luv-beginners December 2020

luv-beginners@luv.asn.au

3 participants
3 discussions

by Peter Wolf

Thanks for your very helpful answer Trent.Yes, finalrd is a shell script as you suggested which is why objdump didn't disassemble it.I thought that hexdump or objdump would have directly shown that finalrd is a shell script.

2 years, 2 months

Re: [luv-beginners] malware or not

by Peter Wolf

Thank you Andrew and Trent for your helpful answers.I have a couple more questions if that is ok. The following is output from an Antix Linux installation I have. $ ls -l /usr/bin/lockfile* -rwxr-xr-x 4 root root 9944 Dec 2 2012 /usr/bin/lockfile-check -rwxr-xr-x 4 root root 9944 Dec 2 2012 /usr/bin/lockfile-create -rwxr-xr-x 4 root root 9944 Dec 2 2012 /usr/bin/lockfile-remove -rwxr-xr-x 4 root root 9944 Dec 2 2012 /usr/bin/lockfile-touch Danny@PM5EZ4AZN6TPOJXZ8KSLVQL5QCXXO5SX5L5KIL38:~ $ md5sum /usr/bin/lockfile* 7e6e10a1272f5cfe594cf297d0ca9151 /usr/bin/lockfile-check 7e6e10a1272f5cfe594cf297d0ca9151 /usr/bin/lockfile-create 7e6e10a1272f5cfe594cf297d0ca9151 /usr/bin/lockfile-remove 7e6e10a1272f5cfe594cf297d0ca9151 /usr/bin/lockfile-touch Danny@PM5EZ4AZN6TPOJXZ8KSLVQL5QCXXO5SX5L5KIL38:~ $ ls -l /usr/bin/mail* -rwxr-sr-x 3 root mail 9944 Dec 2 2012 /usr/bin/mail-lock -rwxr-sr-x 3 root mail 9944 Dec 2 2012 /usr/bin/mail-touchlock -rwxr-sr-x 3 root mail 9944 Dec 2 2012 /usr/bin/mail-unlock Danny@PM5EZ4AZN6TPOJXZ8KSLVQL5QCXXO5SX5L5KIL38:~ $ md5sum /usr/bin/mail* 7e6e10a1272f5cfe594cf297d0ca9151 /usr/bin/mail-lock 7e6e10a1272f5cfe594cf297d0ca9151 /usr/bin/mail-touchlock 7e6e10a1272f5cfe594cf297d0ca9151 /usr/bin/mail-unlock Question #1. What is the reason for the existence of 7 identical files under different names? Regarding question #2.The following is output from a Linux Mint 19.2 installation I have.The command finalrd has been moved from /usr/bin where it was found to $HOME. peter@G9QYX4ZARNADBCM7D12NJQ1TT12B8A5XGBL73KAY:~$ objdump -d finalrd objdump: finalrd: File format not recognised peter@G9QYX4ZARNADBCM7D12NJQ1TT12B8A5XGBL73KAY:~$ hexdump finalrd -n 500 0000000 2123 622f 6e69 732f 0a68 2023 5053 5844 0000010 4c2d 6369 6e65 6573 492d 6564 746e 6669 0000020 6569 3a72 4720 4c50 332d 302e 6f2d 6c6e 0000030 0a79 730a 7465 2d20 0a65 230a 6620 726f 0000040 6920 696e 7274 6d61 7366 742d 6f6f 736c 0000050 6820 6f6f 2d6b 7566 636e 6974 6e6f 0a73 0000060 7865 6f70 7472 4420 5345 4454 5249 2f3d 0000070 7572 2f6e 6e69 7469 6172 666d 0a73 2023 0000080 6f66 2072 752f 7273 6c2f 6269 642f 6172 0000090 7563 2f74 7264 6361 7475 692d 736e 6174 00000a0 6c6c 650a 7078 726f 2074 4544 5453 4f52 00000b0 544f 4944 3d52 4424 5345 4454 5249 230a 00000c0 6920 696e 7274 6d61 7366 742d 6f6f 736c 00000d0 6e20 776f 7220 7165 6975 6572 2073 6874 00000e0 7369 7420 206f 6562 7320 7465 650a 7078 00000f0 726f 2074 6576 6272 736f 3d65 0a6e 230a 0000100 7320 6d6f 7465 6968 676e 6120 726c 6165 0000110 7964 6320 6572 7461 6465 7320 7568 6474 0000120 776f 206e 6e69 7469 6172 666d 0a73 2023 0000130 6173 656d 6320 6568 6b63 6920 2073 6f64 0000140 656e 6220 2079 2e65 2e67 6420 6172 7563 0000150 2d74 6873 7475 6f64 6e77 230a 6920 2074 0000160 7369 6520 7078 6365 6574 2064 6874 7461 0000170 6120 796e 7320 7568 6474 776f 206e 6e69 0000180 7469 6172 666d 2073 7369 6720 6f6f 2064 0000190 6e65 756f 6867 5b0a 2120 2d20 2078 4424 00001a0 5345 4454 5249 622f 6e69 732f 2068 205d 00001b0 7c7c 6520 6978 2074 0a30 230a 2f20 7572 00001c0 206e 616d 2079 6562 6d20 756f 746e 6465 00001d0 6e20 656f 6578 2c63 6f6e 7573 6469 3d20 00001e0 203e 6966 2078 7469 230a 6920 2074 6873 00001f0 756f 646c 00001f4 Question #2 Why can't finalrd be disassembled by objdump ?

