optimus on linux

https://wiki.ubuntu.com/Bumblebee


Bumblebee aims to provide support for NVIDIA Optimus laptops for GNU/Linux distributions. Using Bumblebee, you can use your NVIDIA card for renderinggraphics which will be displayed using the Intel card.

compile assembly 32 bit atas platform 64 bit

Atas ubuntu 64 bit.

Utk kompile binary 64 bit:

nasm -f elf64 -g -F stabs a-eatclib.asm
gcc a-eatclib.o -o a-eatclib

Utk kompile binary 32 bit:

nasm -f elf -g -F stabs a-eatclib.asm
gcc a-eatclib.o -o a-eatclib -m32

assembly panggil libc

cara assembly  panggil libc:  [printf]

; cara nak kompil

;    nasm -f elf -g -F stabs a-eatclib.asm
;    gcc a-eatclib.o -o a-eatclib -m32


EatMsg: db "Saya makan Nasi 0x%x pinggan/n",0
EatMsg2: db "Saya makan Nasi 0x%x pinggan/n",10, 0  ; yg ni baru ada new line
extern printf
global main ; Required so linker can find entry point

main:
push ebp ; Set up stack frame for debugger
mov ebp,esp
push ebx ; Program must preserve ebp, ebx, esi, & edi
push esi
push edi
;;; Everything before this is boilerplate; use it for all ordinary apps!

push esp
push EatMsg
call printf
add esp, 4

;;; Everything after this is boilerplate; use it for all ordinary apps!
pop edi ; Restore saved registers
pop esi
pop ebx
mov esp,ebp ; Destroy stack frame before returning
pop ebp
ret ; Return control to Linux

encrypt: loop file

LOOP TUTORIAL
loop tutorial at http://www.saout.de/tikiwiki/tiki-index.php?page=looptutorial

Setting the Loop File
        1>      dd if=/dev/urandom of=/home/secret bs=1M count=100
        2>      losetup /dev/loop0 /home/secret
        3>      modprobe dm_crypt
        4>      cryptsetup -c aes -y create secret /dev/loop0
        5>      mke2fs -j /dev/mapper/secret     (ext3)
        5>      mke2fs -t ext4 -j /dev/mapper/secret     (ext3)
        6>      mount /dev/mapper/secret /mnt/secret

getPC

GetPC:

• adalah satu teknik digunakan utk dapatkan eip semasa. (dalam shellcode)
• http://skypher.com/wiki/index.php/Hacking/Shellcode/GetPC

Kaedah 1.

$+0:    E8 00000000 CALL    $+5         ; PUSH $+5 onto the stack
$+5:    59          POP     ECX         ; ECX = $+5
$+6:    ...shellcode...

Oleh kerana argument kepada CALL (E8) adalah relatif(offset) kepada kod CALL, maka value-nya ialah 0. Tapi nullbyte ni tak boleh guna dalam shell code.

Kaedah 2)

$+0     EB XX       JMP     SHORT $+N   ; Jump to the call instruction
$+5:    59          POP     ECX         ; ECX = $+N+5
$+6:    ...shellcode...
$+N:    E8 FFFFFFXX CALL    $+5         ; PUSH $+N+5 onto the stack and jump back to $+5

Kaedah ni limitationnya adalah pada saiz shellcode. Saiz maksimum adalah 126 bytes. Kalau nak lebih besar, kena buat jump pada lokasi $+N-2, jump kepada $+N+5.
Flow eip seperti berikut:

1. $+0
2. $+N
3. $+5   ;  ecx  dapat lokasi $+N+5
4. $+6   ;  execute shellcode

Kaedah 3)

$+0  EB FFFFFFFF CALL    $+4         ; PUSH $+5 onto the stack and jump to $+4
$+5: C8 59XX XX  ENTER   XX59,XX     ; Does not get executed like this; see below.

Kaedah guna trik yg menarik. Bila [call $+4 ] di larikan, EIP akan jadi $+4, bukan $+5. Jadi instruction yg akan dijalankan adalah spt berikut:

$+4:  FFC8     DEC     ECX   ; Does nothing useful; can be considered a NOP.
$+6:  59       POP     ECX   ; ECX = $+5
$+7:    ...shellcode...

Gmail down

miniFlame

Once installed, MiniFlame operates as a backdoor and enables the malware operators to obtain any file from an infected machine, according to research from Kaspersky Lab.

The malware can also capture screenshots from infected PCs when people use a

• specified application, 
• IM service, or 
• FTP client, or 

send data to a C&C server.

"Separately, at the request from MiniFlame's C&C operator, an additional data-stealing module can be sent to an infected system, which infects USB drives and uses them to store data that's collected from infected machines without an Internet connection," said Kaspersky Lab.

To recap the malware family tree: Flame was discovered in May 2012. It was initially dismissed by some security researchers as bloatware, in part because of the application's size--20 MB with all modules installed, versus an average of up to 1 MB for most other malware. But ongoing analysis of Flame yielded numerous surprises, including its designers having tapped world-class crypto to imbue the malware with the ability to spoof Windows Update and automatically install itself on targeted computers.

Relation on Flame and Gauss
MiniFlame's ability to be used as a plug-in by either Flame or Gauss clearly connects the collaboration between the development teams of both Flame and Gauss," according to Kaspersky Lab's research. "Since the connection between Flame and Stuxnet/Duqu has already been revealed, it can be concluded that all these advanced threats come from the same 'cyber warfare' factory."



ref> http://www.informationweek.com/security/vulnerabilities/meet-flame-espionage-malware-cousin-mini/240009131