<epigraph>
  <attribution>Donald Knuth</attribution
  <simpara>
    A person who is more than casually interested in computers
    should be well schooled in machine language, since it is a
    fundamental part of a computer.
  </simpara>
</epigraph>

<simpara>
  The scanners in <xref linkend="turn.the.pages"> and
  <xref linkend="second.scan"> check program layout for deviations.
  On a typical Linux distribution this yields good results
  since all programs are compiled and linked with the same
  set of tools. But there are legitimate reasons for executables
  to look different. Some rescue tools and non-free executables
  are linked statically to be independent of the target system.
  And then there is
  <ulink url="&http.asmutils;">asmutils</ulink> on
  <ulink url="&http.linuxassembly;">&http.linuxassembly;</ulink>
</simpara>
<blockquote>
  <simpara>
    asmutils is a set of miscellaneous utilities written in
    assembly language, targeted on embedded systems and small
    distributions (e.g. installation or rescue disks); also it
    contains a small libc and a crypto library. It features the
    smallest possible size and memory requirements, the fastest
    speed, and offers fairly good functionality.
  </simpara>
</blockquote>

<simpara>
  The next best approach is to follow the flow of control
  and verify visited code, starting from the entry point.
  Again this relies on a certain homogeneity of executables.
</simpara>

<orderedlist>
  <listitem>
    <simpara>
      A very simple check is alignment.
      We handle that <link linkend="copy.and.infect">here</link>
      and <link linkend="copy.and.infect.v2">here</link>.
      <citerefentry>
	<refentrytitle>gcc</refentrytitle>
	<manvolnum>1</manvolnum>
      </citerefentry> never starts functions on odd addresses.
      But neither VIT nor <link linkend="rst">RST</link> seem
      to care and put the infection after the last byte of the
      code segment.
    </simpara>
  </listitem>
  <listitem>
    <simpara>
      The improved versions of <function>patchEntryAddr</function>
      in <xref linkend="entry.point"> do a primitive check of the call
      to <function>&calc.sh.gdb.call0.name;</function>.
      Since we leave the entry point unmodified we pass this test.
    </simpara>
  </listitem>
  <listitem>
    <simpara>
      The next step is to check entry code of functions called by
      <function>&calc.sh.gdb.call0.name;</function>,
      especially <function>main</function>.
      We are vulnerable to this.
    </simpara>
  </listitem>
</orderedlist>

<sect2>
  <title>Stack dump</title>

  <simpara>
    Have a look at the
    <link linkend="output.magic.elf.gdb">disassembly</link>
    of a very simple <function>main</function>. The interesting part
    are the first three lines. The <literal>push</literal> and the
    <literal>pop</literal> set up a stack frame. The following
    <literal>sub</literal> reserves stack space for local variables,
    though the example does not use it. Let's examine the stack just
    after the <literal>sub</literal> was executed.
  </simpara>

  <formalpara>
    <title>Command</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../src/stub_revisited/gdb.sh"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>
  <formalpara>
    <title>Output</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../out/stub_revisited/gdb"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

  <informaltable frame="none" pgwide="1">
    <tgroup cols="2">
      <thead>
	<row>
	  <entry>Address</entry>
	  <entry>Contents</entry>
	</row>
      </thead>
      <tbody>
        <row>
          <entry><literal>esp + 16 = ebp + 4</literal></entry>
          <entry>return address</entry>
        </row>
        <row>
          <entry><literal>esp + 12 = ebp + 0</literal></entry>
          <entry>saved ebp</entry>
        </row>
      </tbody>
    </tgroup>
  </informaltable>

</sect2>
<sect2>
  <title>Implementation</title>

  <formalpara>
    <title>Source - infection.asm</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../src/stub_revisited/infection.asm"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>
  <formalpara>
    <title>Source - infection.inc</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../out/stub_revisited/infection.inc"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

  <formalpara>
    <title>Source</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../src/stub_revisited/entry_point_ofs.inc"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
<sect2>
  <title>Test run</title>

  <formalpara>
    <title>Output</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../out/stub_revisited/three/cc"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

  <formalpara>
    <title>Output</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../out/stub_revisited/test"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
