i was wondering, is there a way you can load compiled code into memory, and then run it that way? like making it into a char array, and then casting that into a function pointer or something?

reason is, a kickass polymorphic engine could be made from it.

It's called shellcode.

Yes, something like:

code:<pre>

char c[] = "\xf0\x0f\xc7\xc8";

int main(int argc, char **argv)

{

int (*func)();

func = (int (*)()) c;

(int)(*func)();

}

</pre>

Extra points for whoever can tell me what that code is for...



[This message has been edited by lifejunkie (edited 12-24-2004).]

Pentium foof crash.

quote:Stolen quote

Basically, the opcodes are an invalid form of cmpxchg8b eax with a lock prefix. Has anyone seen this before? The problem doesn't show itself for the Pentium Pro or Pentium 2.

Indeed.

Anyway, that's a basic way to get machine code into a .c file.

ok, i have a few more questions.

1) is it possible to copy the code part of an exe file and make shellcode off that (really im asking is there any way an exe can be stored as shellcode)

2) how do you find and edit the strings that get compiled in a program? (i've been looking and all i can find are programs that edit the string table)

3) what limits does windows impose on antivirus (can it scan a programs memory)

4) how exactly does antivirus counter polymorphism?

5) how far do you have to go to make antivirus scan a file, like if a program makes a file, does it scan it instantly?

quote:1) is it possible to copy the code part of an exe file and make shellcode off that (really im asking is there any way an exe can be stored as shellcode)

Shell code is used to get access to a machine. An .exe is a program. They are not related.

quote:

2) how do you find and edit the strings that get compiled in a program? (i've been looking and all i can find are programs that edit the string table)

Disassemble it.

quote:

3) what limits does windows impose on antivirus (can it scan a programs memory)

None, they have special device drivers to access memory and the hard drive directly.

quote:

4) how exactly does antivirus counter polymorphism?

Basically, they dont.

quote:

5) how far do you have to go to make antivirus scan a file, like if a program makes a file, does it scan it instantly?

Just navigate to the direcory that it's stored in.

4) Heuristics can be used but due to their nature they can be expected to give false positives and negatives, the number of occurrences of each depending on the "sensitivity" set by the antivirus authors. Instead of or in addition to scanning for strings of signatures of virii, the AV program can stick the program in question in a kind of emulator and wait for any virus-like activities to take place. Activities are rated on whether they are virus-like or not and add or subtract to/from a kind of rating that says its a virus if it reaches a predetermined level (this level determining sensitivity). Things like getting keyboard input would detract from this rating and opening an executable for writing would certainly increase it by a large amount if not immediately warning the user. Other things that might not come immediately to mind that would increase the "likelihood tracker" would be using NOPs or instructions larger than are normally used (e.g. MOV AX,1234h as C7 C0 34 12 instead of B8 34 12). I remember reading two pdfs from Norton AV about countering polymorphic virii and another about their heuristics described though I don't remember the url. :-( Now they're all optimistic about this stuff, but it doesn't always work as it's intended. :-/

5) If it's set to scan upon execution, reading, or writing then it will do so. Also your av program may monitor program activities and warn you if a program is attempting to append itself to an executable or something. So in short, it depends on how the user setup their AV program. Remember that some people don't even use AV programs at all, though most do.

thanks for the response,

i know shellcode is the wrong term, but i mean can it be run like shellcode is?

hey jamez, has your nick ever been jamez226 or something like that?

also is your name James Parker?



[This message has been edited by Spliffing (edited 12-29-2004).]