<epigraph>
  <attribution>Terry Pratchett, Moving Pictures</attribution>
  <simpara>It looks worse than you can imagine!</simpara>
  <simpara>I can imagine some pretty bad things!</simpara>
  <simpara>That's why I said *worse*!</simpara>
</epigraph>

<simpara>
  After emotions cooled down a bit we can examine the infected executable
  and compare it with <link linkend="bashful.glance">the original</link>.
</simpara>

<formalpara>
  <title>Command: src/entry_point/segments.sh</title>
  <para>
    <programlisting><inlinemediaobject><imageobject><imagedata
      format="linespecific"
      fileref="../src/entry_point/segments.sh"
    ></imageobject></inlinemediaobject></programlisting>
  </para>
</formalpara>

<formalpara>
  <title>Output: out/i386/entry_point/segments</title>
  <para>
    <programlisting><inlinemediaobject><imageobject><imagedata
      format="linespecific"
      fileref="../out/i386/entry_point/segments"
    ></imageobject></inlinemediaobject></programlisting>
  </para>
</formalpara>

<simpara>
  File size and code segment have grown as expected.
  Data segment and <literal>DYNAMIC</literal> segment moved accordingly:
</simpara>
<blockquote>
  <simpara>
    infected.file_size - sh.file_size =
    &calc.infone.size.D; - &calc.sh.size.D; =
    &calc.infone.size.delta.D; =
    &calc.infone.size.delta.X;
  </simpara>
  <simpara>
    infected.<literal>LOAD</literal>[1].<literal>Filesiz</literal> -
    sh.<literal>LOAD</literal>[1].<literal>Filesiz</literal> =
    &calc.infone.LOAD1.filesiz.X; -
    &calc.sh.LOAD1.filesiz.X; =
    &calc.infone.LOAD1.filesiz.delta.X;
  </simpara>
  <simpara>
    infected.<literal>LOAD</literal>[2].<literal>Offset</literal> -
    sh.<literal>LOAD</literal>[2].<literal>Offset</literal> =
    &calc.infone.LOAD2.offset.X; -
    &calc.sh.LOAD2.offset.X; =
    &calc.infone.LOAD2.offset.delta.X;
  </simpara>
  <simpara>
    infected.<literal>DYNAMIC</literal>.<literal>Offset</literal> -
    sh.<literal>DYNAMIC</literal>.<literal>Offset</literal> =
    &calc.infone.DYNAMIC1.offset.X; -
    &calc.sh.DYNAMIC1.offset.X; =
    &calc.infone.DYNAMIC1.offset.delta.X;
  </simpara>
</blockquote>

<sect2>
  <title>First scan</title>

  <simpara>
    The <link linkend="command.big.sh">big output</link> of the scanner
    from <xref linkend="turn.the.pages"> contains the executable
    from last chapter. But for clarity we repeat the exercise.
  </simpara>

  <formalpara>
    <title>Command: src/entry_point/scan_dist.sh</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../src/entry_point/scan_dist.sh"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>
  <formalpara>
    <title>Output: out/i386/entry_point/scan</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../out/i386/entry_point/scan"
      ></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

  <simpara>
    This is like playing chess against oneself, and losing.
    Can't do much about it, though.
  </simpara>

</sect2>
<sect2 id="looking.around">
  <title>Looking around</title>

  <simpara>
    The value of <literal>Entry point</literal> changed dramatically.
    In the original it is in the first part of the file:
  </simpara>
  <blockquote>
    <simpara>
      entry_point_ofs =
      &calc.sh.entry.point.X; - &calc.base.addr; = 
      &calc.sh.entry.point.start.ofs.X; =
      &calc.sh.entry.point.start.ofs.D; bytes.
    </simpara>
  </blockquote>

  <simpara>
    The infected copy moved that to less than
    <literal>&calc.sh.LOAD1.align.D;</literal>
    bytes from the end of the code segment.
  </simpara>

  <blockquote>
    <simpara>
      entry_point_ofs =
      &calc.infone.entry.point.X; - &calc.base.addr; = 
      &calc.infone.entry.point.start.ofs.X; =
      &calc.infone.entry.point.start.ofs.D; bytes.
    </simpara>
    <simpara>
      end_of_LOAD1 =
      &calc.infone.LOAD1.virtaddr.X; +
      &calc.infone.LOAD1.filesiz.X; =
      &calc.infone.LOAD1.end.X;
    </simpara>
    <simpara>
      entry_point_distance_to_end =
      &calc.infone.LOAD1.end.X; - 
      &calc.infone.entry.point.X; =
      &calc.infone.entry.point.dist.to.end.X; =
      &calc.infone.entry.point.dist.to.end.D;
    </simpara>
  </blockquote>

  <simpara>
    This is another easy vulnerability to scanners.
    But the bad news ain't over. 
    <citerefentry>
      <refentrytitle>readelf</refentrytitle>
      <manvolnum>1</manvolnum>
    </citerefentry> features another option, <option>-S</option>.
  </simpara>

  <formalpara>
    <title>Command: src/entry_point/sections.sh</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
	format="linespecific"
	fileref="../src/entry_point/sections.sh"
      ></imageobject></inlinemediaobject></programlisting
    </para>
  </formalpara>
  <formalpara>
    <title>Output: out/i386/entry_point/sections</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
	format="linespecific"
	fileref="../out/i386/entry_point/sections"
      ></imageobject></inlinemediaobject></programlisting
    </para>
  </formalpara>

  <simpara>
    The most interesting entry is <literal>.text</literal>.
    The start of the section, <literal>&calc.sh.text.addr.X;</literal>,
    equals the entry point as reported by option <option>-l</option> in
    <xref linkend="bashful.glance">.
  </simpara>

</sect2>
<sect2 id="second.scan" xreflabel="Second scan">
  <title>Second scan</title>

  <simpara>
    The following scanner compares the start of section
    <literal>.text</literal> with the entry point.
    It's structure is similar to the script from
    <xref linkend="turn.the.pages">.
  </simpara>

  <formalpara>
    <title>Source: src/scanner/entry_point.pl</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
	format="linespecific"
	fileref="../src/scanner/entry_point.pl"
      ></imageobject></inlinemediaobject></programlisting
    </para>
  </formalpara>

  <simpara>
    <link linkend="command.big.sh">Once again</link> we first test
    with typical places like <filename>/bin</filename>. Everything clean.
  </simpara>
  <formalpara>
    <title>Output: out/i386/scanner/entry_point_big</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
	format="linespecific"
	fileref="../out/i386/scanner/entry_point_big"
      ></imageobject></inlinemediaobject></programlisting
    </para>
  </formalpara>

  <simpara>
    <link linkend="command.small.sh">And then</link> with all infected
    executables. Only a few are detected. Which means there is cure
    against this vulnerability (just read on).
  </simpara>
  <formalpara>
    <title>Output: out/i386/scanner/entry_point_small</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
	format="linespecific"
	fileref="../out/i386/scanner/entry_point_small"
      ></imageobject></inlinemediaobject></programlisting
    </para>
  </formalpara>

</sect2>
