Ciro Santilli @cirosantilli 37

section .data
    hello_world db "Hello world!", 10
    hello_world_len  equ $ - hello_world
section .text
    global _start
    _start:
        mov rax, 1
        mov rdi, 1
        mov rsi, hello_world
        mov rdx, hello_world_len
        syscall
        mov rax, 60
        mov rdi, 0
        syscall

Compiled with:

nasm -w+all -f elf64 -o 'hello_world.o' 'hello_world.asm'
ld -o 'hello_world.out' 'hello_world.o'

TODO: use a minimal linker script with -T to be more precise and minimal.

Versions:

NASM 2.10.09
Binutils version 2.24 (contains ld)
Ubuntu 14.04

We don't use a C program as that would complicate the analysis, that will be level 2 :-)

 Read the full article

ELF Hello World Tutorial / ELF header by

Ciro Santilli 37  Updated 2025-07-11  +Created 1970-01-01

 View more

Running:

readelf -h hello_world.o

outputs:

Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
Class:                             ELF64
Data:                              2's complement, little endian
Version:                           1 (current)
OS/ABI:                            UNIX - System V
ABI Version:                       0
Type:                              REL (Relocatable file)
Machine:                           Advanced Micro Devices X86-64
Version:                           0x1
Entry point address:               0x0
Start of program headers:          0 (bytes into file)
Start of section headers:          64 (bytes into file)
Flags:                             0x0
Size of this header:               64 (bytes)
Size of program headers:           0 (bytes)
Number of program headers:         0
Size of section headers:           64 (bytes)
Number of section headers:         7
Section header string table index: 3

Running:

readelf -h hello_world.out

outputs:

Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
Class:                             ELF64
Data:                              2's complement, little endian
Version:                           1 (current)
OS/ABI:                            UNIX - System V
ABI Version:                       0
Type:                              EXEC (Executable file)
Machine:                           Advanced Micro Devices X86-64
Version:                           0x1
Entry point address:               0x4000b0
Start of program headers:          64 (bytes into file)
Start of section headers:          272 (bytes into file)
Flags:                             0x0
Size of this header:               64 (bytes)
Size of program headers:           56 (bytes)
Number of program headers:         2
Size of section headers:           64 (bytes)
Number of section headers:         6
Section header string table index: 3

Bytes in the object file:

00000000  7f 45 4c 46 02 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
00000010  01 00 3e 00 01 00 00 00  00 00 00 00 00 00 00 00  |..>.............|
00000020  00 00 00 00 00 00 00 00  40 00 00 00 00 00 00 00  |........@.......|
00000030  00 00 00 00 40 00 00 00  00 00 40 00 07 00 03 00  |....@.....@.....|

Executable:

00000000  7f 45 4c 46 02 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
00000010  02 00 3e 00 01 00 00 00  b0 00 40 00 00 00 00 00  |..>.......@.....|
00000020  40 00 00 00 00 00 00 00  10 01 00 00 00 00 00 00  |@...............|
00000030  00 00 00 00 40 00 38 00  02 00 40 00 06 00 03 00  |....@.8...@.....|

Structure represented:

# define EI_NIDENT 16

typedef struct {
    unsigned char   e_ident[EI_NIDENT];
    Elf64_Half      e_type;
    Elf64_Half      e_machine;
    Elf64_Word      e_version;
    Elf64_Addr      e_entry;
    Elf64_Off       e_phoff;
    Elf64_Off       e_shoff;
    Elf64_Word      e_flags;
    Elf64_Half      e_ehsize;
    Elf64_Half      e_phentsize;
    Elf64_Half      e_phnum;
    Elf64_Half      e_shentsize;
    Elf64_Half      e_shnum;
    Elf64_Half      e_shstrndx;
} Elf64_Ehdr;

Manual breakdown:

