Talk:Backdoor

Commands

I googled the various commands to try to figure out what they do. I'm not 100% certain of this, which is why I'm putting it on the discussion page rather than the article page. Anything not specifically cited was found via a google for "man command".

Zone

creates a "virtual machine", seperate from the rest of the operating system, that lets you securely run applications in an isolated environment. I strongly suspect all commands must start with zone. [1]

mount

mounts the file system. This is a common Unix command, and usually one of the first tasks you do.

popen

forks a new process that invokes the shell. It may close previous popen processes.

pread

reads input from a specified position of a file.

pwrite

writes data to a specified position of a file. This command doesn't seem to be allowed.

flush

this may have to do with deferred mail. [2]

rotate

possibly rotates the logs [3]

switch

uncertain. It may be a SELECT...CASE statement [4]. Otherwise, my first guess was a change directory (CD) command.

copy

assuming it copies the data. Doesn't seem to work.

run

run a set of commands.

end

end the current run.

I've been trying to "translate" the command grid into English to get a better sense of how it works. One possible "translation" for 'zone, mount, run, rotate, rotate/ - - popen, rotate, cache/ - - end - -' might be:

1. Start a virtual machine.
2. Mount the filesystem.
3. Run the following commands:
   1. Rotate the logs twice.
   2. Open a new process.
   3. Rotate the logs once.
   4. Cache the data.
   5. End.

This is reading left-to-right row by row. I'm uncertain if this is correct.xnera 18:49, 30 June 2006 (PDT)

Question

What are Frob and Twiddle? TheBozzball asks a dumb question.

Geek terms. Tweak, Twiddle, and fFrob refer to the 3 varying stages of messing with things. fFrob is a sort of spin the dial and see what you get. Especially used when you have no idea what something is. Twiddle is more of a refined fFrob, or perhaps a broad tweak. If fFrob asks us to pick any number, twiddle asks us to pick a numbner between one and a hundred. It narrows the range a great deal. We still don't know what we're doing, but we seem to be closer to understanding what the thing is. Then, the next logical step is a tweak. We can tweak things all day. Up by one step. Down by a half. Right 3/16. 15 degrees to the diagonal of north by 33 9/10. So, naturally, When this page was started, it served as a nice place to start fFrob and twiddling. Hence those titles. It seems to me we should probably start sorting the page out a bit, however. It's becoming a hodge-podge mess. Scott 01:35, 5 July 2006 (PDT)

Garden of Forking Paths

<xnera> i've been thinking of it as a multi-processor... anything after the "run" in the same row reading right or column reading down is run (perhaps simultaneously)

<jbd> right

<xnera> so, could switch mean "switch to the other process"?

<jbd> yeah, that's the theory inky was working from

<xnera> i was thinking rotate might mean "start processing in the other direction". so if you were reading across, you'd start going down

<jbd> this one needs both rotates to work: zone mount run rotate rotate / - - popen zone cache

<jbd> I think even though you can move run anywhere, it still runs as if it's in r1c3. because nothing else goes there without an error

<jbd> and r2c3 is the only place run gives an error, so I'm pretty sure that's the program run activates. run isn't going to activate itself

<xnera> i think popen must preceed a cache

<jbd> so it splits off 'run' from r1c3 ....

<xnera> yeah, seems like it

<jbd> It doesn't like End running, so to end the program gracefully you have to... hmmm.

<jbd> like, this doesn't work: zone mount run cache - / - - popen - -

<jbd> but if you put the rotate right after popen, it does work

<jbd> if you place and end there, you can tell it's trying to execute it because it says session cannot be unloaded at this time

<jbd> (the ends are good for checking where the program is going next)

<jbd> so what is the rotate doing to end it? is it somehow 'joining the streams'?

<xnera> i think the goal is to end up on a "cache" square

<xnera> ooo! maybe ALL program forks have to end on a cache square?

<jbd> yes

<jbd> that sounds right

<jbd> that seems to be the pattern

<jbd> and ... if you run a different number of rotations before you hit the cache ... you get a different file

<jbd> V conversation is one rotation

<jbd> firmware bugs is two rotations

<jbd> neuro thingy is three rotations

<jbd> so to get at the other files, we have to make four, five, six, etc.

<jbd> as many as we can

<jbd> and possibly no rotations, if that's possible

Directions?

<jbd> check this out: run cache -- / popen switch -- / -- -- end

<jbd> this hits the end statement

<jbd> the switch is making the execution arrow go SE

<jbd> flush makes it go south!

<jbd> switch direction SE, flush direction S

<jbd> I wish I knew how rotate worked

<jbd> It's still eluding me

<jbd> based on what's happening with the End statements I'm testing switch definitely goes SE and flush goes S

<jalapenodude> how are you testing?

<jbd> Whenever it hits and End, it gets a consistent error message

<jbd> so you can use End to test if it makes it to a particular square

<jbd> like this one:

<jbd> run flush end / popen rotate end / - end end Unable to write to file

<jbd> I know it can't have gone outside of the boundry.

<jbd> and the r1c4 also still seems to be 'special'.

<jbd> this also gets V text: -- rotate -- / popen flush cache /-- rotate --

<jbd> ah, you don't need the rotate on the first line

<jbd> you do need it on the third line

<jbd> because the flush hits the rotate

<jalapenodude> where does the run go in that grid?

<jalapenodude> I just get "no disk access"

<jbd> sorry, I am including only the right half

<jbd> here's the full thing

<jbd> zone mount run -- --

<jbd> -- -- popen flush cache

<jbd> -- -- -- rotate --

<jbd> 'flush' moves the execution down to rotate. somehow from there it gets to the cache

<jbd> what I am needing now is an execution that hits four rotates before cache

<jalapenodude> so the program moves downwards at the beginning, not right?

<pelrun> what if the rotate functions on the execution direction of the cell *after* it (i.e. the rotate is delayed one step?)

<pelrun> doesn't seem to fit this example though, if it's going down from flush

<jbd> yeah. somehow it hopes from rotate to cache

<jalapenodude> okay so zone mount run -- --/-- -- flush cache --/-- -- rotate -- -- also works

<jbd> that's handy to know

<pelrun> what if the rotate doesn't function just on execution direction, but on the surrounding cells themselves?

<jbd> incidentally, I'm starting to think there's one pointer

<jbd> not multiple forks

<jbd> and that's an interesting thought perlrun

<xnera> pelrun, you mean that the cells rotate around the cell that has the rotate in it?

<pelrun> yeah

<xnera> and jbd, i am glad I am not the only person who misreads pelrun's name as perlrun :)

<jbd> hey, this is cool ... (cutting out first two columns)

<pelrun> heh, not the first time I've been mistaken for a man page either XD

<jbd> run - - / flush - - / popen end -

<jbd> that hits the end

<jbd> the popen makes it go east

<jbd> maybe *All* these commands are just directional somehow

<pelrun> yup

<pelrun> each command has an effect and a execution direction

<xnera> huh. i've been automatically going east after a popen without realising it

<jalapenodude> right side only: run cache --/popen rotate-- gets the approached the master one

xnera 20:57, 30 June 2006 (PDT)

More Direction Discussion!

<jalapenodude> ok so I'm going to go command by command.

<jalapenodude> Zone and mount start a program. Zone also moves the program left.

<xnera> agreed

<jalapenodude> Mount moves the program SE.

<jalapenodude> Switch also moves the program southeast

<xnera> how are you getting mount moving it SE?

<jalapenodude> run -- --/switch -- --/-- end --

<jalapenodude> I'm skipping copy for now

<jalapenodude> sorry--I'm skipping rotate and working on copy

<jalapenodude> copy moves down

<pelrun> pread goes left

<pelrun> pwrite goes right

<pelrun> popen is right of course

<pelrun> perhaps run actually does fire execution chains off in all four directions, but only shows the most interesting message of the four - maybe the one that executed the longest without error

<jalapenodude> YES I DID IT!!!!!!

<pelrun> cool

<xnera> awesome!

