- su.virus (2:465/215) --------------------------------------------- su.virus -
 From : andrew baranovich                   2:465/215       sat 09 jul 05 18:03
 To   : All                                                 sat 09 jul 05 18:03
 Subj : Obfuscated! :-)
-------------------------------------------------------------------------------

        , ! -)

            ,      
         ,    . 
        ""  .

         -   arch (
             # rpm -qf `which arch`
             util-linux-2.11f-12.asp
        ),       
        .  ,    'obfuscated'    
            .  !
        ,  ,   .

        ,   ,     
         ,    .  ,    
         ? -))) ,     
         ,     .
        , , . -  . -)))

- su.virus (2:465/215) --------------------------------------------- su.virus -
 From : andrew baranovich                   2:465/215       thu 14 jul 05 09:36
 To   : Yuriy Saloid                                        thu 14 jul 05 09:37
 Subj : Virus.Linux.Grip.a, was: Obfuscated! :-)
-------------------------------------------------------------------------------
Yuriy Saloid wrote to Alexey Podtoptalow:

 YS>  ...         ,
 YS> ,     -    -
 YS>  ;)

             .    
         BrainFuck (   ""),
             (Urban Mueller) -  1993,
              -.
          ,     .   
        :

|       +   +1     
|       -   -1     
|       <    
|       >    
|       .      
|       ,       
|       [    0,    ]
|       ]     0,    [

         ,    BrainFuck   
         2  (     )  
        sed:

|       $cat bfcc.sed
|       1a      \
|       main(){char c[30000],*p=c;memset(c,0,30000);
|       # strip comments
|       s/[a-zA-Z0-9\|\\\(\)\$\^\-\*#=]//g
|       s/+/++*p;/g
|       s/-/--*p;/g
|       s/</--p;/g
|       s/>/++p;/g
|       s/\./putchar(*p);/g
|       s/\,/*p=getchar();/g
|       s/\]/}/g
|       s/\[/while(*p)\{/g
|       $a      \
|       }
|
|       $ cat hello.bf
|       Hello World program
|       >+++++++++[<++++++++>-]<.>+++++++[<++++>-]<+.+++++++.
|       .+++.[-]>++++++++[<++++>-]<.#>+++++++++++[<+++++>-]<.
|       >++++++++[<+++>-]<.+++.------.--------.[-]>++++++++[<
|       ++++>-]<+.[-]++++++++++.
|
|       $ sed -f bfcc.sed hello.bf|gcc -xc -o hello -
|       $ ./hello
|       Hello World!

        ,    :

        [  ]      .
           30000     . EOF
           .      
           . EOL - 0x0A,  ,
         ,   .  
        BrainFuck   BrainFuck:

|       >>>+[[-]>>[-]++>+>+++++++[<++++>>++<-]++>>+>+>+++++[>++>++++++
|       <<-]+>>>,<++[[>[->>]<[>>]<<-]<[<]<+>>[>]>[<+>-[[<+>-]>]<[[[-]<
|       ]++<-[<+++++++++>[<->-]>>]>>]]<<]<]<[[<]>[[>]>>[>>]+[<<]<[<]<+
|       >>-]>[>]+[->>]<<<<[[<<]<[<]+<<[+>+<<-[>-->+<<-[>+<[>>+<<-]]]>[
|       <+>-]<]++>>-->[>]>>[>>]]<<[>>+<[[<]<]>[[<<]<[<]+[-<+>>-[<<+>++
|       >-[<->[<<+>>-]]]<[>+<-]>]>[>]>]>[>>]>>]<<[>>+>>+>>]<<[->>>>>>>
|       >]<<[>.>>>>>>>]<<[>->>>>>]<<[>,>>>]<<[>+>]<<[+<<]<]
        [input a brainfuck program and its input, separated by an
        exclamation point. Daniel B Cristofani (cristofdathevanetdotcom)
        http://www.hevanet.com/cristofd/brainfuck/]

          C (  ):

        char m[9999],*n[99],*r=m,*p=m+5000,**s=n,d,c;main(){for(read(0,r,p)
        ;c=*r++;c-93?c-91?d?0:c-43&~2?c-44?c-46?p+=c&~2^60?0:c%4-1:write(1,
        p,1):read(2,p,1):(*p-=c-44):d++||(*++s=r):d&&--d?0:*p?r=*s:--s);}

           :

; BrainFuck interpreter herm1t'2005 (http://vx.netlux.org/herm1t/)
;   
; void bf(uint8_t *code, uint8_t *core, int(*gc)(void),int(*pc)(int))
bfi:    db  0x60, 0x89, 0xe5, 0x8b, 0x75, 0x24, 0x8b, 0x7d
        db  0x28, 0xfc, 0xe8, 0x02, 0x00, 0x00, 0x00, 0xeb
        db  0xf9, 0x31, 0xc0, 0xac, 0x09, 0xc0, 0x74, 0x5a
        db  0x3c, 0x2b, 0x75, 0x03, 0xfe, 0x07, 0xc3, 0x3c
        db  0x2d, 0x75, 0x03, 0xfe, 0x0f, 0xc3, 0x3c, 0x3e
        db  0x75, 0x02, 0x47, 0xc3, 0x3c, 0x3c, 0x75, 0x02
        db  0x4f, 0xc3, 0x3c, 0x2e, 0x75, 0x08, 0x8a, 0x07
        db  0x50, 0xff, 0x55, 0x30, 0x58, 0xc3, 0x3c, 0x2c
        db  0x75, 0x06, 0xff, 0x55, 0x2c, 0x88, 0x07, 0xc3
        db  0x3c, 0x5b, 0x75, 0xfb, 0x89, 0xf3, 0x0f, 0xb6
        db  0x0f, 0xac, 0x3c, 0x5d, 0x75, 0x09, 0x80, 0x3f
        db  0x00, 0x74, 0xec, 0x89, 0xde, 0xeb, 0xf2, 0x3c
        db  0x5b, 0x74, 0x03, 0x67, 0xe3, 0xeb, 0x53, 0x51
        db  0x4e, 0xe8, 0xa3, 0xff, 0xff, 0xff, 0x59, 0x5b
        db  0xeb, 0xdf, 0x89, 0xec, 0x61, 0xc3

          ,       
             ,   
           ,   Linux.Grip.a. ,
          ,      . -)

            ELF-.  
          . PT_NOTE   PT_LOAD. p_offset = filesize,
        p_align = 1, p_vadr = p_padr = ALIGN(min(PHDR.p_vaddr) - VSIZE, 4096),
        p_filesize = p_memsize = sizeof(virus) - , ,  ,
               bf-,  
                  < PAGE_SIZE,
           - ,     , 
        -    (fs/binfmt_elf.c).   .
        ,       ,   FreeBSD,    
         ELF-.    ,   
        LDE32 ( )  call,  ,     .
                .

          .  : "!"   .  
        .     XOR'  (, !),
           XOR' ( !)    
            XTEA (  by
        Farshid Mossaiby).  XTEA    .
           ,  -   TZ#1  
          ent. seed = time(NULL) ^ getpid() ^ RDTSC.HI ^ RDTSC.LO.

        .    .    BrainFuck?

         -     .   , 
           ,       -
        , ,  .   , 
             BF.  :

int _sqrt(int x)
{
        register int r;
        x = (x+1) >> 1;
        for (r = 0; x > r; x -= r++)
                ;
        return r;
}

#define S(c)    *code++ = c;
#define M(c,n)  for (i = 0; i < n; i++) S(c)
char *mk(char *code, int n)
{
        int     x, y, t, i;
        char    cmd;

        x = y = _sqrt(n);
        while ((t = (x * y)) < n)
                y++;
        t -= n;
        assert((x * y - t) == n);

        S('>');
        M('+', x)
        S('[');
        S('<');
        M('+', y)
        S('>');
        S('-');
        S(']');
        S('<');
        if (t < 0) {
                t = -t;
                cmd = '+';
        } else {
                cmd = '-';
        }
        M(cmd, t);
        S('>');

        return code;
}

        ,   mk,     ( 
         ). , xtea_decipher   
            .  , , .
               ,  
          . .   . "  
         ",     ,     ,
            ,     . ,   
            .

p.s.           :

                     .....
                 ..$MMMMMMM$..
               .$MMM$"$M$"$MMM$.
              $MMMM$" "M" "$MMMM$
            .$MMMMM!   $   !MMMMM$.
           .$MMMMMM:      :MMMMMM$.
           $MMMMMMM:   $   :MMMMMMM$
           M$M" "MM!   M   !MM" "M$M
           $$ ."MMM$. .M. .$MMM". $$
           "$MM "MMM$.$M$.$MMM" MM$"
            "$MM  "MMMMMMMMM"  MM$"
              $MM$  "$$M$$"  $MM$
               "$M$.       .$M$"
                 ""$$m...m$$""
                     """""