0 0: EI_MAG = 7f 45 4c 46 = 0x7f 'E', 'L', 'F': ELF magic number
0 4: EI_CLASS = 02 = ELFCLASS64: 64 bit elf
0 5: EI_DATA = 01 = ELFDATA2LSB: little endian data
0 6: EI_VERSION = 01: format version
0 7: EI_OSABI (only in 2003 Update) = 00 = ELFOSABI_NONE: no extensions.
0 8: EI_PAD = 8x 00: reserved bytes. Must be set to 0.
1 0: e_type = 01 00 = 1 (big endian) = ET_REl: relocatable format
On the executable it is 02 00 for ET_EXEC.
Another important possibility for the executable is ET_DYN for PIE executables and shared libraries.
ET_DYN tells the Linux kernel that the code is position independent, and can loaded at a random memory location with ASLR.
This is explained further at:
- stackoverflow.com/questions/2463150/what-is-the-fpie-option-for-position-independent-executables-in-gcc-and-ld/51308031#51308031
- stackoverflow.com/questions/34519521/why-does-gcc-create-a-shared-object-instead-of-an-executable-binary-according-to/55704865#55704865
1 2: e_machine = 3e 00 = 62 = EM_X86_64: AMD64 architecture
1 4: e_version = 01 00 00 00: must be 1
1 8: e_entry = 8x 00: execution address entry point, or 0 if not applicable like for the object file since there is no entry point.
On the executable, it is b0 00 40 00 00 00 00 00. The kernel puts the RIP directly on that value when executing. It can be configured by the linker script or -e. But it will segfault if you set it too low: stackoverflow.com/questions/2187484/why-is-the-elf-execution-entry-point-virtual-address-of-the-form-0x80xxxxx-and-n
2 0: e_phoff = 8x 00: program header table offset, 0 if not present.
40 00 00 00 on the executable, i.e. it starts immediately after the ELF header.
2 8: e_shoff = 40 7x 00 = 0x40: section header table file offset, 0 if not present.
3 0: e_flags = 00 00 00 00 Arch specific. i386 docs say:
The Intel386 architecture defines no flags; so this member contains zero.
3 4: e_ehsize = 40 00: size of this elf header. TODO why this field needed? Isn't the size fixed?
3 6: e_phentsize = 00 00: size of each program header, 0 if not present.
38 00 on executable: it is 56 bytes long
3 8: e_phnum = 00 00: number of program header entries, 0 if not present.
02 00 on executable: there are 2 entries.
3 A: e_shentsize and e_shnum = 40 00 07 00: section header size and number of entries
3 E: e_shstrndx (Section Header STRing iNDeX) = 03 00: index of the .shstrtab section.

 Read the full article

Organization developing electron on helium quantum computer by

Ciro Santilli 37  Updated 2025-07-11  +Created 1970-01-01

 Read the full article

Yanis Varoufakis by

Ciro Santilli 37  Updated 2025-07-11  +Created 1970-01-01

 View more

He beats the The European Union is a failure drum pretty well.

www.youtube.com/watch?v=iVxaTC7Qp44 The Global Minotaur: The Crash of 2008 and the Euro-Zone Crisis in Historical Perspective (2011)

 Read the full article

Knuth reward check by

Ciro Santilli 37  Updated 2025-07-11  +Created 1970-01-01

 View more

 Read the full article

N-V center quantum computer by

Ciro Santilli 37  Updated 2025-07-11  +Created 1970-01-01

 Read the full article

ecash by

Ciro Santilli 37  Updated 2025-07-11  +Created 1970-01-01

 Read the full article

Cool data embedded in the Bitcoin blockchain / Prayer wars by

Ciro Santilli 37  Updated 2025-07-11  +Created 1970-01-01

 View more

Starting at tx cbbaa0a64924fe1d6ace3352f23242aa0028d4e0ff6ae8ed615244d66079cfb1 (2011-08-05), Catholic Bitcoin developer Luke Dashjr started to inscribe prayers in the miner messages of his mining pool "Eligius pool", usually one verse per message.

Figure 1.
Saint Eligius by Petrus Christus
. Source. Off-chain image for illustration. Eligius pool is named after Saint Eligius, patron of goldsmiths and miners^[ref]

These are some of the earliest inscriptions in the blockchain, and therefore extremelly visible.