<pelrun> looks like the one that was stumbled on earlier (but the program was lost)

<jalapenodude> the trick is that rotates go NE on odd-numbered columns and N on even-numbered columns

<jalapenodude> it should be Zone mount run -- –/copy zone zone cache --/copy pwrite rotate -- --/copy rotate -- -- --/rotate -- -- -- --

xnera 21:47, 30 June 2006 (PDT)

Frob

[ARG]/001 Ghogg says, "http://events.perplexcity.com/gateway/commandinterface/index.html"

[ARG]/002 Ghogg says, "this is the most recently popped up puzzle. it is a 'backdoor' of some sort with a bunch of unix-y commands"

[ARG]/003 inky says, "hey, I got it to do something"

[ARG]/004 Ghogg asks, "PWRITE, POPEN, and PREAD seem pretty straightforward. What would SWITCH and ROTATE do?"

[ARG]/005 inky says, "I figured that the commands were meaningless and it was just going to be a puzzle about spelling stuff out with the first two letters"

[ARG]/006 inky says, "if this is like befunge, then switch and rotate may change which direction execution moves in"

[ARG]/007 Ghogg asks (of inky), "whoa, really?"

[ARG]/008 inky says (to Ghogg), "well, I got it to blink and say "invalid command path""

[ARG]/009 inky says, "I realize that is not that exciting"

[ARG]/010 Ghogg says, "heh, ok. If you drop 'run' anywhere it'll try to excute the stuff on the row and column"

[ARG]/011 Ghogg says, "someone managed to get one thing to run ... lesse..."

[ARG]/012 Ghogg says, "something with mount and zone, but I'm not getting it to work"

[ARG]/013 Ghogg says, "I do think this is supposed to represent a 'real' computer system"

[ARG]/014 inky says, "yeah, apparently"

[ARG]/015 Jota says, "I got it to complain about disk access."

[ARG]/016 Jota says, "Runtime Error: No disk access."

[ARG]/017 inky says, "you have to popen first"

[ARG]/018 inky says, "er"

[ARG]/019 inky says, "mount first"

[ARG]/020 Jota says, "I've got mount as the first operations of the row and column (after run, in the upper left), and I've still got that error."

[ARG]/021 Jota says, "Which is interesting, since I guess it means I managed to compile."

[ARG]/022 * NewsBoy hollers, "Extra! Extra! Ghogg has posted message 6, about Backdoor' in Perplex City puzzle', to the bulletin board! Jaybird soon to be given WizBit!"

[ARG]/023 Ghogg says (to Jota), "the goal here seems to be either to a.) dump the system files from this point or b.) cause a crash that will let you break into the system proper"

[ARG]/024 Jota says, "I'm vaguely curious what that blank one is all about."

[ARG]/025 inky asks, "blank one?"

[ARG]/026 Jota says, "The thing in the upper right."

[ARG]/027 Jota says, "(Or is that only visible if you open the SWF directly?)"

[ARG]/028 inky says, "I don't see any such thing, yeah"

[ARG]/029 Jota says, "I managed to use it to get an 'undefined' command."

[ARG]/030 inky says, "neat"

[ARG]/031 Jota says, "Dunno if that's a bug or necessary to win."

[ARG]/032 Jota says, "Huh. It doesn't let you put things in certain places."

[ARG]/033 inky asks, "really?"

[ARG]/034 inky says, "I've occasionally had them snap back but it seemed to be more because I was misplacing them within the grid"

[ARG]/035 inky says, "and when I tried again it worked"

[ARG]/036 Jota says, "Let me try to recreate it."

[ARG]/037 Jota says, "I can't seem to find how I did it before."

[ARG]/038 Jota says, "'Session can not be unloaded at this time'."

[ARG]/039 inky says, "hrm"

[ARG]/040 inky says, "oh, heh"

[ARG]/041 Jota says, "'No area has been accessed'"

[ARG]/042 Jota asks, "Do we know what the P in popen, pwrite, pread are?"

[ARG]/043 inky says, "hey, nice"

[ARG]/044 inky asks, "how did you get it to do that?"

[ARG]/045 inky says, "no, although they're actually names of unix system functions"

[ARG]/046 Jota says, "Mount, run, rotate, end in the first row; run, rotate, end in the second column. (Same 'run'.)"

[ARG]/047 inky says, "although they're not related, I don't think -- popen forks a new process, and pread and pwrite read and write a file"

[ARG]/048 inky says, "hmm, interesting"

[ARG]/049 Jota says, "It appears that you need mount before run, and you need some command between run and end. I'm trying out the different commands now."

[ARG]/050 Jota says, "Hmm. I can legally put a pwrite before the mount."

