<epigraph>
  <attribution>Norm Schryer</attribution>
  <simpara>
    If the code and the comments disagree, then both are probably wrong.
  </simpara>
</epigraph>

<simpara>
  In <xref linkend="one.step.closer"> we inserted code into the gap
  between code and data segment. This loophole is rather small.
  And even worse, it is not too hard to check whether it is occupied.
  I still have no cure for that. Read the trail of my wrath.
</simpara>
<simpara>
  Well, just kidding. But mindless rage is a good excuse for
  actions that are doomed from the start. Of course my
  <link linkend="turn.the.pages">pestiferous piece of Perl</link>
  will detect the result of this chapter
  (<quote>has 3 LOAD segments</quote>).
  But then even the untrained eye can spot the difference
  in the output of
  <citerefentry>
    <refentrytitle>readelf</refentrytitle>
    <manvolnum>1</manvolnum>
  </citerefentry>.
  So why is this done at all?
</simpara>
<simpara>
  Because the method is very simple to implement and imposes no size
  limit on the code.
</simpara>

<sect2>
  <title>A simple plan</title>

  <simpara>
    Have a look at
    <citerefentry>
      <refentrytitle>readelf</refentrytitle>
      <manvolnum>1</manvolnum>
    </citerefentry>'s
    <link linkend="bashful.glance">output</link> on
    <filename>/bin/sh</filename>.
    The last program header is of type <literal>NOTE</literal>
    and has exactly &calc.infone.NOTE1.filesiz.X; bytes.
    So what's in there?
  </simpara>

  <formalpara>
    <title>Command</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific" fileref="../src/additional_cs/od.sh"
      ></imageobject></inlinemediaobject></programlisting
    </para
  </formalpara>
  <formalpara>
    <title>Output</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific" fileref="../out/additional_cs/od"
      ></imageobject></inlinemediaobject></programlisting
    </para
  </formalpara>

  <simpara>
    It's the magic of the GNU.
    In this special case we can live without.
  </simpara>

  <procedure>
    <step>
      <simpara>
	Overwrite program header of type of <literal>NOTE</literal>
        with a code segment definition (type <literal>LOAD</literal>).
      </simpara>
    </step>
    <step>
      <simpara>Append virus code at end of file.</simpara>
    </step>
  </procedure>

  <simpara>
    Having just &calc.infection.size; bytes,
    <link linkend="Target.infection">our unrealistic code</link>
    is small enough to fit into the <literal>NOTE</literal> segment.
    But let's pretend this is a real example.
    I will reuse the framework from <xref linkend="one.step.closer">.
  </simpara>

</sect2>
<sect2>
  <title>patchPhdr</title>

  <simpara>
    Double infection is
    <link linkend="patching.program.headers">again</link>
    impossible by design. If there is no <literal>PT_NOTE</literal>
    this target is out of reach.
  </simpara>

  <formalpara>
    <title>Source - patchPhdr</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific" fileref="../src/additional_cs/patch_phdr.inc"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
<sect2>
  <title>newEntryAddr</title>

  <simpara>
    We can use any memory region not already occupied.
    Using one below the magic base of &calc.base.addr; avoids trouble.
    See <xref linkend="INFECTION.SIZE"> for an explanation of
    <literal>% 0x1000</literal>.
  </simpara>
  <formalpara>
    <title>Source - newEntryAddr</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific" fileref="../src/additional_cs/new_entry_addr.inc"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
<sect2>
  <title>patchShdr</title>

  <simpara>
    Not implemented. To cover the bytes of the new <literal>LOAD</literal>
    segment with a section we would have to insert a new one in the
    array of section headers. Right now I'm not in the mood
    to invest so much time in a hopeless case.
  </simpara>
  <formalpara>
    <title>Source - patchShdr</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific" fileref="../src/additional_cs/patch_shdr.inc"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
<sect2 id="copy.and.infect.v2">
  <title>copyAndInfect</title>

  <formalpara>
    <title>Source - copyAndInfect</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific" fileref="../src/additional_cs/copy_and_infect.inc"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
<sect2 id="to.serve.and.detect">
  <title>To serve & detect</title>

  <formalpara>
    <title>Output - build</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific" fileref="../out/additional_cs/cc"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

  <formalpara>
    <title>Output - test</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific" fileref="../out/additional_cs/test"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

  <simpara>
    The method works, but is not safe to
    <citerefentry>
      <refentrytitle>strip</refentrytitle>
      <manvolnum>1</manvolnum>
    </citerefentry>.
    Well, on to
    <citerefentry>
      <refentrytitle>readelf</refentrytitle>
      <manvolnum>1</manvolnum>
    </citerefentry>.
    Compare it with <link linkend="bashful.glance">the original</link>.
  </simpara>

  <formalpara>
    <title>Output - readelf</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific" fileref="../out/additional_cs/segments"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

  <simpara>
    File size grew &calc.additional.cs.size; - &calc.sh.size; =
    &calc.additional.cs.size.delta.D; bytes.
    But even an unmodified entry point is pointless in this case.
    Anybody can notice <literal>LOAD</literal> instead of
    <literal>NOTE</literal>.
  </simpara>

  <formalpara>
    <title>Command - scan</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific" fileref="../src/additional_cs/scan_dist.sh"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>
  <formalpara>
    <title>Output - scan</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific" fileref="../out/additional_cs/scan"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

  <simpara>Case closed. Guilty of failure.</simpara>

</sect2>
