11–20 of 55 posts
If you read this article, you'll understand just how easy it is to compromise so many computers. What I have seen infecting my own systems works on computers built in 2004 as well as new machines, so its exploiting the design and implementation of various international standards. The way it works, is the bios loads the malware irrespective of the boot drive order specified in the bios, and then it seems to rewrite th…
Why he is using 32-bit esp/ebp registers in 16-bit environment? There are 16-bit sp/bp registers. And there is 0xFFFF limit on segment descriptors in real mode anyway.
Why he is using 32-bit esp/ebp registers in 16-bit environment? There are 16-bit sp/bp registers. And there is 0xFFFF limit on segment descriptors in real mode anyway.
It might be tooling. A 32-bit assembler (like gas) will turn `mov %esp,%ebp` into `89 e5` while `mov %sp,%bp` becomes `66 89 e5` -- the former being correct when actually in 16-bit.
> And there is 0xFFFF limit on segment descriptors in real mode anyway.
Not saying he is wrong or anything,but he seems to have missed how modern machines ship with UEFI which tries to solve this problem on firmware level. That said: if you're curious and want to learn, I have no objections to digging into stuff, even "obsolete" stuff like BIOS boot :)
What would be the equivalent of this in UEFI? I mean is there a one page tutorial on booting with UEFI by writing a few lines of assembly?
You may find it interesting.
Basically you won't bother writing a bootloader with UEFI, since it already provides that feature. Instead you'll get right at working on your OS.
If you read this article, you'll understand just how easy it is to compromise so many computers. What I have seen infecting my own systems works on computers built in 2004 as well as new machines, so its exploiting the design and implementation of various international standards. The way it works, is the bios loads the malware irrespective of the boot drive order specified in the bios, and then it seems to rewrite th…
This is not an isolated incident. The "badBIOS" incident reported by Dragos Ruiu a few years ago ([1]) had many of the same characteristics as what you are reporting:
• Vague symptoms, affecting all computers (and, often, even non-computer devices) owned by the individual
• Inability to isolate the agent involved
• Belief that widely publicized exploits or discoveries are involved, often in the absence of any evidence (e.g, DirtyCOW here, ultrasonic networking in Dragos' case)
Please seek psychiatric help.
[1]: http://www.infoworld.com/article/2609622/security/4-reasons-...
Why he is using 32-bit esp/ebp registers in 16-bit environment? There are 16-bit sp/bp registers. And there is 0xFFFF limit on segment descriptors in real mode anyway.
> Why he is using 32-bit esp/ebp registers in 16-bit environment? It might be tooling. A 32-bit assembler (like gas) will turn `mov %esp,%ebp` into `89 e5` while `mov %sp,%bp` becomes `66 89 e5` -- the former being correct when actually in 16-bit. > And there is 0xFFFF limit on segment descriptors in real mode anyway. http://wiki.osdev.org/Unreal_Mode
He is using nasm with "bits 16" directive, so 66 prefix will be emitted for "mov ebp,esp". gas with 32-bit target is totally unrelated to this discussion.
> http://wiki.osdev.org/Unreal_Mode
So what? MBR runs in 16-bit real mode.
Earlier quoted context omitted.
> Why he is using 32-bit esp/ebp registers in 16-bit environment? It might be tooling. A 32-bit assembler (like gas) will turn `mov %esp,%ebp` into `89 e5` while `mov %sp,%bp` becomes `66 89 e5` -- the former being correct when actually in 16-bit. > And there is 0xFFFF limit on segment descriptors in real mode anyway. http://wiki.osdev.org/Unreal_Mode
> A 32-bit assembler (like gas) will turn `mov %esp,%ebp` into `89 e5` while `mov %sp,%bp` becomes `66 89 e5` -- the former being correct when actually in 16-bit. He is using nasm with "bits 16" directive, so 66 prefix will be emitted for "mov ebp,esp". gas with 32-bit target is totally unrelated to this discussion. > http://wiki.osdev.org/Unreal_Mode So what? MBR runs in 16-bit real mode.
So he is!
I had to download nasm to check, but that sounds useful.
Why he is using 32-bit esp/ebp registers in 16-bit environment? There are 16-bit sp/bp registers. And there is 0xFFFF limit on segment descriptors in real mode anyway.
> Why he is using 32-bit esp/ebp registers in 16-bit environment? It might be tooling. A 32-bit assembler (like gas) will turn `mov %esp,%ebp` into `89 e5` while `mov %sp,%bp` becomes `66 89 e5` -- the former being correct when actually in 16-bit. > And there is 0xFFFF limit on segment descriptors in real mode anyway. http://wiki.osdev.org/Unreal_Mode
https://onlinedisassembler.com/odaweb/z1mMaYSk/0
locations of his binary file (which is identical to the binary I can produce with the nasm):
:0000001f 6683c402 add $0x2,%esp
:00000025 6655 push %ebp
:00000027 6689e5 mov %esp,%ebp
If you read this article, you'll understand just how easy it is to compromise so many computers. What I have seen infecting my own systems works on computers built in 2004 as well as new machines, so its exploiting the design and implementation of various international standards. The way it works, is the bios loads the malware irrespective of the boot drive order specified in the bios, and then it seems to rewrite th…
The "findings" you are describing are characteristic of security-conscious users suffering from paranoid schizophrenia. This is not an isolated incident. The "badBIOS" incident reported by Dragos Ruiu a few years ago ([1]) had many of the same characteristics as what you are reporting: • Vague symptoms, affecting all computers (and, often, even non-computer devices) owned by the individual • Inability to isolate the…
However having just read this https://www.facebook.com/dragosr/posts/10151655183445588 I can see he has explained much of what I was witnessing on some systems as well.
Cant rule out a modern day version of one of these https://en.wikipedia.org/wiki/Phoebus_cartel considering the Windows MSR partition I have copies of which effectively stripes the Windows Partition as well.
Some people are desperate to keep this quiet though, so perhaps suggesting what you have is your way to introduce doubt into an argument which is after all a valid debating technique.