[Trap Archetype] The "Vampire" and Control-Flow Hijacking in Cybersecurity
Instead of killing with DAT, Vampire hurls calibrated JMP traps ("Fangs") that hijack enemy execution pointers into a lethal Pit
Experience the advanced Vampire archetype! Instead of throwing DAT bombs, a Vampire hurls a calibrated JMP trap (called a "Fang") that forces any enemy process stepping on it to jump straight into the Vampire's lethal Pit (0004)!
- Row 0002 (JMP.A $-396, #390) is the Fang. - When this Fang lands on 0400 and the enemy executes it, the enemy's pointer jumps 400 - 396 = 0004—straight into your DAT pit!
🎯 Your Task Change the highlighted B (Right Value) of the Fang on row 0002 from #390 to #398 (0002 + 398 = 0400) and press [PLAY] to abduct the enemy into your Pit!
1. The Fourth Archetype ("Vampire"): Why Abduct Instead of Kill?
In Step 29, you unleashed the most deceptive and intellectually fascinating archetype in CoreWar: the Vampire.
Every offensive warrior we built previously (Dwarf, Stone, and Scissors) attacked by hurling passive "DAT" bombs to kill the enemy's process on the spot. A Vampire does something far more sinister. Instead of throwing a "DAT" cell, a Vampire throws a carefully calibrated "JMP" instruction—called a "Fang"—into enemy territory. When an enemy execution pointer steps onto that Fang, it does not die immediately; instead, its Program Counter is hijacked and forced to jump across memory straight into the Vampire's internal prison chamber, known as "The Pit"!
Look at the anatomy of your Vampire in Step 29: - Row 0002 (The Fang): "JMP.A $-396, #398" - Rows 0003–0004 (The Pit): "SPL.A $1, #0" followed by "DAT.F #0, #0" When Line 1 ("MOV.I $2, @2") executed, it copied the Fang at Row 0002 and launched it via "@2" (0002 + 398 = Address 0400) directly onto the enemy! On the enemy's very next turn at Address 0400, the enemy executed your injected Fang ("JMP.A $-396"), which rewrote the enemy's Program Counter to 0400 - 396 = Address 0004—hurling the enemy's soul straight into your lethal Pit!
[0000] MOV.I $2, @2 ──(Launches the Fang at [0002] to 0002 + 398 = [0400])──┐
[0001] JMP.A $-1, #0 │
[0002] JMP.A $-396, #398 ──► 🧛 THE FANG (Calibrated JMP Trap) ▼
[0003] SPL.A $1, #0 ──┐ [0400] JMP.A $-396, #398
[0004] DAT.F #0, #0 ◄─┴─ 💀 THE PIT ◄──(Enemy at 0400 jumps 400 - 396 = 0004!)──┘2. The Genius of "The Pit": Why Process Starvation Beats Instant Death
A natural question arises: "If the enemy just jumps to Address 0004 and dies on a DAT cell anyway, why not just throw a DAT bomb at Address 0400 in the first place?"
Against a single-process target, both achieve a quick kill. Against a multi-process opponent like Paper (which has 10 or 20 active threads in its FIFO queue), however, throwing a DAT bomb is often counterproductive—whereas a Vampire Pit is devastating!
Think back to the 1/N Round-Robin scheduling law from Step 22: - If an enemy has 10 processes and you kill 1 of them with a DAT bomb, the remaining 9 enemy processes actually SPEED UP (each now gets 1/9th of the CPU turns instead of 1/10th)! - Now look at what a real Vampire Pit (like "SPL $0" above "JMP $-1" or "DAT") does when it abducts just ONE of the enemy's threads: instead of killing the abducted thread right away, the Pit forces the enemy thread to execute "SPL" over and over again inside the prison!
Suddenly, that single captured enemy thread multiplies into 50, 100, or 500 trapped prisoner threads inside your Pit! Because all 500 prisoner threads belong to the enemy's FIFO queue, the enemy's healthy colonies outside the Pit are starved of CPU cycles—slowing to 1/500th speed (Process Starvation / CPU DoS) while the Vampire leisurely finishes them off!
3. Direct Parallel in Cybersecurity: Control-Flow Hijacking and ROP
From a computer science and cybersecurity perspective, the Vampire archetype is a textbook demonstration of Control-Flow Hijacking.
In real-world exploit engineering, attackers rarely want to merely crash a target server (a simple Denial of Service, equivalent to a DAT bomb). Instead, sophisticated exploits overwrite a function pointer, a virtual method table (vtable) entry, or a stack return address with a carefully calculated offset—a "Fang"—that redirects the victim process's Instruction Pointer (PC) into a payload controlled by the attacker (the "Pit", such as shellcode or a Return-Oriented Programming / ROP chain).
Notice too the mathematical challenge of crafting a Fang in CoreWar: because JMP uses PC-relative addressing, if a Vampire throws Fangs across memory using a loop, it must simultaneously increment the Fang's B-field (+S to advance the throw distance) AND decrement the Fang's A-field (-S so that from the further landing site, the jump offset still points back to the exact same Pit!). To defend real computers against Vampire-style pointer redirection, modern CPUs (like Intel CET and ARM PAC) now implement hardware Control-Flow Integrity (CFI).
🔒 MISSION CLEAR Unlocks the Full Lecture Note
Complete the experiment in the simulator above to automatically unlock the full deep-dive article—or click below to read the full text immediately.