🚀 go-pugleaf

Followup-to: ee.prog

Tere,

sain minagi hiljutises viirusevaimustuses hulgaliselt usse ja viirusi.
Ühele neist (vt. <http://www.hot.ee/veideruss/document_9446.pif>)
kõhtu vaadates avastasin niisuguse huvitava sektsioonitabeli:

name     memsz  RVA    filesz offset !rel !ln  #rel #ln  flags
======== ====== ====== ====== ====== ==== ==== ==== ==== ========
.shrink   15000   1000   c400   1000    0    0    0    0 c0000040
.shrink    3000  16000   1200   d400    0    0    0    0 c0000040
.shrink    4000  19000   1200   e600    0    0    0    0 c0000040
.shrink    3000  1d000   2200   f800    0    0    0    0 c0000040

Huvitav ei ole mitte see, et sektsiooninimed korduvad, vaid see, et fail
ise on ainult 47196 = 0xB85C baiti pikk.  Nagu näha, jookseb esimene
sektsioon seega faili lõpust julmalt üle ja järgmised kolm paiknevad
failist täielikult väljaspool.  Sarnane on lugu ka imporditabeliga,
mis peaks okupeerima 0x9C baiti alates RVA'st 0x1EBE2, mis jääb, nagu
ülevalt näha, neljandasse .shrink'i -- mis omakorda täielikult failist
välja jääb.

Kuidas see uss niimoodi töötada saab?
Niisugune sektsioonitabel jätab mulle mulje, nagu suudaks see uss end
lahti pakkida enne, kui opsüsteem teda üldse mällu map'ima hakkabki.
Kuidasmoodi?

Või sattus mulle vigane uss, mis tuleks garantiikorras ümber vahetada?

Rohkem dumpi järgneb:

=== MZ header ===
MZ magic: 'MZ'
0x0003 blocks in file, last has 0x0090 bytes
Header size: 0x0004 paragraphs
Extra paragraphs needed: min 0x0000, max 0xffff
Initial SS:SP = 0000:00b8
Checksum: 0x0000
Initial CS:IP = 0000:0000
Relocation table: 0 entries at [0040]
New EXE header at [000000e0]
=== PE header ===
PE magic: 'PE\x00\x00'
Target machine/a.out magic: 332 (i80386)
Section count: 4
Timestamp: 1061139293 (2003-08-17 16:54:53 GMT)
Symbol table: 0 entries at [00000000]
Optional header size: 0x00e0 bytes
Characteristics: -------3----SLxR
=== Optional (a.out) header ===
Optional header magic: 267 (PE32)
Linker version: 6.0
Text size: 0x00000000  Data size: 0x00007000  BSS size: 0x00000000
Entry point (RVA): [0001ebd6]
Base of text segment: [00001000]
Base of data segment: [00016000]
Preferred image base address: [00400000]
Alignment:  memory 0x00001000  file 0x00000200
OS version: 4.0
Image version: 0.0
Subsystem version: 4.0
Size of image: 0x00020000  headers: 0x00001000
Checksum: 0x0001f117
Subsystem: 2 (Windows GUI)
DLL characteristics: 0x0000
Stack size: reserve 0x00100000  commit 0x00001000
Heap size: reserve 0x00100000  commit 0x00001000
Loader flags (obsolete?) 0x00000000
Dictionary entry count: 16
                             ======== ========
00. Export table:            00000000 00000000
01. Import table:            0001ebe2 0000009c
02. Resource table:          00000000 00000000
03. Exception table:         00000000 00000000
04. Certificate table:       00000000 00000000
05. Base relocation table:   0001ec7e 00000008
06. Debug:                   00000000 00000000
07. Architecture specific:   00000000 00000000
08. Global pointer:          00000000 00000000
09. TLS table:               00000000 00000000
10. Load config table:       00000000 00000000
11. Bound import table:      00000000 00000000
12. Import address table:    00000000 00000000
13. Delay import descriptor: 00000000 00000000
14. COM+ runtime header:     00000000 00000000
15. (reserved)               00000000 00200000

Section table
name     memsz  RVA    filesz offset !rel !ln  #rel #ln  flags
======== ====== ====== ====== ====== ==== ==== ==== ==== ========
.shrink   15000   1000   c400   1000    0    0    0    0 c0000040
.shrink    3000  16000   1200   d400    0    0    0    0 c0000040
.shrink    4000  19000   1200   e600    0    0    0    0 c0000040
.shrink    3000  1d000   2200   f800    0    0    0    0 c0000040

Faili esimene ots näeb välja niisugune:

00000000 : 4D 5A 90 00 03 00 00 00-04 00 00 00 FF FF 00 00 : MZ..............
00000001 : B8 00 00 00 00 00 00 00-40 00 00 00 00 00 00 00 : ........@.......
00000002 : 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 : ................
00000003 : 00 00 00 00 00 00 00 00-00 00 00 00 E0 00 00 00 : ................
00000004 : 0E 1F BA 0E 00 B4 09 CD-21 B8 01 4C CD 21 54 68 : ........!..L.!Th
00000005 : 69 73 20 70 72 6F 67 72-61 6D 20 63 61 6E 6E 6F : is program canno
00000006 : 74 20 62 65 20 72 75 6E-20 69 6E 20 44 4F 53 20 : t be run in DOS 
00000007 : 6D 6F 64 65 2E 0D 0D 0A-24 00 00 00 00 00 00 00 : mode....$.......
00000008 : D3 A0 48 CF 97 C1 26 9C-97 C1 26 9C 97 C1 26 9C : ..H...&...&...&.
00000009 : 14 DD 28 9C 8D C1 26 9C-7F DE 2C 9C ED C1 26 9C : ..(...&...,...&.
0000000A : C1 DE 35 9C 9A C1 26 9C-97 C1 26 9C 94 C1 26 9C : ..5...&...&...&.
0000000B : 97 C1 27 9C 06 C1 26 9C-F5 DE 35 9C 9A C1 26 9C : ..'...&...5...&.
0000000C : 7F DE 2D 9C 8D C1 26 9C-52 69 63 68 97 C1 26 9C : ..-...&.Rich..&.
0000000D : 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 : ................
0000000E : 50 45 00 00 4C 01 04 00-5D B3 3F 3F 00 00 00 00 : PE..L...].??....

Aadressidel 80-DF asuv on PE-EXE jaoks kaunis ebatavaline ja meenutab,
kui ma ei eksi, ikooni.  Ma oletan, et see on vajalik sellepärast, et
shell ikooni näitamise tarvis seda faili lahti pakkida ei oska.

-- 
Andres Soolo  <soolo@math.ut.ee>

I've got a very bad feeling about this.
		-- Han Solo