Advertisement
Madmouse

Qemu detection, even the patch for this is a vulnerability

Apr 9th, 2015
465
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 2.44 KB | None | 0 0
  1. // ------------------------------------------------------------------------------
  2. // THE BEER-WARE LICENSE (Revision 43):
  3. // <aaronryool@gmail.com> wrote this file. As long as you retain this notice you
  4. // can do whatever you want with this stuff. If we meet some day, and you think
  5. // this stuff is worth it, you can buy me a beer in return
  6. // ------------------------------------------------------------------------------
  7.  
  8. #include <unistd.h>
  9. #include <stdlib.h>
  10. #include <signal.h>
  11. #include <sys/mman.h>
  12.  
  13. int main(unsigned a);
  14.  
  15. __sighandler_t handler(int sig)     // our signal handler function
  16. {
  17.     switch(sig)
  18.     {
  19.         case SIGSEGV:       // when segfaults happen
  20.             main(0xC0DE);   // assume they have to be because of the bug and tell us we are in the matrix
  21.         break;
  22.     }
  23. }
  24. unsigned qemu(void)
  25. {
  26.     void *page =(void *) ((unsigned long) (&&assembly) &~(getpagesize() - 1)); // get the page the assembly is on
  27.     mprotect(page, getpagesize(), PROT_READ | PROT_WRITE | PROT_EXEC);  // mark that shit as RWE for self modification
  28. assembly: asm volatile(
  29. ".intel_syntax noprefix\n"
  30.     "mov eax, 0x90\n"   // move a nop into eax for copying
  31.     "mov ecx, 9\n"      // move 9 into ecx for the number of bytes the byte code is from the offset to the jmp
  32.     "mov edi, offset $\n"   // mov the address of the start of this instruction into edi for rep
  33.     "rep stosb\n"       // finally, repeat that byte over the memory region
  34.     "jmp _qemu\n"       // this should be overwritten, if it isnt, some naughty child is running an old version of qemu lol, and they are in the matrix
  35.     "jecxz noqemu\n"    // if ecx is 0, we are not in the matrix by definition lol, if it is not 0, then
  36. "_qemu:\n"          // this is the matrix
  37.     "mov eax, 1\n"      // follow cdecl calling convention and return 1 in eax
  38.     "ret\n"
  39. "noqemu:\n"         // this is not the matrix
  40.     "xor eax, eax\n");  // return 0 according to cdecl calling convention
  41. }
  42.  
  43.  
  44. int main(unsigned a)
  45. {
  46.     if(a==0xC0DE) goto matrix;  // if this shit is from a segfault, we are matrix status
  47.     signal(SIGSEGV, &handler);  // register the segfault signal to be caught by our handler
  48.    
  49.     if(qemu()) goto matrix;     // if this is an old version of qemu, and the standard vulnerability is present, MATRIX (upgrade yo shit foo)
  50.     puts("Isn't real life boring?");    // if we get here, this is boring reality :( no cool ninja moves today bro lol
  51.     exit(0);
  52.  
  53. matrix:
  54.     puts("The Matrix haz you Neo...");  // this is where you would put ninja moves, jack in or jack off, your choice ;)
  55.     exit(1);
  56. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement