- [Duke's Virus Labs #10] - [Page 28] -

Linux 
(c) by ULTRAS/MATRiX

 ⮩   ஡ ᭨     Linux.
  ⠭  稭  ᠭ ᮢ   
.

Linux 祭 宦    0,     
ணࠬ    祬  ⠪ .      稭 
 ந 맮  ᬥ  linux.  ᨬ  eax  ⥬ 
맮,  ebx & ecx & edx  ᨬ 㬥. ,  ᨬ  ᠬ 
㬥,   . 뢠 syscall- linux- 뢠 int80.

ਬ ணࠬ
~~~~~~~~~~~~~~~~

global main

section .data
main:

    mov eax,0bh		;  㭪 11() - execve
    mov ebx,filez	;   䠩 ஥   
    mov ecx,parz	;  ࠬ
    xor edx,edx
    int 80h		;  SysCall
    mov eax,1		;  㭪 1(室) - exit
    mov ebx,0		;  ࠬ 室
    int 80h		;  SysCall

filez db '/bin/ping',0	;   ணࠬ ஥ 㦭 
parz  dd filez		;    䠩
      dd par_1		;   ࠬ  ᪠ 䠩
      dd par_1		;  ன ࠬ  ᪠ 䠩
      dd 0		;  稫 ࠬ
par_1 db 'www.coderz.net/ultras',0
par_2 db '3',0



 쪠 ணࠬ 믮 ᫥騥 ⢨:

ping www.coderz.net/ultras 3

 祭      0.

Syscall
~~~~~~~

쪨 ᯨ᮪ 㭪権    ᠭ ᮢ  
ணࠬ  linux.

01 - exit     
02 - fork     
03 - read     
04 - write     
05 - open
06 - close    
08 - creat    
11 - execve   
12 - chdir     
15 - chmod
19 - lseek    
26 - ptrace   
37 - kill     
89 - readdir   
90 - mmap

