<epigraph>
  <attribution>U.S. News and World Report, 10/14/85</attribution
  <simpara>
    Attorney General Edwin Meese III explained why the Supreme Court's
    Miranda decision (holding that subjects have a right to remain silent
    and have a lawyer present during questioning) is unnecessary:
    <quote
      >You don't have many suspects who are innocent of a crime.
      That's contradictory. If a person is innocent of a crime,
      then he is not a suspect.</quote>
  </simpara>
</epigraph>

<simpara>
  The tricks shown in <xref linkend="doing.it.in.c"> raise a question.
  Is it possible to distinguish virus code from regular code
  by a static scan of the disassembly?
</simpara>
<simpara>
  The first problem is how to get at <quote>the code</quote>.
  Everything from the start of the file to the last byte of code is
  mapped into the code segment. This is described in
  <xref linkend="how.it.works"> and illustrated in
  <xref linkend="bashful.glance">. A virus could hide in a region
  declared as <acronym>ELF</acronym> header.
</simpara>
<simpara>
  A possible approach is to follow the flow of control starting with
  the entry point. Either compare it directly with expected code
  (see <xref linkend="entry.point">). Or verify addresses with the
  <acronym>ELF</acronym> header. This requires a certain homogeneity of
  executables.
  But it would be an easy way to detect all infective code shown so far.
  The entry code of both <link linkend="Target.infection"
    >One step closer to the edge</link>
  and <link linkend="the.stub">Doing it in C</link> differs from
  a regular function decoration.
</simpara>

<simpara>
  It's more fun to have a look at the sections of an executable file,
  however.
</simpara>

<sect2>
  <title>Extracting sections</title>

  <simpara>
    Here comes a script that extracts a single section from
    an executable as raw data.
    <citerefentry>
      <refentrytitle>readelf</refentrytitle>
      <manvolnum>1</manvolnum>
    </citerefentry> provides a related (but useless) option.
  </simpara>
  <blockquote>
    <simpara><option>-x &lt;number&gt;</option></simpara>
    <simpara><option>--hex-dump=&lt;number&gt;</option></simpara>
    <simpara>
      Displays the contents of the indicated section as a hexadecimal dump.
    </simpara>
  </blockquote>

  <formalpara>
    <title>Source - dumpsection.pl</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
	format="linespecific" fileref="../src/suspicious_code/dumpsection.pl"
      ></imageobject></inlinemediaobject></programlisting
    </para>
  </formalpara>

  <simpara>
    And the first test is simple. Compare the following output with
    <link linkend="output.entry.point.sh.gdb">
      <citerefentry>
	<refentrytitle>gdb</refentrytitle>
	<manvolnum>1</manvolnum>
      </citerefentry>'s dump
    </link> in <xref linkend="entry.point">.
  </simpara>
  <formalpara>
    <title>Command</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
	format="linespecific" fileref="../src/suspicious_code/ndisasm.sh"
      ></imageobject></inlinemediaobject></programlisting
    </para>
  </formalpara>
  <formalpara>
    <title>Output</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
	format="linespecific" fileref="../out/suspicious_code/ndisasm"
      ></imageobject></inlinemediaobject></programlisting
    </para>
  </formalpara>

</sect2>
