
(A && B) && C && D 8000
![Page 48: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/48.jpg)
48
Expression Code
(A && B) 8888
!(A && B) 7777
(A || B) EEEE
!(A || B) 1111
![Page 49: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/49.jpg)
49
Expression Code
(A && B) 8888
!(A && B) 7777
(A || B) EEEE
!(A || B) 1111
FFFF
FFFF
![Page 50: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/50.jpg)
50
Expression Code
(A && B) && C && D 8000
00000...001
00000...001
![Page 51: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/51.jpg)
51
Expression Code
(A && B) 8888
(A || B) EEEE
!(A && B) 7777
!(A || B) 1111
(A && B) && C 8080
(A && B) && C && D 8000
![Page 52: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/52.jpg)
52
LUT
![Page 53: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/53.jpg)
53
Thank you!
![Page 54: TOP SECRET - xdc2019.x.org · 12 Steps - trivial Write a test Trace baseline input Trace with single “interesting” change Diff the traces Single change? Lucky.](https://reader033.fdocuments.us/reader033/viewer/2022041506/5e24facf8da97c69033be165/html5/thumbnails/54.jpg)
54
TOP SECRET
CONFIDENTIAL