 ᯨ᮪ 㭪権  : /usr/include/asm/unistd.h

 ELF 䠩
~~~~~~~~~~~~~~~~~~~~

 ELF 䠩  ਬ୮ ⠪ :
 
  +---------------------------+
          ELF Header         
  +---------------------------+
       Program head table    
  +---------------------------+
  	.text section	      +
  +---------------------------+
       .data section         
  +---------------------------+
           .........         
  +---------------------------+
      Section header table   
  +---------------------------+
          Section(s)         
  +---------------------------+

 룫廊 ⠭p  ELF.

  0  e_ident     -  䫠
+10  e_type	 - ⨯ 䠩
+12  e_machine   - p⥪p ⥬
+14  e_version   - p ꥪ
+18  e_entry     - entry point
+1c  e_phoff     - ᬥ饭 pp 
+20  e_shoff     - ᬥ饭 ᥪ樮 
+24  e_flags     - pp 䫠
+28  e_ehsize    - pp  ELF
+2A  e_phentsize - pp 祩 pp 奤
+2C  e_phnum     - ⢮ 祥
+2E  e_shentsize - pp 祩 ᥪ樮 奤
+30  e_shunum    - ⢮ 祥
+32  e_shstrndx  - ᭠ p ᥪ樮 奤

 룫廊 pp  ELF.

  0  p_type	 - ⨯ ᥣ
 +4  p_offset    - ᬥ饭  䠩
 +8  p_vaddr     - p㠫 p ᥣ
 +c  p_addr      - 䨧᪨ p ᥣ
+10  p_filesz    - pp ᥣ  䠩
+14  p_memsz     - pp ᥣ  
+18  p_flags     - ᥣ 䫠
+1c  p_align     - ᯮ ᥣ

 룫廊 ᥪ樮  ELF.

  0  sh_name     - ᮤন 㪠⥫   ᥪ権  . 
 +4  sh_type     - ⨯ ᥪ樨
 +8  sh_flags    - 䫠
 +c  sh_addr     - 䨧᪨ p ᥣ
+10  sh_offset   - ᬥ饭  䠩
+14  sh_size     - ࠧ ᥪ
+18  sh_link     -  ᯮ짮   ⨯ ᥪ樨
+1c  sh_info     -   ⨯ ᥪ樨
+20  sh_addralign- ᯮ ᥣ
+24  sh_entsize  - ᥪ ᮤন ⠭ 室 ࠧ


 ਬ୮ ⠪ 㤥 룫拉 header+hello world!
 ணࠬ  ᥣ  59 ⮢.

BITS 32
		org	0x68504000
		db	0x7F, "ELF"		; maGic numberz
		dd	1
		dd	0
		db	0
entry:		inc	eax			; ணࠬ 稭 
		push	eax
		push	dword 0x00030002
		xor	eax,eax			; 㫨 eax
		lea	edx,[byte eax + 13]	; 13 = ࠧ 
		inc	eax			; eax ⥯ = 1
		push	eax			; 1 = 室 (exit) syscall
		push	dword 4			; 4 = (write) syscall
		mov	ecx,msgtext		;  ecx ⨬ ᮮ饭
		xchg	eax,ebx			; 1 = stdout
done:		pop	eax
		int	0x80			; make the syscall
		dec	ebx			; 0 ==  ஡ 室  ணࠬ
		jmp	short done		; 맮 쭥訩 syscall
		dw	1
msgtext:	db	'hello, world', 10

 ᮡ⢥  ᠬ 奤  ᠭ  :

e_ident:	db	0x7F, "ELF"			; required
		db	1				; 1 = ELFCLASS32
		db	0				; 
		db	0				; 
		db	0x00, 0x00, 0x00, 0x00		; ᯮ짮
		db	0x00, 0x00, 0x40, 0x50, 0x68
e_type:		dw	2				; 2 = ET_EXE
e_machine:	dw	3				; 3 = EM_386
e_version:	dd	0x508DC031			; 
e_entry:	dd	entry				; ணࠬ 稭 
e_phoff:	dd	4				; phdrs located here
e_shoff:	dd	0x50402EB9			; 
e_flags:	dd	0xCD589368			; ᯮ짮
e_ehsize:	dw	0x4B80				; 
e_phentsize:	dw	0xFAEB				; 
e_phnum:	dw	1				;  phdr
e_shentsize:	dw	0x6568				; 
e_shnum:	dw	0x6C6C				; 
e_shstrndx:	dw	0x2C6F				; 

pp  ELF

p_type:	dd	1					; 1 = PT_LOAD
p_offset:	dd	0				; ⠥  竮 䠩
p_vaddr:	dd	$$				; 㧨  
p_paddr:	dd	0x00030002			; ᯮ㥬
p_filesz:	dd	0x508D30C1			; , 
p_memsz:	dd	entry				; १
p_flags:	dd	4				; 4 = PF_R (no PF_X?)
p_align:	dd	0x2EB9				; 

 ᫥   ஡ ஡  ஡ ᠭ  
 ᥪ権  ELF 䠩   㣮...

⮤ ࠦ
~~~~~~~~~~~~~~~~~

  ஡   ⮤ ࠦ ELF 䠩   .

1. ⮤

饬 ᥪ 樠஢  "bss"  ࠨ ᢮   ⮩ 
ᥪ樨,  ⮬  㢥 ࠧ ᥪ樨  ࠧ +ࠧ   
ᤢ  ⠢  䠩.  ࠧ     窨 
室 ELF-䠩.  ਣ   ᥡ,    
뢠  室   .  (㦭) २ 
ᥪ 'bss' ਬ  'bzz'    ਡ.

2. ⮤

稢 ࠧ ᫥ ᥪ樨 䠩    窨 室. ⥬ 
뢠 ᥡ   䠩  ⠭  窨 室  ᢮ .

3. ⮤

뢠   㦥 ᥪ , ।⥫쭮 
㢥稢  ࠧ  ࠧ . ࠥ ७ ଠ ELF 䠩, 
뢠  ᥪ権, ।  ࢮ ᥪ樨 , 
ᤢ    ᫥騥 ᥪ樨 , 뢠 ᢮ ᮡ⢥   
ࠧ襥 ࠭⢮  ⥬ 室 ࠧ ४㥬  
ᥪ権   "窨 室" -  楤,   । 
ࠢ  ᪥ 䠩.  ࠦ 䠩  "窨 室" 㪠뢠 
  .

4. ⮤

뢠 ᥡ  ᠬ 砫 ELF 䠩, । ࠦ 䠩 뢠 
᢮ ⥫  䠩 ⥫. ⮬ ⮡  䠩-⥫,  㦭 
ᮧ ६ 䠩  뢠   ⥫ 䠩-⥫  exec .

 ⮤  ᢮ ,     ⮤  ᢮ ⪨.

tnanx Silvio Cesare, Mandragore, dr.insane, paddingx


   							    -=ULTRAS=- (c) 2000
							    What`s my age again
