moyix

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

// Build:
// gcc -gdwarf-4 -fcf-protection=none -no-pie -fno-stack-protector basicbof.c -o basicbof

// To give us a pop rdi gadget
void dosomething() {
    int x = 0xc35f;

moyix

import sys
import torch
from transformers import StoppingCriteria, StoppingCriteriaList
from transformers import AutoTokenizer, AutoModelForCausalLM

class StreamPrinter(StoppingCriteria):
    def __init__(self):
        StoppingCriteria.__init__(self)
        self.pos = 0
    def __call__(self, input_ids, scores):

moyix

MONGODB_URL=mongodb://localhost:27017
HF_ACCESS_TOKEN=<REDACTED>

# 'name', 'userMessageToken', 'assistantMessageToken' are required
MODELS=`[
  {
    "endpoints": [{"url": "http://localhost:8081"}],
    "name": "WizardLM/WizardLM-70B-V1.0",
    "description": "WizardLM: Empowering Large Pre-Trained Language Models to Follow Complex Instructions",
    "websiteUrl": "https://huggingface.co/WizardLM/WizardLM-70B-V1.0",

moyix

#!/usr/bin/env python3
from flask import Flask, request, redirect
import os
import subprocess
import sys
import yaml
import MySQLdb

app = Flask(__name__)

moyix

{
    "fp16": {
        "enabled": true,
        "loss_scale": 0,
        "loss_scale_window": 1000,
        "initial_scale_power": 16,
        "hysteresis": 2,
        "min_loss_scale": 1
    },
    "optimizer": {

moyix

Total instructions:     48093488942
Total SSE instructions:   100105422
Total XMM instructions:   877832653
Totals by sanitizer:
   ASAN: SSE:   39197160, XMM:  308790743
   MSAN: SSE:   29922931, XMM:  342062480
  UBSAN: SSE:   30985331, XMM:  226979430
All projects per sanitizer, sorted by percent of SSE instructions:
ASAN:                               SSE Instr /      Total =   Pct ↓   Wilson
    simd                         :    1122000 /   63479115 =  1.77 % ( 1.76 %)

moyix

The ffast and the Furious

This is a small and admittedly contrived demo showing how some weird but safe code could become vulnerable if run in an environment where some shared library has changed the FPU's FTZ/DAZ bits to force denormals to zero.

To run it:

# Create an empty file
$ touch gofast.c      

moyix

#===============================================================
#
#
#===============================================================
import shutil
from setuptools import find_packages, setup
from os.path import exists,join,relpath
import os
import stat

moyix

#!/usr/bin/env python

import sys, os
import platform
import ctypes as ct
import mmap
from enum import Enum
import importlib
import functools
import errno

moyix

import sys
import os
import re
import json
import zipfile
from collections import defaultdict, namedtuple
from collections.abc import Mapping
from email.parser import HeaderParser
from email.policy import compat32
from base64 import urlsafe_b64decode