The stosb detection method for qemu lives AGAIN, only my version checks for a segfault because they patched this, but they patched it DIRTY xD
This is technically a new vulnerability found by myself that checks for BOTH mine and the original vulnerability that would fail to write over the memory location directly below what would be a jmp to say we were in fact in the matrix.
// ------------------------------------------------------------------------------ // THE BEER-WARE LICENSE (Revision 43): // <aaronryool@gmail.com> wrote this file. As long as you retain this notice you // can do whatever you want with this stuff. If we meet some day, and you think // this stuff is worth it, you can buy me a beer in return // ------------------------------------------------------------------------------ #include <unistd.h> #include <stdlib.h> #include <signal.h> #include <sys/mman.h> int main(unsigned a); __sighandler_t handler(int sig) // our signal handler function { switch(sig) { case SIGSEGV: // when segfaults happen main(0xC0DE); // assume they have to be because of the bug and tell us we are in the matrix break; } } unsigned qemu(void) { void *page =(void *) ((unsigned long) (&&assembly) &~(getpagesize() - 1)); // get the page the assembly is on mprotect(page, getpagesize(), PROT_READ | PROT_WRITE | PROT_EXEC); // mark that shit as RWE for self modification assembly: asm volatile( ".intel_syntax noprefix\n" "mov eax, 0x90\n" // move a nop into eax for copying "mov ecx, 9\n" // move 9 into ecx for the number of bytes the byte code is from the offset to the jmp "mov edi, offset $\n" // mov the address of the start of this instruction into edi for rep "rep stosb\n" // finally, repeat that byte over the memory region "jmp _qemu\n" // this should be overwritten, if it isnt, some naughty child is running an old version of qemu lol, and they are in the matrix "jecxz noqemu\n" // if ecx is 0, we are not in the matrix by definition lol, if it is not 0, then "_qemu:\n" // this is the matrix "mov eax, 1\n" // follow cdecl calling convention and return 1 in eax "ret\n" "noqemu:\n" // this is not the matrix "xor eax, eax\n"); // return 0 according to cdecl calling convention } int main(unsigned a) { if(a==0xC0DE) goto matrix; // if this shit is from a segfault, we are matrix status signal(SIGSEGV, &handler); // register the segfault signal to be caught by our handler if(qemu()) goto matrix; // if this is an old version of qemu, and the standard vulnerability is present, MATRIX (upgrade yo shit foo) puts("Isn't real life boring?"); // if we get here, this is boring reality :( no cool ninja moves today bro lol exit(0); matrix: puts("The Matrix haz you Neo..."); // this is where you would put ninja moves, jack in or jack off, your choice ;) exit(1); }
Comments
Post a Comment