Monday, July 6, 2015

The stosb detection method for qemu lives AGAIN, only my version checks for a segfault because they patched this, but they patched it DIRTY xD

This is technically a new vulnerability found by myself that checks for BOTH mine and the original vulnerability that would fail to write over the memory location directly below what would be a jmp to say we were in fact in the matrix.
// ------------------------------------------------------------------------------
// THE BEER-WARE LICENSE (Revision 43):
// <aaronryool@gmail.com> wrote this file. As long as you retain this notice you
// can do whatever you want with this stuff. If we meet some day, and you think
// this stuff is worth it, you can buy me a beer in return
// ------------------------------------------------------------------------------

#include <unistd.h>
#include <stdlib.h>
#include <signal.h>
#include <sys/mman.h>

int main(unsigned a);

__sighandler_t handler(int sig)  // our signal handler function
{
 switch(sig)
 {
  case SIGSEGV:  // when segfaults happen
   main(0xC0DE); // assume they have to be because of the bug and tell us we are in the matrix
  break;
 }
}
unsigned qemu(void)
{
 void *page =(void *) ((unsigned long) (&&assembly) &~(getpagesize() - 1)); // get the page the assembly is on
 mprotect(page, getpagesize(), PROT_READ | PROT_WRITE | PROT_EXEC); // mark that shit as RWE for self modification
assembly: asm volatile(
".intel_syntax noprefix\n"
 "mov eax, 0x90\n" // move a nop into eax for copying
 "mov ecx, 9\n"  // move 9 into ecx for the number of bytes the byte code is from the offset to the jmp
 "mov edi, offset $\n" // mov the address of the start of this instruction into edi for rep
 "rep stosb\n"  // finally, repeat that byte over the memory region
 "jmp _qemu\n"  // this should be overwritten, if it isnt, some naughty child is running an old version of qemu lol, and they are in the matrix
 "jecxz noqemu\n"  // if ecx is 0, we are not in the matrix by definition lol, if it is not 0, then
"_qemu:\n"   // this is the matrix
 "mov eax, 1\n"  // follow cdecl calling convention and return 1 in eax
 "ret\n"
"noqemu:\n"   // this is not the matrix
 "xor eax, eax\n"); // return 0 according to cdecl calling convention
}


int main(unsigned a)
{
 if(a==0xC0DE) goto matrix; // if this shit is from a segfault, we are matrix status
 signal(SIGSEGV, &handler); // register the segfault signal to be caught by our handler
 
 if(qemu()) goto matrix;  // if this is an old version of qemu, and the standard vulnerability is present, MATRIX (upgrade yo shit foo)
 puts("Isn't real life boring?"); // if we get here, this is boring reality :( no cool ninja moves today bro lol
 exit(0);

matrix:
 puts("The Matrix haz you Neo..."); // this is where you would put ninja moves, jack in or jack off, your choice ;)
 exit(1);
}

No comments :

Post a Comment