Although the prayer verses appear contiguous in ASCII dumps, Eligius was not actually mining every block: it is just that in those early days, miners still hadn't started adding advertisement messages to every block, so only Eligius shows up and appears contiguous.

At some point, opponents noticed these messages, and started adding atheist mockery graffiti replies, which appear interspersed in ASCII dumps with the prayer.

The first prayer is the Latin version of the Divine Praises, a Catholic prayer composed in 1797 in Italian by Luigi Felici for the purpose of making reparation after saying or hearing sacrilege or blasphemy. Luke claims he was referring to anything in particular that came prior in the blockchain: twitter.com/LukeDashjr/status/1749182637569122434. There arent many earlier inscriptions at all to refer to in any case! The prayer and correspondong interrupts (in transaction outputs, not by other miners) ordered by block are:

139690 (2011-08-05) prayer: "Eligius/Benedictus Deus. Benedictum Nomen Sanctum eius."
139717 prayer: "Eligius/Benedictus Deus. Benedictum Nomen Sanctum eius.'
139758 interruption: ***************************************************. This is not a Coinbase message: www.blockchain.com/explorer/transactions/btc/23befff6eea3dded0e34574af65c266c9398e7d7d9d07022bf1cd526c5cdbc94. This Bitcoin input script appears to spend a standard P2PKH output, but it first adds an extra value to the stack which contains the ***.
139792 prayer: "Benedictus Iesus Christus, verus Deus et verus homo.'
139831 prayer: "Benedictum Nomen Iesu.'
139838 (2011-08-06) interruption: "I LIKE TURTLES" (tx 78eb16507b3d3df615e3b474e853db4667f4b11954ec6d918b1ded0fca7ad25a)
138898 prayer: "Benedictum Cor eius sacratissimum."
139904 prayer: "Benedictus Sanguis eius pretiosissimus."
139921 prayer: "Benedictus Iesus in sanctissimo altaris Sacramento."
139942 prayer: "Benedictus Sanctus Spiritus, Paraclitus."
139954 interrupion: "aC-C-C-COMBO BREAKER" (tx 138c024a76df99ecafd2236d5429cf574b7778a3c6508bd83f116c832f3c6980)
139960 prayer: "Benedictus Sanctus Spiritus, Paraclitus."
139977 prayer: "Benedicta excelsa Mater Dei, Maria sanctissima."
139990 (2011-08-06) prayer: "Benedicta sancta eius et immaculata Conceptio."

Then comes:

140181 Latin Trinitarian formula
In nomine Patris et Filii et Spiritus Sancti. Amen.
Act of Contrition
Act of Hope

and various others + output message interruptions.

Then at last come the first miner message interruptions. Luke explained on Twitter ^[ref] that they were also made by Eligius pool, as there was a system in which contributors besides Luke could submit their own strings:

142547: (2011-08-25) tx 8e1e44a48b5e79636675d1476f8e4add075bbeb7f49e00ec743eed56f17feaaa A yandere game is starting in 60 seconds! Please type "]yandere" to join. Yandere Simulator comes to mind, but it can't be because that was pitched 2014.
142550: "A yandere game is starting in 60 seconds! Please type "]yandere" to join."
142573: (2011-08-25) "Militant atheists, bit.ly/naNhG2 -- happy now?". A Rickrolling link. Perhaps one of the fist.
142596: (2011-08-25) " ran out of prayers?! That explains the price drop.". Possibly quoting this dude on som twitter.com/cjdelisle Bitcoin IRC channel givesn the <USERNAME> format?
142640: "an de ti go su by ra me ni ko hu vy la po fy ton": Tonal system numerals. Interesting.

followed by more prayers and interruptions such as tx ec92d245822fa1ff862f3314b9102f36fe1eb8bc055865674c75323540aedef6:

FFS Luke-Jr leave the blockchain alone!
Oh, and God isn't real

The last Luke prayer appears to be on block 143822 (2011-09-03)

... the Lord of the harvest, that he send forth labourers into his harvest.

