{"id":782,"date":"2014-05-02T04:07:05","date_gmt":"2014-05-02T04:07:05","guid":{"rendered":"http:\/\/www.gironsec.com\/blog\/?p=782"},"modified":"2014-05-02T21:34:32","modified_gmt":"2014-05-02T21:34:32","slug":"updates-updates-updates","status":"publish","type":"post","link":"https:\/\/www.gironsec.com\/blog\/2014\/05\/updates-updates-updates\/","title":{"rendered":"Updates! Updates! Updates!"},"content":{"rendered":"

Howdy all!<\/p>\n

It’s been a dog’s age. I’ve been busy with work and personal things. I enjoyed a brief 3 month relationship only to return to a life of loneliness. For now anyways.
\nCactusCon went well. Had a nice turn out for my work shop. Hopefully the attendees learned something as I tried to make it as interactive as possible. <\/p>\n

Now for the good stuff:<\/p>\n

I’ve been browsing the source code for Zues. Since its source code publication, many copycats have spawned. The part I was interested in was its VM detection, specifically virtualbox (since that’s what I use).
\n<\/p>\n

\n
\tif<\/span> (!<\/span>CheckReg("HARDWARE<\/span>\\\\<\/span>DESCRIPTION<\/span>\\\\<\/span>System"<\/span>,"SystemBiosVersion"<\/span>, szBuf, BUF_SIZE)) return<\/span> true<\/span>;\r\n\tif<\/span> (STR::<\/span>Pos("VBOX"<\/span>, szBuf)) return<\/span> true<\/span>;\r\n<\/pre>\n<\/div>\n
Seems like it only checks the registry. Good to know , but I wish they went into more depth. Check out the fill file here<\/a> or the whole thing on
\ngithub<\/a>.<\/p>\n
I recently discovered the holy grail<\/a> of anti-debugging techniques. 150 pages of awesome and I’m trying to go through it all. <\/p>\n
I’ve also figured out how to do the EBFE trick in my C programs:
\n<\/p>\n
\n
#define jump2self __asm _emit 0xEB __asm _emit 0xFE<\/span>\r\n<\/pre>\n<\/div>\n
The “emit” pseudo-function lets you insert 1 byte at a time into programs. It’s a bit more graceful than just jumping to a random place in memory and crashing.
\nThis allows me to insert asm instructions which may or may not be recognized by the compiler, but are accepted by the CPU. ICEBP<\/a> comes to mind (0xF1).
\n<\/p>\n
\n
#define iceBP __asm _emit 0xF1<\/span>\r\n<\/pre>\n<\/div>\n
This of course works best with Pelles C compiler. It’s a bit different when using something like MingW with CodeBlocks as it has to conform to *nix standards. Since there is no ‘__emit’ function \/ keyword on Linux, you have to do the following:
\n<\/p>\n
\n
    asm<\/span> __volatile__<\/span> (".byte 0xEB"<\/span>);\r\n    asm<\/span> __volatile__<\/span> (".byte 0xFE"<\/span>);\r\n<\/pre>\n<\/div>\n
<\/p>\n
\n
    asm<\/span> __volatile__<\/span> (".byte 0xF1"<\/span>);\r\n<\/pre>\n<\/div>\n
Aside from that, my work continues on my anti-virus program with strides being made in the driver. Expecting an alpha release just in time for blackhat \/ HOPE (which I am presenting at).<\/p>\n
I promise to have a more comprehensive blog post next time. Until next time, hack on!
\n\"1219376966785\"<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Howdy all! It’s been a dog’s age. I’ve been busy with work and personal things. I enjoyed a brief 3 month relationship only to return to a life of loneliness. For now anyways. CactusCon went well. Had a nice turn out for my work shop. Hopefully the attendees learned something as I tried to make […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[4,7],"tags":[82],"_links":{"self":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/782"}],"collection":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/comments?post=782"}],"version-history":[{"count":5,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/782\/revisions"}],"predecessor-version":[{"id":788,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/782\/revisions\/788"}],"wp:attachment":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/media?parent=782"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/categories?post=782"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/tags?post=782"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}