Hacker News Reader

Comment by nneonneo | Hacker News Reader

It’s actually a shame that there is no `mov rip, ...` instruction. That would make it truly Turing-complete. ARM has this instruction! (Of course, jmp [...] works just as well, but it isn’t called mov)

View on HN

Movfuscator [0] (which expands on the paper) managed to find a way to jump using just mov - by using a faulting mov.

[0] https://github.com/xoreaxeaxeax/movfuscator

Yeah, I remember this. It requires setting up a custom signal handler though. IIRC something similar is used to get system/library calls (which also can’t be expressed purely with mov instructions, normally).

If I recall correctly tom7 had a cute trick to get looping behavior in his ASCII-only compiler for 16-bit Intel (http://tom7.org/abc/) which was to make the program 64KB exactly, such that the program counter just loops around at the end. I suppose that’s another option to get _pure_ mov-only code.

PDP-11 architechture [1] has a "jmp" that is a variant of "mov". And "push", "pop", and even "ret" are too. Also this beauty:

  MOV -(PC), -(PC)

This is a 1-word self-replicating program that (when run from the topmost RAM address) will clobber entire RAM by copying itself all over it.

[1] https://en.wikipedia.org/wiki/PDP-11_architecture#Addressing...

Note that Arm64 also doesn't have this kind of direct access to the program counter.

Additionally, the ARM mov instruction can't access memory, so it is not Turing complete anyway.

Reply on news.ycombinator.com