<epigraph>
  <attribution>J. Gustav White</attribution>
  <simpara
    >One can search the brain with a microscope and not find the mind,
    and can search the stars with a telescope and not find God.</simpara>
</epigraph>

<simpara
  >After finding an exploitable peculiarity you need to verify
  its existence in a typical population of target executables.
  Some peculiarities can be used only once, i.e. filling the
  segment gap on i386 removes the gap. This makes the following
  scripts kind of dual-use technology.
</simpara>

<sect2 id="scan.driver.scripts">
  <title>Driver scripts</title>

  <simpara
    >Scanner scripts read a list of file names from
    <literal>stdin</literal>, one file name per line.
    Human readable output is written to <literal>stdout</literal>,
    with the convention that clean targets create no output.
    Since the scripts just parse the output of another tool
    performance is generally bad. Use of 
    <citerefentry>
      <refentrytitle>file</refentrytitle>
      <manvolnum>1</manvolnum>
    </citerefentry> as a fast file-type is the best we can do to lower
    noise and duration to acceptable regions.
  </simpara>
  <simpara
    >The following driver script are configurable.
    First arguments is the output file.
    Second argument is the file name of the scanner.
    Third argument is required postfix of target file names.
    A quoted empty string (<literal>""</literal>) accepts all
    files in target directories. The other typical value is
    <literal>"_infected"</literal> since this postfix is used by all
    examples in this document. All other arguments are directory
    names passed on to 
    <citerefentry>
      <refentrytitle>find</refentrytitle>
      <manvolnum>1</manvolnum>
    </citerefentry>.
  </simpara>

  <formalpara>
    <title>Source: src/scanner/driver.sh</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
        fileref="../src/scanner/driver.sh"
      /></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
<sect2 id="scan.segment.padding" xreflabel="Scan segment padding">
  <title>Scan segment padding</title>

  <simpara
    >The input is expected to be the output of
    <command>objdump <option>-p</option></command> (for multiple files).
    Input is parsed for lines starting with the word <literal>LOAD</literal>.
    The end of the segment is calculated and stored for the next line.
    The distance from the start of a <literal>LOAD</literal>
    segment to the end of the previous one is than compared with
    two values. See <xref linkend="segment.padding"/> for an
    overview of <literal>_SC_PAGESIZE</literal> and
    <literal>Alignment</literal>. Actual values for a specific
    platform are at &yref.packages;.
  </simpara>
  <simpara
    >Output is at &yref.segment.padding;. Its meaning is ambigious.
    We can positively tell whether the gap exists or not. But we cannot
    say whether the gap never existed or is indeed occupied by an
    infection.
    On platforms other than i386 alignment is larger than page size.
    It is possible that a small infection taking just one page
    affects a single target more than once and still leaves a gap
    larger than the segment alignment. These cases go undetected
    by this script.
  </simpara>
  <simpara
    >Anyway, <literal>det_page</literal> is the number of files
    detected to have a gap smaller equal one page (no further infection
    possible). <literal>det_align</literal> is the number of files
    where the gap is smaller than segment alignment (probably infected).
    Obviously these criteria overlap.
  </simpara>

  <formalpara>
    <title>Source: src/scanner/dist.pl</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
        fileref="../src/scanner/dist.pl"
      /></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
<sect2 id="scan.entry.point" xreflabel="Scan entry point">
  <title>Scan entry point</title>

  <simpara
    >For each file the start of section <literal>.text</literal>
    should equal the entry point. See &yref.sections; for background
    and output.
  </simpara>

  <formalpara>
    <title>Source: src/scanner/entry_point.pl</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
        fileref="../src/scanner/entry_point.pl"
      /></imageobject></inlinemediaobject></programlisting
    ></para>
  </formalpara>

</sect2>
