Detecting BAD code | The Coffeehouse

Minh
WOOH! WOOH!

I was listening to the weekly StackOverflow podcast, and they mentioned devs had a sort of a contest to see who can write the best Battleship ("you sank my battleship") AI... which lead me to think... hmmm.... a Battleship AI contest server -- where people can upload their AI DLL -- wouldn't be hard to write...

Although, I'm not sure if I could prevent people from writing

while (true);

and hang the server...

Or if their routine takes a real long time to execute...

Can you detect this by reflection? Or at least at runtime?

How would you attempt to?

joechung

http://en.wikipedia.org/wiki/Halting_problem

CannotResolveSymbol
{insert caption here}

You could set a fixed time limit, start a second thread, and kill the first if it exceeds the time limit. Or, if you don't want a specific time limit, use a watchdog timer of sorts (where the program has to reset it every x seconds or it will be stopped, similar to that used in many realtime systems.

Verifying that a given routine terminates (or completes in a certain amount of time) is an unsolved problem in CS, though.

Minh
WOOH! WOOH!

In reply to CannotResolveSymbol

#Nov 2nd @ 6:07 PM

a timer is a good idea... isn't there a state for a thread to indicate whether or not it's still running?

I'll look into code for this...

Bass
Channel 9, best used in moderation

The testing framework I use for C unit tests does this. All it does is fork each test as a seperate process and wait a configurable amount of seconds for the process to complete, if it doesn't it kills it and fails that test.

This might be a feature of NUnit too, so you might want to see if you can utilize that for your purposes. Actually I think it will work rather well.

blowdart
Peek-a-boo

In reply to CannotResolveSymbol

#Nov 2nd @ 6:07 PM

I've done this sort of thing for a system I've been writing.

However Thread.Abort is messy. So you then start looking at app domain setup/tear down for isolation and to stop memory leaks.

Then of course there's sandboxing. You will need to CAS sandbox the plugins so they don't start trying to access the file system. Which is a lot easier in 4.0 with the simple sandbox API.

figuerres
???

i forget the name but in the time of .net 1.0 / 1.1 there was a kind of game / sim that used .net and cas and was internet based.

it was in part a sample from microsoft of how you could sandbox stuff in .net and do a plugin system.

some name like ant farm seems like the name of it? not sure though.

look around, it let folks write dlls that other folks would load onto thier pc and run.

each pc that ran the software was part of a kind of network that all ran the game together.

Maddus Mattus
Do, or do not. There is no try. - Yoda

Just set a limit to the amount of IL instructions allowed per move.

Sven Groot
My name has 9 letters. Coincidence? I think not...

In reply to Maddus Mattus

#Nov 3rd @ 6:17 AM

while( true ) doesn't use a lot of instructions and will still hang the server.

Minh
WOOH! WOOH!

In reply to figuerres

#Nov 3rd @ 5:51 AM

It was called Terrarium and it was very cool... It has it's own client that visually shows you the bug DLLs that wandered onto your machine.

It was the effort of a handful of people, and they said they would release the source... but that never happened, as far as I know

rhm

Have a google for the presentations by the guy who was implementing .NET support in SecondLife. Random users can (or will be able to) upload assemblys for running on their servers. They have to deal with limiting memory allocation and CPU useage as well as the normal .NET facility of preventing harmful code execution. They additionally have the issue of needing to migrate running code between servers due to SecondLife's architecture. Because their grid servers run on Linux, it's implemented using Mono, but apparently they avoided modifying the runtime for the most part. Most of this is provided by re-writing the IL of the uploaded assemblies before they are loaded.

Maddus Mattus
Do, or do not. There is no try. - Yoda

In reply to Sven Groot

#Nov 3rd @ 6:39 AM

Till the IL instruction count is reached.

Any code that does not rely on the environment will utilize the CPU to 100%, so that is not the actual problem.

The problem is detecting rogue processes. So if you set a limit on the amount of instructions, rogue processes don't matter. It will "eat up" it's instruction count and terminate and lose the game.

blowdart
Peek-a-boo

In reply to Minh

#Nov 3rd @ 7:03 AM

This now makes me want to experiment with the new 4.0 sandbox API. Damn you!

Minh
WOOH! WOOH!

In reply to blowdart

#Nov 3rd @ 7:12 AM

I definitely don't want to require 4.0... but this makes me want to look at the API to see if I can steal some code. Damn you!

blowdart
Peek-a-boo

In reply to Minh

#Nov 3rd @ 7:21 AM

CAS sandboxes right now are a mess. Really confusing. You should be able to use 4.0 as the hosting platform, but use 2.0 assemblies as the plugin ...

Minh
WOOH! WOOH!

In reply to blowdart

#Nov 3rd @ 7:23 AM

Can I use 4.0 sandbox and run a 2.0 assembly under the real 2.0 runtime? (I'm guessing not)

figuerres
???

In reply to Minh

#Nov 3rd @ 7:03 AM

you mean you have not found this:

http://www.codeplex.com/terrarium2

??

Sven Groot
My name has 9 letters. Coincidence? I think not...

In reply to Maddus Mattus

#Nov 3rd @ 7:12 AM

How do you count the number of instructions executed? It's an interesting idea, I just don't know how to execute it in practice. And besides, the idea was to have something that would detect bad code before executing it.

blowdart
Peek-a-boo

In reply to Minh

#Nov 3rd @ 7:29 AM

Nope, it'd be under the 4.0 runtime. But for battleships where it's just move calculations what does that matter?

Minh
WOOH! WOOH!

In reply to figuerres

#Nov 3rd @ 7:32 AM

Gasp! I have been there... but apparently not in a while... DOWNLOADS! YES!

Minh
WOOH! WOOH!

In reply to blowdart

#Nov 3rd @ 7:50 AM

Probably won't matter...

But as a principle... Can I guarantee that there's an equivalence for ALL 1.1 calls under the 4.0 runtime?

rhm

In reply to Sven Groot

#Nov 3rd @ 7:41 AM

See my previous post in this thread. It's all been solved (with a performance penalty obviously).

blowdart
Peek-a-boo

In reply to Minh

#Nov 3rd @ 7:52 AM

Why would you want all calls? That's just dangerous *grin* Really you want a very limited API, a battleships AI only needs to have 3 entry points - ConfigureBoard, MakeAShot, TakeAShot. The AI doesn't need to render, or communicate beyond that.

Reduce the attack surface dear boy!