full-disclosure - Disinfectors for the calculator virus (ti89.Gaara)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <46627D76.607@gmail.com>
Date: Sun, 03 Jun 2007 10:36:06 +0200
From: Piotr Bania <bania.piotr@...il.com>
To: dailydave@...ts.immunitysec.com,  full-disclosure@...ts.grok.org.uk, 
	bugtraq@...urityfocus.com
Subject: Disinfectors for the calculator virus (ti89.Gaara)

Hey,

For those who are interrested, i made two types of Gaara (the calculator 
virus) disinfectors. The first one patches the virus body, which causes 
to return the control to the host just when the EPO injection travels 
the control to the virus. So the virus will not get executed at all.
And the second one is trying to find an EPO injection by searching for 
BRA opcodes, and testing them for suitable conditions.

Here are the codes:
Dis1:
Source:
http://piotrbania.com/all/ti89/dis1.c

Binary:
http://piotrbania.com/all/ti89/dis1.89z

Dis2:
Source:
http://piotrbania.com/all/ti89/dis2.c

Binary:
http://piotrbania.com/all/ti89/dis2.89z

i hope you will find them somehow interresting.

best regards,
pb

-- 
--------------------------------------------------------------------
Piotr Bania - <bania.piotr@...il.com> - 0xCD, 0x19
Fingerprint: 413E 51C7 912E 3D4E A62A  BFA4 1FF6 689F BE43 AC33
http://www.piotrbania.com  - Key ID: 0xBE43AC33
--------------------------------------------------------------------

               - "The more I learn about men, the more I love dogs."

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/