[ARG]/051 Jota says, "I get the same runtime error, but at least it's a valid command grid."

[ARG]/052 Jota exclaims, "Woo, a file error!"

[ARG]/053 Jota says, "'File access denied'."

[ARG]/054 inky says, "awright"

[ARG]/055 josh_g says, "hee hee"

[ARG]/056 Jota says, "I am totally racking up the errors here."

[ARG]/057 josh_g says, "phrases you didn't expect to hear"

[ARG]/058 Jota exclaims, "Access error!"

[ARG]/059 Jota says, "(Unable to reset read permissions)"

[ARG]/060 Jota says, "I currently have zone, mount, run, rotate, pread / -, -, popen, zone, - / -, -, pwrite, pread, - / -, -, rotate, -, - / -, -, end, -, -."

[ARG]/061 Jota says, "I am confused by the fact that the zone needs to be present for this to 'work'."

[ARG]/062 Jota says, "'Timeout in folder'"

[ARG]/063 Jota says, "I still have no idea what I'm doing, but at least I've reached the point where I get lots of different messages."

[ARG]/064 Jota says, "Hmm. I think the timeout might mean some kind of loop."

[ARG]/065 inky says, "holy!!!"

[ARG]/066 inky says, "I think I got it"

[ARG]/067 inky says, "arg, shit, and the screen that popped up obscured what I did"

[ARG]/068 josh_g says, "woot!"

[ARG]/069 inky says, "curse it all"

[ARG]/070 josh_g says, "but you are still a winnar"

[ARG]/071 Jota says, "Congrats."

[ARG]/072 inky says, "so irritating"

[ARG]/073 inky says, "I really have no idea what I did"

[ARG]/074 inky says, "I think I put a rotate in the upper-right corner and and a switch in the lower-right"

[ARG]/075 inky says (to Jota), "starting from what you had"

[ARG]/076 (from josh_g) inky says, "but I might be able to remember more clearly for, say, $10"

[ARG]/077 Jota says, "Working silently and secretly, not sharing his progress (by which I mean 'error messages') with the rest of us."

[ARG]/078 inky says, "for the record, the code phrases or whatever from this seem to be "CRYPTO PARTS REF: 384621-5A" "EXTERNAL REF: 9CE42T""

[ARG]/079 Jota says, "I think you must have made more changes than to the upper right and lower right squares, since since that's an invalid command grid."

[ARG]/080 inky says, "yeah"

[ARG]/081 inky says, "I think the theory is rotate turns the direction of execution, and going off the edge without hitting an end is one of the things that trigger invalid"

[ARG]/082 inky says, "you've got the 'session can not be unloaded at this time' one, right? I think that's from hitting an end too early, or without caching or something"

[ARG]/083 Jota says, "Yeah."

[ARG]/084 Jota says, "I think that was the third one I saw, after the one for not mounting and the invalid grid one."

[ARG]/085 inky says, "dadgummit"

[ARG]/086 inky says, "I just got another useful ending screen"

[ARG]/087 inky says, "(so clearly the previous one wasn't the whole solution, which makes sense)"

[ARG]/088 Jota says, "Curse it all."

[ARG]/089 Jota says, "(I have no real reason to curse anything, but I just felt like going along with you.)"

[ARG]/099 inky says, "zone mount run rotate rotate / - - rotate zone cache / - - pwrite pread - / - - rotate - end / - - end - -"

[ARG]/100 inky says, "pops up one of the screens I've got"

[ARG]/101 inky says, "(but you can't keep accessing the grid at this point)"

[ARG]/102 Jota asks, "File access denied?"

[ARG]/103 inky says, "oh you're kidding me"

[ARG]/104 inky tries it himself

[ARG]/105 Jota says, "Maybe you did something else to gain access first."

[ARG]/106 inky says, "ack, I hope not"

[ARG]/107 inky says, "this will be even harder if it's not stateless"

[ARG]/108 inky says, "grah, yes, I get the error too"

[ARG]/109 inky says, "aha, sorry, I made a typo"

[ARG]/110 inky says, "try zone mount run rotate rotate / - - popen zone cache / - - pwrite pread - / - - rotate - end / - - end - -"

[ARG]/111 inky says, "ie, sub popen for the rotate on the second row"

[ARG]/112 Jota says, "Aha, there it is."