2 years, 2 months

malware or not

by Peter Wolf

Hello, I have found numerous files being added to my /usr/bin folder.I want to know if one of them,a perl script is malware.I strongly suspect that it is malware.Unfortunately, I don't know enough about perl to be able to tell for sure.The script doesn't seem to work properly and seems to hang the perl interperetor.Be very careful running it.I will embed it at the bottom of this email.If it is malware and something new,please forward it to the relevant people.Thanks.The filename on my hard drive is function_grep.pl -------------------------------------------------------------------------------------------------------------------------------------- #! /usr/bin/perl -w # # Copyright 2000 Patrik Stridvall # # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. # # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. # # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA # use strict; my $name0=$0; $name0 =~ s%^.*/%%; my $invert = 0; my $pattern; my @files = (); my $usage; while(defined($_ = shift)) { if (/^-v$/) { $invert = 1; } elsif (/^--?(\?|h|help)$/) { $usage=0; } elsif (/^-/) { print STDERR "$name0:error: unknown option '$_'\n"; $usage=2; last; } elsif(!defined($pattern)) { $pattern = $_; } else { push @files, $_; } } if (defined $usage) { print "Usage: $name0 [--help] [-v] pattern files...\n"; print "where:\n"; print "--help Prints this help message\n"; print "-v Return functions that do not match pattern\n"; print "pattern A regular expression for the function name\n"; print "files... A list of files to search the function in\n"; exit $usage; } foreach my $file (@files) { open(IN, "< $file") || die "Error: Can't open $file: $!\n"; my $level = 0; my $extern_c = 0; my $again = 0; my $lookahead = 0; while($again || defined(my $line = <IN>)) { if(!$again) { chomp $line; if($lookahead) { $lookahead = 0; $_ .= "\n" . $line; } else { $_ = $line; } } else { $again = 0; } # remove C comments if(s/^(|.*?[^\/])(\/\*.*?\*\/)(.*)$/$1 $3/s) { $again = 1; next; } elsif(/^(.*?)\/\*/s) { $lookahead = 1; next; } # remove C++ comments while(s/^(.*?)\/\/.*?$/$1\n/s) { $again = 1; } if($again) { next; } # remove empty rows if(/^\s*$/) { next; } # remove preprocessor directives if(s/^\s*\#/\#/m) { if(/^\#[.\n\r]*?\\$/m) { $lookahead = 1; next; } elsif(s/^\#\s*(.*?)(\s+(.*?))?\s*$//m) { next; } } # Remove extern "C" if(s/^\s*extern[\s\n]+"C"[\s\n]+\{//m) { $extern_c = 1; $again = 1; next; } elsif(m/^\s*extern[\s\n]+"C"/m) { $lookahead = 1; next; } if($level > 0) { my $line = ""; while(/^[^\{\}]/) { s/^([^\{\}\'\"]*)//s; $line .= $1; if(s/^\'//) { $line .= "\'"; while(/^./ && !s/^\'//) { s/^([^\'\\]*)//s; $line .= $1; if(s/^\\//) { $line .= "\\"; if(s/^(.)//s) { $line .= $1; if($1 eq "0") { s/^(\d{0,3})//s; $line .= $1; } } } } $line .= "\'"; } elsif(s/^\"//) { $line .= "\""; while(/^./ && !s/^\"//) { s/^([^\"\\]*)//s; $line .= $1; if(s/^\\//) { $line .= "\\"; if(s/^(.)//s) { $line .= $1; if($1 eq "0") { s/^(\d{0,3})//s; $line .= $1; } } } } $line .= "\""; } } if(s/^\{//) { $_ = $'; $again = 1; $line .= "{"; $level++; } elsif(s/^\}//) { $_ = $'; $again = 1; $line .