Then there is a bit of radio silence, until finally Slush Pool started self advertising for the first time on block 163970 (2012-01-26):

/P2SH/BIP16/slush/R,

They had been mining for a long time by then (December 2010 according to en.bitcoin.it/wiki/Slush_Pool), but this is when they decided to add a human readable ASCII message as well.

From then on, miner messages would be forever polluted with ads, and Luke's multi-miner message feat would never again be reproduced.

The non-obvious interruptions are all well known memes/anime references:

"I like turtles": knowyourmeme.com/memes/i-like-turtles
Combo breaker: knowyourmeme.com/memes/combo-breaker
"Yukkuri Shiteitte ne": knowyourmeme.com/memes/yukkuri-shiteitte-ne
"kLhLUKE-JR IS A Pedophile! Oh, and God isn't real, sucka. Stop polluting the blockchain with your nonsense.", tx 9740e7d646f5278603c04706a366716e5e87212c57395e0d24761c0ae784b2c6, block 141460
"Help me, ERINNNNNN!!": touhou.fandom.com/wiki/Lyrics:_Help_me,_ERINNNNNN!!
"EASY MODO? How lame!F?": knowyourmeme.com/memes/kimoi-girls

Bibliography:

2011-08-19 bitcointalk.org/index.php?topic=38007.0 "Eligius miners aware of prayers in block headers?" from on bitcointalk.org by user "Graet" who quotes prior discussion from a Bitcoin IRC channel:
cosurgi: by design, it contains "random" data-- I've just been setting some of that "random" data to prayers
mm interesting luke-jr i understand you are strong in your faith but you dont think putting prayers in might alienate some ppl - after all btc is multidenominational
Graet: Catholics do not believe in freedom of religion.
and you make your non catholic miners aware of this?
2011-11-02 bitcointalk.org/index.php?topic=52979.0 "Mysterious transaction spotted in blockchain!"

 Read the full article

Cool data embedded in the Bitcoin blockchain / Len Sassaman tribute by

Ciro Santilli 37  Updated 2025-07-11  +Created 1970-01-01

 View more

Tribute to computer security researcher Len Sassaman, who killed himself on 2011-07-03, starting with an ASCII art portrait followed by text.

Because it comes so early in the blockchain, and because it is the first ASCII art on the blochain as far as we can see, and because is so well done, this is by far the most visible ASCII art of the Bitcoin blockchain.

Present at tx 930a2114cdaa86e1fac46d15c74e81c09eee1d4150ff9d48e76cb0697d8e1d72. It does not show well on Bitcoin Inscription Indexer however with rationale described at: github.com/cirosantilli/bitcoin-inscription-indexer/tree/3f53e152ec9bb0d070dbcb8f9249d92f89effa70#smart-newline-joining

But it can be seen at on bitcoinStrings.com at: bitcoinstrings.com/blk00003.txt.

Transaction: www.blockchain.com/btc/tx/930a2114cdaa86e1fac46d15c74e81c09eee1d4150ff9d48e76cb0697d8e1d72 from 2011-07-30, a few weeks after the suicide.

Discussion: bitcoin.stackexchange.com/questions/3370/in-which-block-was-len-sassaman-memorialised/101276#101276

Created by famous computer security researcher Dan Kaminsky and Travis Goodspeed, presumably this other security researcher, evidence:

signature on the tribute
the art is highlighted at Video 1. "Black OPS of TCP/IP by Dan Kaminsky (2011)", which happened very few days after the art was uploaded to the blockchain, thus making it exceedingly unlikely that someone else could have done it

"Bernanke" is a reference to Ben Bernanke, who was one of the economists in power in the US Government during the financial crisis of 2007-2008, and much criticized by some, as shown for example in the documentary Inside Job (2010). As hinted in the Genesis block message, the United States Government bailed out many big banks that were going to go bankrupt with taxpayer money, even though it was precisly those banks that had started the crisis through their reckless investment, thus violating principles of the free market and business accountability. This was one of the motivations for the creation Bitcoin, which could reduce government power over economic policy.

