Re: Idea: string replace

[Gianni Tedesco <gianni@ecsc.co.uk>]

[-- Attachment #1: Type: text/plain, Size: 2090 bytes --]

On Wed, 2002-10-02 at 00:33, Peter Surda wrote:
> On Tue, Oct 01, 2002 at 11:06:50PM +0200, Peter Surda wrote:
> > > Regarding the "is it difficult" question, that depends on whether you
> > > want to replace with a string of identical length (piece of cake),
> > Actually, I didn't think so far as to use different lengths, somehow I
> > subconsiously assumed it is far from easy. Again, I only need this for a very
> > specific purpose (disabling one virus), for which IMHO same-length-replace is
> > sufficient.
> Ok, so I tried, I tried really hard <g>, and it compiled, and it didn't crash,
> and it seems to behave as expected (the virus attachment arrives or is
> downloaded, but is artifically corrupt and doesn't work). Attached patches
> (one userspace and one kernel) against cvs from end of July.
> 
> The string match has a new option, --replace-with, that takes one string as a
> value. I think the code is straightforward, the checksumming stuff is pasted
> from nat_helper.c (but it doesn't do conntrack of course).

Cool, I'm pretty sure you could pre-compute the checksum differences in
userspace and pass them in the info struct that would save dirtying lots
of CPU caches *too* much. :]

> Please test and report :-). I am sure there are more cool ways to use it than
> fighting virii.

Everyone here knows the problem of this approach for virus killing. To
do it right you need to wory about if the virus straddles two packets,
is radix 64 encoded, is using HTTP gzip ecoding, is using SMTP TLS,
never mind the various ptacek/newsham style attacks for TCP etc etc...

That said, I'm sure this will catch 99% of all viruses because they
probably wont straddle two packets, they certainly aren't deliberatly
evasive and they are usually sent via mail APIs which allow little
control that would let you do most of the interesting evasion
techniques.

-- 
// Gianni Tedesco (gianni at ecsc dot co dot uk)
lynx --source www.scaramanga.co.uk/gianni-at-ecsc.asc | gpg --import
8646BE7D: 6D9F 2287 870E A2C9 8F60 3A3C 91B5 7669 8646 BE7D

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 232 bytes --]