编程与软件工程github.com
用一次 printf 调用实现的井字棋 C 程序
C implementation of Tic-Tac-Toe in a single call to printf
2020 — 2022，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
这是 Nicholas Carlini 写的一个 C 程序：把整个井字棋游戏塞进一次 printf 调用里。它利用 %n 格式符会向指针写入「已输出字节数」的特性，去改写格式字符串本身，从而让 printf 变成图灵完备的计算引擎；README 解释了这套原理及相关的格式化字符串安全风险。
为什么经久不衰：它把「格式字符串漏洞」这种安全缺陷反过来当成编程语言来用，既有智力挑战的趣味，也直观提醒每个 C 程序员：把用户输入当格式串有多危险。
HN 评论精选
宏海只是表象，真正巧妙的是其中没有显式的井字棋逻辑；用清晰的 C 写反而更能体现功力。
说来奇怪，我觉得这堆 #define 宏反而削弱了这里的精彩程度。我一开始并不太惊艳，因为靠一堆 #define 来混淆 C 代码是种很无聊的写法——宏足够多，任何代码都能伪装成一次 printf 调用！但实际上它比这巧妙得多。我觉得如果它用简单清晰的 C 写出来会更令人佩服，因为那样你才会看到，其中确实没有按常规方式显式实现任何井字棋逻辑。
simias查看英文原文
Oddly enough I find that the #define macro soup detracts from the performance here. I was rather unimpressed at first because obfuscating C code by just #define'ing a bunch of code is a trivial and rather uninteresting way to write unreadable code. Of course you can make any arbitrary code look like a printf call with enough macros! But it's actually a lot more clever than that. I feel like this would be a lot more impressive if it was written in simple and clear C since then you'd see that there really isn't any tic-tac-toe logic being explicitly implemented the way you'd expect.
提前公开源码可能违反 IOCCC 匿名评审规则，导致参赛资格失效。
恐怕作者因为抢在 IOCCC 2020 评审结束前公布了源码，而把自己搞成了不合格。规则里的第22条军规写着：「评委强烈希望不知道提交者是谁。」甚至获奖者也被要求在 IOCCC 官网公布之前不要公开代码。
mci查看英文原文
I am afraid that the author has disqualified himself by publishing the source code before the judging of IOCCC 2020 is over. See catch 22 in the rules: "The judges STRONGLY prefer to not know who is submitting entries to the IOCCC."[1] Even the winners are asked not to publish the code until it is available on the IOCCC web site.[2] [1] https://ioccc.org/2020/rules.txt [2] Personal communication
作者的研究表明，程序内存在图灵完备的函数（如 printf）构成无法用控制流完整性防御的根本漏洞。
相关演讲，谈 printf 编程的动机：Control-Flow Bending（控制流弯曲）。大致观点是，程序中存在图灵完备的函数会带来根本性漏洞，即便严格限制程序的控制流也无法避免。
mjburgess查看英文原文
Relevant talk on the motivation for printf-programming: https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/carlini#:~:text=Control%2DFlow%20Bending%3A%20On%20the%20Effectiveness%20of%20Control%2DFlow%20Integrity,-Authors%3A&text=Control%2DFlow%20Integrity%20(CFI),is%20believed%20to%20be%20secure. Very interesting. Roughly, that the existence of Turing-complete functions within programs creates a fundamental vulnerability that even rigid control over the control flow of a program cannot avoid.
%n 是任意写入原语，使 printf 图灵完备，也是格式化字符串漏洞的根源；现代编译器与部分 C 库已对此设防。
几个要点（README 里也提到）：%n 会让 printf() 取出一个 int* 参数，并把目前已写出的字符数写进该地址。真正好玩的是滥用它去覆写格式字符串本身，这实际上让 printf() 变成图灵完备的。这也意味着，如果你偷懒把用户可控的字符串直接塞进 printf 风格的函数（而不是写成 printf("%s", str)），它就能被当作任意内存写入的利用原语（外加任意栈读取）。正因如此，编译器会对非字符串字面量的格式串报警（我记得 GCC 11 起默认开启），一些 C 库如 dietlibc 干脆拒绝实现 %n。
st_goliath查看英文原文
A few key points (also mentioned in the README): The "%n" specifier makes printf() fetch an int* argument and write the number of characters written so far to the target location. The funky stuff happens when you abuse that to overwrite the format string itself, actually making printf() Turing-complete. This also means that if you lazily stuff a user controller string into a printf() style function (instead of doing e.g. `printf("%s", str)`), this can be used as a gadget for arbitrary memory writes (in addition to arbitrary stack reads). For this reason, there are compiler warnings if you use a format string that isn't a string literal (IIRC now on by default in GCC 11) and some C libraries like dietlibc refuse to implement %n.
历次讨论
同类还值得读
开源应用架构
The Architecture of Open Source Applications
《开源软件架构》（AOSA）是一本在线免费书，邀请知名开源项目的作者亲自剖析其内部设计，涵盖 SQLAlchemy、LLVM、Audacity、Apache、Bash 等系统。
编程与软件工程上首页 9 次 · 2011–2024aosabook.org编辑精选编程语言简史：简短、不完整且多半错误
A Brief, Incomplete, and Mostly Wrong History of Programming Languages
一篇以戏谑、故意不准确的方式回顾编程语言史的博客文章，用夸张轶事和讽刺定义串起 Lisp、C、C++、Java、JavaScript、PHP 等语言。
编程与软件工程上首页 8 次 · 2009–2021james-iry.blogspot.comSQLite 是如何测试的
How SQLite is tested
SQLite 官方文档页，系统介绍 SQLite 的测试体系：多种测试方法（TCL 测试、模糊测试、回归测试、静态分析等）和海量测试用例，展示了这个小型开源项目如何靠极致测试获得…
编程与软件工程上首页 8 次 · 2009–2025sqlite.org编辑精选高级编程语言（2009）
Advanced programming languages (2009)
Matt Might 的经典文章，按用途推荐“高级编程语言”：如果追求就业就选主流语言，如果追求表达力、学术研究或创业，则推荐 Haskell、OCaml、Scala 等函数式语…
编程与软件工程上首页 8 次 · 2009–2022matt.might.net我的 Forth 与栈机器经历
Yosefk - My history with Forth & stack machines
作者以亲身经历回顾了使用 Forth 语言和栈式机器的历程：既赞叹其简洁优雅、代码量小、可自举的优点，也坦率指出栈操作在实际编程中的痛苦，以及 Forth 社区文化中的问题。
编程与软件工程上首页 8 次 · 2010–2024yosefk.com编辑精选