Twiddle

[16:57] <achenar> This whole thing would probably make more sense if I knew Unix, wouldn't it? ;)

[16:57] * _SB|nothere is now known as _SilentlyBroken

[16:57] <SteveC> So - we've got two distinct paths - one is giving us parts, the other is giving us chat..

[16:57] <SteveC> achenar: Not really

[16:57] <poozle> Knowing unix doesn't help achenar

[16:57] <Book[sidelines]> Hmm

[16:57] <Scott`> http://perplexcitywiki.com/wiki/Backdoor

[16:58] <SteveC> I'm not convinved that it's not just random :)

[16:58] <Scott`> has all the latest as i am aware

[16:58] * Cheese|Away is now known as MasterCheese

[16:58] * Gibbet has joined #syzygy

[16:58] <achenar> Ooh, thanks. *wikifies before she does anything too stupid* ;)

[16:59] <poozle> I'm looking at it and there seem to be patterns, just not a lot of them

[16:59] <AxysDenyed> Actually, you can just do zone mount run switch - / - - popen rotate cache

[16:59] <Book[sidelines]> No END needed ? Hm...

[17:00] * Mico has joined #syzygy

[17:00] <MAFIAA> end might be needed for the branches

[17:00] <CLU> Wait, what have we got so far?

[17:01] <poozle> Anyone had "Session can not be unloaded at this time"?

[17:01] <Wizdumb> yea

[17:01] <Wizdumb> that's from an end too early

[17:01] <poozle> ok

[17:01] <SteveC> brb

[17:01] <poozle> thanks, will keep trying

[17:01] * SteveC has quit IRC (Quit: )

[17:03] <jbd> that's interesting the switch works

[17:03] <Book[sidelines]> Yup.

[17:17] <TheBozzball> If you do programs consisting of just "run", you get invalid command grid unless you put run on the first column, in which case you get "no disk access". If you do programs consisting of square 1: some command, square 2: run, you get - for Switch, Copy, Flush, Pread, Cache, Mount - Inv. Command Grid, for the other 6 - No Disk Access

Direction theories

DIrections that each comand moves in. If blocked (either by a side, or by a previously used square), then progresses to next listed direction. However, I haven't explored these latter moves extensively, so there are gaps.

In 2,2, from 1,1: MO - SE ZO - W, N, E, NE, [NW?], SW SW - SE RO - N, NE, [E?], S CO - S FL - S, SE (Seems to move BEFORE flushing) doesn't seem to go upwards PW - E, S PO - E, S PR - W CA - No direction EN - No direction

How the filesystem works:

Files are accessed in a 3-dimensional, rotational space - think along the lines of X, Y and Z axes with the space wrapping around. The wiki is along the right lines on this. The 3 commands ZONE, SWITCH and ROTATE move along each axis. Not all axes ar the same length - there seem to be 4 zones, each with 5 switches, but the number of rotates in each of these varies (usually 1 or 2, sometimes 0).

Breaking the System:

Caine has given us one example, with an infinite loop, which we also found by accident. Usually, the execution of commands cannot loop as the executing program keeps track of which squares have been used already. If a command tries to enter a used square, it fails and moves to the next directionon its list. However, I think the FLUSH command clears out this "stack" of used squares, which means we can enter squares we have already been to and produce an infinite loop. For some reason, what should loop doesn't always get accepted by the "parser", i.e. only some loops work and crash the system.

These loops (following some other commands) seems to "work" (i.e. break) but they may or may not be dependent on the precending commands. I think they may also need to be "inescapable" - e.g. Flush doesn't seem to move upwards at all, so is best placed at the right-hand edge, surrounded by other commands to the left and below.: FL RO PR RO PW FL ZO RO FL (with Flush at edge, no other way down)

Caine also reveals what looks to be an excerpt from an inetd.conf file. Looks like we need to break the system in another way, but haven't figured this out yet. - courtesy of Scribe

Config 23/24 Audio

It sounds like Violet to me. Can someone call the US/UK "walkthrough puzzle" and confirm that the woman making those audio entries is Violet Kiteway? Ayanami 04:42, 5 July 2006 (PDT)