= "}" if $level > 1; $level--; if($level == -1 && $extern_c) { $extern_c = 0; $level = 0; } } next; } elsif(/^class[^\}]*{/) { $_ = $'; $again = 1; $level++; next; } elsif(/^class[^\}]*$/) { $lookahead = 1; next; } elsif(/^typedef[^\}]*;/) { next; } elsif(/(extern\s+|static\s+)? (?:__inline__\s+|__inline\s+|inline\s+)? ((struct\s+|union\s+|enum\s+)?(?:\w+(?:\:\:(?:\s*operator\s*[^\)\s]+)?)?)+((\s*(?:\*|\&))+\s*|\s+)) ((__cdecl|__stdcall|CDECL|VFWAPIV|VFWAPI|WINAPIV|WINAPI|CALLBACK)\s+)? ((?:\w+(?:\:\:)?)+($\w+$)?)\s*$([^$]*)\)\s* (?:\w+(?:\s*$[^$]*\))?\s*)*\s* (\{|\;)/sx) { $_ = $'; $again = 1; if($11 eq "{") { $level++; } my $linkage = $1; my $return_type = $2; my $calling_convention = $7; my $name = $8; my $arguments = $10; if(!defined($linkage)) { $linkage = ""; } if(!defined($calling_convention)) { $calling_convention = ""; } $linkage =~ s/\s*$//; $return_type =~ s/\s*$//; $return_type =~ s/\s*\*\s*/*/g; $return_type =~ s/(\*+)/ $1/g; $arguments =~ y/\t\n/ /; $arguments =~ s/^\s*(.*?)\s*$/$1/; if($arguments eq "") { $arguments = "void" } my @argument_types; my @argument_names; my @arguments = split(/,/, $arguments); foreach my $n (0..$#arguments) { my $argument_type = ""; my $argument_name = ""; my $argument = $arguments[$n]; $argument =~ s/^\s*(.*?)\s*$/$1/; # print " " . ($n + 1) . ": '$argument'\n"; $argument =~ s/^(IN OUT(?=\s)|IN(?=\s)|OUT(?=\s)|\s*)\s*//; $argument =~ s/^(const(?=\s)|CONST(?=\s)|__const(?=\s)|__restrict(?=\s)|\s*)\s*//; if($argument =~ /^\.\.\.$/) { $argument_type = "..."; $argument_name = "..."; } elsif($argument =~ /^ ((?:struct\s+|union\s+|enum\s+|(?:signed\s+|unsigned\s+) (?:short\s+(?=int)|long\s+(?=int))?)?(?:\w+(?:\:\:)?)+)\s* ((?:const(?=\s)|CONST(?=\s)|__const(?=\s)|__restrict(?=\s))?\s*(?:\*\s*?)*)\s* (?:const(?=\s)|CONST(?=\s)|__const(?=\s)|__restrict(?=\s))?\s* (\w*)\s* (?:\[\]|\s+OPTIONAL)?/x) { $argument_type = "$1"; if($2 ne "") { $argument_type .= " $2"; } $argument_name = $3; $argument_type =~ s/\s*const\s*/ /; $argument_type =~ s/^\s*(.*?)\s*$/$1/; $argument_name =~ s/^\s*(.*?)\s*$/$1/; } else { die "$file: $.: syntax error: '$argument'\n"; } $argument_types[$n] = $argument_type; $argument_names[$n] = $argument_name; # print " " . ($n + 1) . ": '$argument_type': '$argument_name'\n"; } if($#argument_types == 0 && $argument_types[0] =~ /^void$/i) { $#argument_types = -1; $#argument_names = -1; } @arguments = (); foreach my $n (0..$#argument_types) { if($argument_names[$n] && $argument_names[$n] ne "...") { if($argument_types[$n] !~ /\*$/) { $arguments[$n] = $argument_types[$n] . " " . $argument_names[$n]; } else { $arguments[$n] = $argument_types[$n] . $argument_names[$n]; } } else { $arguments[$n] = $argument_types[$n]; } } $arguments = join(", ", @arguments); if(!$arguments) { $arguments = "void"; } if((!$invert && $name =~ /$pattern/) || ($invert && $name !~ /$pattern/)) { if($calling_convention) { print "$return_type $calling_convention $name($arguments)\n"; } else { if($return_type =~ /\*$/) { print "$return_type$name($arguments)\n"; } else { print "$return_type $name($arguments)\n"; } } } } elsif(/\'(?:[^\\\']*|\\.)*\'/s) { $_ = $'; $again = 1; } elsif(/\"(?:[^\\\"]*|\\.)*\"/s) { $_ = $'; $again = 1; } elsif(/;/s) { $_ = $'; $again = 1; } elsif(/extern\s+"C"\s+{/s) { $_ = $'; $again = 1; } elsif(/\{/s) { $_ = $'; $again = 1; $level++; } else { $lookahead = 1; } } close(IN); }

2 years, 3 months

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

luv-beginners December 2020