It is worth mentioning that there do exist some slightly earlier "artistic" inscriptions in the form Punycode inscription in the Namecoin blockchain, but as far as we've seen, the are all trivial compared to BitLen in terms of artistic value/size.

---BEGIN TRIBUTE---
#./BitLen
:::::::::::::::::::
:::::::.::.::.:.:::
:.: :.' ' ' ' ' : :
:.:'' ,,xiW,"4x, ''
:  ,dWWWXXXXi,4WX,
' dWWWXXX7"     `X,
 lWWWXX7   __   _ X
:WWWXX7 ,xXX7' "^^X
lWWWX7, _.+,, _.+.,
:WWW7,. `^"-" ,^-'
 WW",X:        X,
 "7^^Xl.    _(_x7'
 l ( :X:       __ _
 `. " XX  ,xxWWWWX7
  )X- "" 4X" .___.
,W X     :Xi  _,,_
WW X      4XiyXWWXd
"" ,,      4XWWWWXX
, R7X,       "^447^
R, "4RXk,      _, ,
TWk  "4RXXi,   X',x
lTWk,  "4RRR7' 4 XH
:lWWWk,  ^"     `4
::TTXWWi,_  Xll :..
=-=-=-=-=-=-=-=-=-=
LEN "rabbi" SASSAMA
     1980-2011
Len was our friend.
A brilliant mind,
a kind soul, and
a devious schemer;
husband to Meredith
brother to Calvin,
son to Jim and
Dana Hartshorn,
coauthor and
cofounder and
Shmoo and so much
more.  We dedicate
this silly hack to
Len, who would have
found it absolutely
hilarious.
--Dan Kaminsky,
Travis Goodspeed
P.S.  My apologies,
BitCoin people.  He
also would have
LOL'd at BitCoin's
new dependency upon
   ASCII BERNANKE
:'::.:::::.:::.::.:
: :.: ' ' ' ' : :':
:.:     _.__    '.:
:   _,^"   "^x,   :
'  x7'        `4,
 XX7            4XX
 XX              XX
 Xl ,xxx,   ,xxx,XX
( ' _,+o, | ,o+,"
 4   "-^' X "^-'" 7
 l,     ( ))     ,X
 :Xx,_ ,xXXXxx,_,XX
  4XXiX'-___-`XXXX'
   4XXi,_   _iXX7'
  , `4XXXXXXXXX^ _,
  Xx,  ""^^^XX7,xX
W,"4WWx,_ _,XxWWX7'
Xwi, "4WW7""4WW7',W
TXXWw, ^7 Xk 47 ,WH
:TXXXWw,_ "), ,wWT:
::TTXXWWW lXl WWT:
----END TRIBUTE----

Code 1.

Len Sassaman tribute

Video 1.

Black OPS of TCP/IP by Dan Kaminsky (2011)

Source. Presented at the BlackHat 2011 conference. Dan unveils the Len memorial at the given timestamp around 8:41. The presentation was done on 2011-08-03 or 04, so very few days after the upload to the blockchain.

From the JSON transaction we understand the encoding format:

   "out":[
      {
         "spent":false,
         "tx_index":0,
         "type":0,
         "addr":"1CqKQ2EqUscMkeYRFMmgepNGtfKynXzKW7",
         "value":1000000,
         "n":0,
         "script":"76a91481ccb4ee682bc1da3bda70176b7ccc616a6ba9da88ac"
      },
      {
         "spent":false,
         "tx_index":0,
         "type":0,
         "addr":"157sXa7duStAvq3dPLWe7J449sgh47eHzw",
         "value":1000000,
         "n":1,
         "script":"76a9142d2d2d424547494e20545249425554452d2d2d2088ac"
      },
...
      {
         "spent":false,
         "tx_index":0,
         "type":0,
         "addr":"157sXYpjvAyEJ6TdVFaVzmoETAQnHB6FGU",
         "value":1000000,
         "n":77,
         "script":"76a9142d2d2d2d454e4420545249425554452d2d2d2d2088ac"
      }

So it is really encoded one line at a time in the script of the transaction outputs.

 Read the full article

AlphaFold by