<epigraph>
  <attribution>Carl Sagan, Cosmos</attribution>
  <simpara><quote>In order to make an apple pie from scratch,
    you must first create the universe.</quote></simpara>
</epigraph>

<simpara>
  This chapter is an incoherent collection of platform independent
  items that found no other place. This includes a few parts of the
  framework <xref linkend="one.step.closer"/> that are specific to
  infectors but independent of the infection method.
</simpara>

<sect2 id="print.summary.1" xreflabel="print_summary #1">
  <title>print_summary #1</title>

  <simpara
    >Infectors provide only minimal statistics.
    See <xref linkend="print.summary.2"/>.
  </simpara>

  <formalpara>
    <title>Source: src/one_step_closer/print_summary.inc</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../src/one_step_closer/print_summary.inc"
      /></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
<sect2 id="target.action.1" xreflabel="target_action #1">
  <title>target_action #1</title>

  <simpara
    >This is the logic of all infectors based on the framework.
    Scanners do something different, see <xref linkend="target.action.2"/>.
  </simpara>

  <formalpara>
    <title>Source: src/one_step_closer/action.inc</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../src/one_step_closer/action.inc"
      /></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
<sect2 id="target.patch.entry.addr.1">
  <title>target_patch_entry_addr #1</title>

  <simpara
    >Modifying <literal>e_entry</literal> is the obvious way to
    activate inserted code. It is quite simple to detect, however.
    See &yref.entry.point; for possible improvements.
    Directory name <filename>e1</filename> means that this
    is the first (orthogonal) implementation.
    The issue is independent of the chosen infection method. Well,
    almost independent. Entry point obfuscation generally means that
    virus code is activated later. Some infection methods must clean
    up things or the target will crash, though.
  </simpara>
  <simpara
    >Anyway, without this function the behavior of the target is
    not modified. If the infection methods prevents double infection
    by design, this can be used for vaccination in the true meaning
    of the word: Infection with a deactivated mutation makes the
    target immune against less friendly attackers.
  </simpara>

  <formalpara>
    <title>Source: src/one_step_closer/e1/patch_entry_addr.inc</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../src/one_step_closer/e1/patch_entry_addr.inc"
      /></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
<sect2 id="target.open.dst">
  <title>target_open_dst</title>

  <simpara
    >Infectors write a modified copy of the target into the current
    directory. The file name is build by appending the letters
    <literal>_infected</literal>. It really should be hard to overlook.
  </simpara>

  <formalpara>
    <title>Source: src/one_step_closer/open_dst.inc</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../src/one_step_closer/open_dst.inc"
      /></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
<sect2 id="target.write.infection.1"
  xreflabel="target_write_infection #1">
  <title>target_write_infection #1</title>

  <simpara
    >This function is called from within
    <xref linkend="target.copy.and.infect.1"/>.
    This implementation of <literal>target_write_infection</literal>
    does not require a special infection method but is not insertable
    itself. See &yref.doing.it.in.c; for something more realistic.
    Anyway, <varname>infection</varname> is an array of bytes generated
    by <xref linkend="dressing.up.binary.code"/>. Constant
    <constant>ENTRY_POINT_OFS</constant> points to the location
    inside this array to patch with the original entry address.
  </simpara>

  <formalpara>
    <title>Source: src/one_step_closer/write_infection.inc</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../src/one_step_closer/write_infection.inc"
      /></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
<sect2 id="dressing.up.binary.code" xreflabel="Dressing up binary code">
  <title>Dressing up binary code</title>

  <simpara
    >This script is used throughout the document to convert binary
    files into valid C code, i.e. definition of a byte array.
    This started as small filter written in
    <application>perl</application>, but now it has a lot of features.
    We need to process the output of both
    <application>ndisasm</application> and
    <application>objdump</application>, on multiple platforms.
    Examples for valid input (i386, sparc, alpha):
  </simpara>
  <programlisting><inlinemediaobject><imageobject><imagedata
    fileref="../intro/example.asm.txt"
    format="linespecific"
  /></imageobject></inlinemediaobject></programlisting>
  <simpara
    >The <literal>__attribute__</literal> clause is explained in
    &yref.a.section.called.text;.
  </simpara>
  <simpara
    >Initializing the array with string literals (looking like
    <literal>\xDE\xAD\xBE\xEF</literal>) is easier. The terminating
    zero would not work with &yref.doing.it.in.c;, however.
    But then using a list of hexadecimal numbers introduces
    separating comas, requiring special treatment of the last line.
  </simpara>
  <simpara
    >If command line option <option>-last_line_is_ofs</option>
    is passed to the program then the last line of disassembly
    is meant to specify a offset into the code.
    Actually it's just the last byte of that line.
    You are free to use any dummy operation, see the example input above.
    A real world example is at &yref.infection.1;.
    The last instruction itself is not emitted to the byte array.
    Instead enum constant <literal>ENTRY_POINT_OFS</literal> is defined.
  </simpara>

  <formalpara>
    <title>Source: src/platform/disasm.pl</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
        fileref="../src/platform/disasm.pl"
      /></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
