<epigraph>
  <attribution>U.S. News and World Report, 10/14/85</attribution>
  <simpara>
    Attorney General Edwin Meese III explained why the Supreme Court's
    Miranda decision (holding that subjects have a right to remain silent
    and have a lawyer present during questioning) is unnecessary:
    <quote
      >You don't have many suspects who are innocent of a crime.
      That's contradictory. If a person is innocent of a crime,
      then he is not a suspect.</quote>
  </simpara>
</epigraph>

<simpara>
  The tricks shown in <xref linkend="doing.it.in.c"/> raise a question.
  Can a look at the disassembly find pieces of code that distinguish
  viruses in general from regular code? You can call that the holy
  grail of scanning. This is very different from finding specific
  pieces of code that identify exactly one virus (a signature).
  Which is again very different from identifying a virus exactly &hellip;
</simpara>
<simpara>
  The first problem is how to get at <quote>the code</quote>.
  Everything from the start of the file to the last byte of code is
  mapped into the code segment. This is described in
  <xref linkend="how.it.works"/> and illustrated in
  <xref linkend="segments.of.sh"/>. A virus could hide in a region
  declared as <acronym>ELF</acronym> header.
  <acronym>VIT</acronym> and its variations (see &yref.segment.padding;)
  put the code into section <literal>.rodata</literal>.
</simpara>
<simpara>
  So keep in mind that this chapter is very hypothetical.
</simpara>

<sect2>
  <title>Extracting sections</title>

  <simpara>
    Let's have fun by looking at the sections of an executable file.
    Here comes a script that extracts a single section as raw data.
    <citerefentry>
      <refentrytitle>readelf</refentrytitle>
      <manvolnum>1</manvolnum>
    </citerefentry> provides a related (but useless) option.
  </simpara>
  <blockquote>
    <simpara><option>-x &lt;number&gt;</option></simpara>
    <simpara><option>--hex-dump=&lt;number&gt;</option></simpara>
    <simpara>
      Displays the contents of the indicated section as a hexadecimal dump.
    </simpara>
  </blockquote>

  <formalpara>
    <title>Source: src/suspicious_code/dumpsection.pl</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
	format="linespecific"
	fileref="../../src/suspicious_code/dumpsection.pl"
      /></imageobject></inlinemediaobject></programlisting
    ></para>
  </formalpara>

  <simpara>
    And the first test is simple. Compare the following output with
    <link linkend="output.entry.point.sh.gdb">
      <citerefentry>
	<refentrytitle>gdb</refentrytitle>
	<manvolnum>1</manvolnum>
      </citerefentry>'s dump
    </link> in <xref linkend="entry.point"/>.
  </simpara>
  <formalpara>
    <title>Command: &config.PRE;/suspicious_code/&config.ASM.STYLE;.sh</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
	format="linespecific"
	fileref="../../&config.PRE;/suspicious_code/&config.ASM.STYLE;.sh"
      /></imageobject></inlinemediaobject></programlisting
    ></para>
  </formalpara>
  <anchor id="output.dumpsection.pl"/>
  <formalpara>
    <title>Output: &config.OUT;/suspicious_code/disasm</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
	format="linespecific"
	fileref="../../&config.OUT;/suspicious_code/disasm"
      /></imageobject></inlinemediaobject></programlisting
    ></para>
  </formalpara>

</sect2>
