Hacking WinRAR for fun and profit
github.com
github.com
Now of course there may be exploitable vulnerabilities here, but just as in any other piece of software.
So no, just because this runs a VM doesn't mean it's intrinsically more dangerous than anything else. Basically just any program that takes input from the outside world (a PDF reader, an MP3 player, you name it) is vulnerable to attacks.
"There are several known bugs in the RarVM.
[redacted as some have security consequences]"
makes it seem quite likely that there are some ugly vulnerabilities.
I can understand why those who have used WinRAR for many years might keep using the .rar format out of habit even in 2012, but is there any other reason for anyone else to compress new files with .rar at this point? Sure, you might be able to shave a few more kilobytes off a large file, but small differences like that are becoming increasingly irrelevant compared to interoperability. Are there other technical advantages to the .rar format that other formats like .zip and .tar.gz lack?
Of course in the terminal world you could chain it all. But rar provide a convenient package of it all and with a gui. Zip files are painful to deal with when the system encoding is different from the one that created the archive.
So, a customer sends you a RAR file and it goes straight to the trash? You sound like a swell guy.
Where do you work?
That said, I do still use zip for compatibility 90% of the time - but I was only going to pay for one commercial archiver for Windows, and WinRar was it. Why pay for WinZip? (this was years ago, amortized cost is now less than pennies/day)
Of course you could ask why pay for software at all, but that's a different problem. I'm happy to pay someone for software that works better, does things that otherwise can't be done or would be tedious, or is a de-facto standard of some sort. Hence at one time or another I've paid for Adobe Creative Suite, Cubase, MS Office, VMWare Workstation, Rhino 3D, Autopano Pro, and others.
Almost everything you'd get on Usenet uses RAR, fwiw. I know Usenet is a dinosaur, but it's still a highly functioning one.
These are exactly the sort of stupid statements that make so many people frown on the HN community.
1. It's been years since anyone has emailed me an .rar attachment. In fact, I don't think I've had a legitimate .rar file in my Inbox since the turn of the millennium.
2. The last time I regularly opened .rar files was when I was into warez. Those things often contained malware.
3. As a result of 1) and 2), I would be very suspicious if somebody sent me an .rar file.
Of course, that's just my perception, so other people might associate the .rar extension with better things.
Let's say you're putting together WinRAR 4.5 and have a fancy new compression method you want to implement. .RAR files generated with Version 4.5 that use it, won't be compatible with earlier versions.
The way around this is to embed, in the .RAR file itself, a program (written in the WinRAR VM) to decompress the data using the new method. WinRAR 4.0 can just run this embedded program without knowing the precise details of the Version 4.5 algorithm.
So you get some of the advantages of a self-executable archive without the portability and security issues.
I think that WinRAR in particular implements a lot of pre-filters, which are things you run over the data before your main compression algorithm in order to make the data more compressible. This seems like a good use for such a VM - they're simple, less-speed-critical than your core compressor, and you can always write more of them.
Examples of prefilters are BCJ2 (http://en.wikipedia.org/wiki/7z#Pre-processing_filters) and the PNG image filters (http://www.w3.org/TR/PNG-Filters.html).
Now, if there's a security flaw, that's a different story. But it looks like the VM just gets to play around with memory and registers and doesn't get any libraries or IO, and doesn't rely on type safety for correctness -- which eliminates the typical sources of security holes in more complex VMs such as JVM. And if you don't need great performance, then you can put bounds checks everywhere.
Safe as houses. Unless someone screwed up.
Now if only a decompressor existed for current versions of RAR. A FOSS unrar tool exists that decompresses RAR 1, RAR 2, and some RAR 3 archives, but not current RAR 3 archives.
[redacted as some have security consequences]"
I wonder if torrent seeders have exploited this to spread malware/bots....
Seeders cannot modify the content of the files they're seeding. Torrent client checks hashes for each chunk of data it downloads.
Only the original uploader could do that and there's regular reputation system at play there. There are known uploaders, known scene groups, etc.
Plus, most torrents, with the exception of applications where you can just modify the installer, don't contain compressed archives.
Maybe we need to rewrite that old law:
All programs expand until they contain a virtual machine. Those that cannot do so are replaced by ones that can.
(If you don't take "running the bitcoin script" as "virtual machine".... then yes, it is technically a virtual machine, but very Turing incomplete.)
Although nowadays the art of programming is maturing enough that the inner platform sometimes is deliberately designed and well specified.
Is it still being developed?
Oh okay, it was the distributor, not author: http://en.wikipedia.org/wiki/Ron_Dwight
FAR Manager has been open-sourced - http://www.farmanager.com/
[1] http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-progr...
I really don't miss Windows.
This sort of thing can happen to some virus scanners when they come across a page with the text of things like malicious VBScript, batch files, etc., even if it's text that's displayed on the page.