*Start = AllocateExecutableMemory(Size.L)

Ollivier · Post by **Ollivier** » Wed Sep 26, 2007 2:04 am

It'd be cool executing this code

:

*Start = AllocateExecutableMemory(1)
      PokeB(*Start, $CB)
      CallFunctionFast(*Start)

Post by **Rings** » Wed Sep 26, 2007 7:36 am

*stop=MakingTrojansForDummies(<Insert Nickname here>)

Ollivier · Post by **Ollivier** » Sun Sep 30, 2007 10:23 pm

Yes! It's right! It's shame too...

DoubleDutch · Post by **DoubleDutch** » Mon Oct 01, 2007 9:45 am

Maybe an optional flag to specify the type of memory or if it should be pre-cleared would be handy.

Ollivier · Post by **Ollivier** » Sat Oct 06, 2007 8:04 am

@Rings

A solution in order to prevent dummies from such an infection should be adding a warning input requester at the beginning of the execution.

Code: Select all

Caution ! This program could contain a virus : Are you sure you want to execute it ?

[Yes] [No] [Cancel]

A second solution : limit the size of such a memory area. The quantity too. I see two reason to have this functionnality :
1) protect the code by autoreferency enkryption. Thing I never saw actually.
2) use a new possibility of call of procedure.
In the past, in the old Basic compiler named Quick-Basic, there was a function named : On Value Goto Label1, Label2, Label3, etc...

Maybe other users can find other functionnalities available with this options.

Post by **Rings** » Sat Oct 06, 2007 8:50 am

DoubleDutch · Post by **DoubleDutch** » Sat Oct 06, 2007 9:22 am

Ollivier: You cannot be serious with this suggestion? Anyone who wanted to bypass your ideas would just use the API.

I think if these extensions were added then it would be great, but with no "nanny state" warning messages please.

Ollivier · Post by **Ollivier** » Sat Oct 06, 2007 9:39 am

Yes, yes! CallFunctionFast() Okay but not JumpFast, cause actually OOC... slow, slow... Lol ?

Code: Select all

Object1()
...
code
...
JMP {lea Object2() } << Poke!

Object2()
...
code
...
JMP {lea Object3() } << Poke!

Object3()
...
code
...
JMP {lea Object1() } << And Poke!

And when you've a picture to transform with ! REP MOVSD, it's cool to prepare registers before the execution... not during the one, exactly like the code above.

>> Autoreferency enkrypton... What's that?
Maybe an expression with lots of error that a french try to translate!

Yes! It's only that... I just hope it's not a patent I'm able to execute with an old compiler I wanna forget!

Code: Select all

In this rectangle:
1) There is ... time(s) the figure 4
2) There is ... time(s) the figure 3
3) There is ... time(s) the figure 2
4) There is ... time(s) the figure 1

I think it's a good illustration of the autoreferency bordel.

So! Happy to discover your humour!

DoubleDutch · Post by **DoubleDutch** » Sat Oct 06, 2007 9:43 am

>> Autoreferency enkrypton... What's that?
Maybe an expression with lots of error that a french try to translate!

Who are you replying to? Has a post been deleted?

Ollivier · Post by **Ollivier** » Sat Oct 06, 2007 9:49 am

@DoubleDutch

If the PB team gives us this technic, he'll use to protect PBCompiler again hacking. Now, draw a message and input the keyboard, it's not only the API...

You give me an idea...

...

PB · Post by PB » Sat Oct 06, 2007 9:52 am

> Who are you replying to? Has a post been deleted?

He's referring to the fifth post in this thread, where "autoreferency enkryption"
is first mentioned. I guess he used ">>" to point out that phrase, rather than
use it as quote marks (as some people, including myself, do).

Ollivier · Post by **Ollivier** » Sat Oct 06, 2007 9:53 am

@DD

no... no deleted post
Just the function AllocateExecutableMemory() allows us really to protect executable code.

Auto-reference resolution, it's simple: more it's false, more it's longer.

EDIT : Rings had right : lol
I seem like ET...

DoubleDutch · Post by **DoubleDutch** » Sat Oct 06, 2007 5:24 pm

ic...

I think that adding the extra flags to AllocateMemory, is the best way to go. It means no extra commands that are basically just mods of the other commands.

Eg:

address=AllocateMemory(4000,#PB_Memory_Code) ; default is #PB_Memory_Data

Trond · Post by **Trond** » Thu Oct 11, 2007 2:06 pm

This would be useful for a scripting language.

Iron_Meiden · Post by **Iron_Meiden** » Tue Oct 16, 2007 1:53 pm

Special for Rings...

Code: Select all

\ Just for fun (Win32Forth v6.13.00)...

: Test CR S" Hi, I'm a trojan for all dummies !!1" TYPE CR ;
HERE CONSTANT TestEnd
' Test CONSTANT TestStart

TestEnd TestStart - Constant CodeSize
CodeSize Allocate Drop Value MEMORY
TestStart MEMORY CodeSize MOVE
MEMORY EXECUTE