ProofOfConceptExploit

What about it? -- PEZ

Given some time it would've exploited itself a rank around 1900. -- Kuuran

You have asked if anyone has a way to stop it, but i can't find anywhere what it actually is... I certainly can't stop it if i don't have any idea what you are talking about... :-/ -- Tango

Looking at the source, it appears it just commits suicide in a very inefficient way if it comes across Smog, which would raise smog's ranking a little, but little else would happen... I don't get what you are trying to do... :-/ -- Tango

Don't decompile my bots. The contents of that bot include the contents of Muffin which is closed source. Thankfully you don't seem competent enough to steal my code if you can't tell what the exploit is. Muffin's score against Smog gives a ranking around 1900, it commits suicide against any bot that isn't Smog causing those scores to be discarded. Time to find out if obfuscators increase codesize... -- Kuuran

Interesting. Though as I said, on my system it hung the RR@H client. And, I would have believed you if you had just said this kind of trick would work. =) -- PEZ

Heh, yeah. The reason it hung robocode is I was ensuring suicide (and 0 scores) by entering a while(true); loop if my opponent wasn't my target opponent. So it wasn't actually hanging, it would just slow to a crawl for whatever the timeout is at the start of each round. I wanted to throw an exception but couldn't find a clean way to cause that, and being a SittingDuck doesn't guarantee no points against some bots. In the morning, when I'm not all groggy, I, of course, now realize a much better way would've been to attempt a sandbox break and let robocode toss a SecurityException?. -- Kuuran

• Another way to do it is to just use throw new SecurityException?() or something. -- Kawigi
  • None of the event methods robocode calls would allow a throw in them and any method I define as throwing something I also need to catch when I'm calling, so I couldn't find a simple way to make this work. -- Kuuran
    • You can always throw a purely runtime-ish exception without declaring the method as throwing it. Of course, I don't know if a SecurityException? specifically would work, but you could throw an IllegalArgumentException? or NumberFormatException? or IndexOutOfBoundsException? for no reason if you wanted (and if you can't, try new Color(256, 256, 256) or Integer.parseInt("Hello, World!") or (new int[0])[0] and they'll do it for you). Woah, that was scary, I've been teaching beginners Java for too long if I can think of 3 easy ways to throw exceptions in less than 5 seconds... -- Kawigi
      • Heh, indeed, my solution was new FileInputStream?("../blee.explode"); ;) But I didn't know how the runtime exceptions got thrown without being declared and didn't really feel like trying to figure it out at that hour. Handy tips on crashing my programs ;) -- Kuuran
      • Although I really prefer "throw new Error()" myself. -- nano

Well, my machine didn't get past battles with this bot. You could have put som getX() calls inside that loop. That should quickly reach the limit and make Robocode shut you out. -- PEZ

Also a very valid idea. I think we should leave bots off the finalized rankings tables if they haven't competed against all opponents yet. Side note: I can't seem to upload any results today, any idea what might be causing that? -- Kuuran

But that would be painful while waiting for your bot to get all pairings. It can take several days or even a week.

No real clue why you can't upload. For how long have you had the problem you estimate? -- PEZ

Last several hours. The servlets for upload and remove are returning HTTP code 500. -- Kuuran

I restarted the Tomcat server. Hope that helps. -- PEZ

Indeed it did, thanks. -- Kuuran

Hmm... I missed an exclamation mark. Makes so much more sense now... As for decompiling, I think you will find I am well within my rights to decompile your code as long as I don't use or distribute the code in any way. It's no different to taking apart a patented radio to see how it works. -- Tango (And if you can't even think to add a simple getXX or setXX method to your loop, then i don't think you are in any position to call my incompetent)

Tango, it isn't nice to read other people's code, as it contains information that they probably would rather you not see. If the person is okay with you seeing their code, then they include it in the jar. It seems to me to be very rude to decompile against someone's wishes. -- nano

It is also very rude to waste people's CPU cycles, isn't it? -- Tango

If you name a bot ProofOfConceptExploit and don't provide any info about it then you must be prepared for that bot being decompiled and analyzed. Even more so if it also hangs the RR@H system. -- PEZ

Granted, I'm just speaking of decompiling in general. I can see how one could consider this bot to be an exception, although I personally wouldn't have decompiled. I would've just removed it from the competition and then asked the author about it. -- nano

Which is exactly what PEZ did and you don't see me being upset at PEZ ;) I think if I wanted the exploit source to be shared I would've opened sourced it same as any bot. Obviously if something is closed source and you want to know how it works ask the author (or wait for him to get his beauty sleep and post it). -- Kuuran

Though I only removed it because of the hang. I regarded the source as trusted so the name wasn't all that scary. =) In any case, I bet bots are decompiled often by curious people. Use obfuscators if you keep secrets in there. Of course, I rather see you open source your bots instead. It's good for your Karma. -- PEZ

I don't regularly decompile things, but if someone asks a question which i can't answer without decompiling their code, then I take it as implied permission. It isn't possible to come up with a fix for an exploit without knowing what the exploit is, so you either have to tell people what it is, or come up with the fix yourself. -- Tango

If u are so concerned about your property, u should then take care a little better of it's security. Take a look at Shadow's package for example, maybe u can ask ABC how to do that. You must have in your mind that java is not entirely compilated, the .class files are bytecodes, what makes easy to decompile it. When u do not open your source, you are actualy saying that others can't use what is in, not that they can't see it. Unless u take some kind of measure against it, it's like you say that people can't look in throw your glass window unless it's open. If you don't want them to look, put some curtains. -- Axe

I'm fully aware of obfuscation, Axe. I've grown accustomed to the idea that the robocode community is honourable enough that I wouldn't have to resort to that unless I was being paranoid. Clearly I was wrong. Obfuscation probably greatly increases codesize so I'm not sure it's viable for any of my bots, but I will definitely try and find out now, this whole situation has upset and disgusted me quite a bit. As for expecting you to try to steal my IP, Tango, if you had bothered asking or waiting a few hours for me to post the explanation (which I was planning on doing in the morning EST) before breaking out the reverse engineering this situation wouldn't have arisen.

I've released a more efficient version just to see if this does in fact work.

-- Kuuran

• I don't belive you informed the wiki of your plans to explain it in the morning, you did however ask for solutions in the evening. You can't ask the question, and except people to guess that you are going to give them the information needed to answer it later. I did not steal your IP, and I resent that defamation. -- Tango
  • I hate to break it to you, but decompiling is by definition IP theft, you're using a method to gain access to information which someone else is keeping to themselves. This is no different (except in scale) than photocopying classified documents and then being offended by the allegation of espionage because you just did it to see if taxpayer's money was being well spent on the military. -- Kuuran

Is there any way to get RR@H to run just POCE and Smog so I can hurry up, see if it works, and get it out of the way? (It'll probably clog up the smart battles system for awhile otherwise, which I'm not too eager to do). -- Kuuran

Better install the Robocode server locally and test it there. It takes only a few minutes to set it up. Then you'll be set for helping out developing the servlets too. =) -- PEZ

Sorry, but I removed this bot again. I think it will take forever before it stops clogging the system. -- PEZ

There is no way to run only Smog vs. POCE battles. I think the only way is to make a local installation as PEZ says and then modify the client to run only Smog vs. POCE. -- Albert

Can't you just manually edit the participents file like you used to be able to? It's not a very good idea, and a local server would be much better, but i thought it was possible. -- Tango

I would be happy if we didn't carry out experiments like this in the regular environment. I know Albert has not said we are "live" yet. But it works well enough and I am probably not alone to regard it as almost live and official. The system is pretty simple. I'm sure there are all sorts of exploits possible on it. It's good that some of us think them up and are ready to spend time exploring them. But better do it in a lab environment. -- PEZ

Editing the participants file would not be an exploit, would be cheating :-). And it would not prevent your bot running in other systems. In any case, I agree with PEZ, we should avoid it. BTW I'm thinking going live in a few days (when we sort the long melee battles question and have time to put it all togheter). -- Albert

Total number of battles had a .5 in it the other day, sounds like you might be compensating for the counting each battle twice problem in two places? Or maybe it was just a fluke, I haven't seen it since. Oh, and an exploit is cheating, at least in my book :p Though a practical version of this exploit wouldn't require it, just proving graphically it exists is made easier by that. -- Kuuran

Number of battles can get to .5 ,because of the way it is calculated, when a bot is removed. Lets say that A and B fight. Then the file for bot A has battles = 1 and the file for bot B has battles = 1. Then RR@H adds the battles number from all files and divides by 2: (1 battle from file A + 1 battle from file B)/2. If you remove bot A from competition, then it will only find the battle for B and the result will be 0.5. -- Albert