Assembly Code and Jarvis Message
Assembly Code and Jarvis Message
Here's the connection....
The assembly code is, as mentioned elsewhere, a basic stack frame initialization in 8086 Intel code. See it as a scratchpad that is created at the start of every function where the function can store it's data and keep results.
* attempting reinit 080483be:
80483be: 8d 4c 24 04 lea 0x4(%esp), %ecx
80483c2: 83 e4 f0 and $0xfffffff0,%esp
80483c5: ff 71 fc pushl 0xfffffffc(%ecx)
80483c8: 55 push %ebp
However, this particular code was taken from https://www.owasp.org/index.php/Buffer_overflow_attack (credits to https://plus.google.com/u/0/+LeonZhao for finding it).
A stack overflow attack comes down to a user trying to manipulate the stack in such a way that they can get control over the flow of the program. This is done by writing more data on the stack than there is space for, which could corrupt the stack, stackpointer, instruction pointer, registers... This can be used to inject code into an existing program and redirect execution of the normal program to the injected code.
The 'attempting reinit' comment certainly makes it look like New Wave might be responsible for adding the code shown to the scanner in an attempt to restart ADA.
However, the code is not an exploit or attack itself, it is a vulnerable piece of code. By inserting this code NWR left the (back)door open to others... and that backdoor was used to insert the Jarvis audio into the scanner.
H. Richard Loeb Edgar Allan Wright
Here's the connection....
The assembly code is, as mentioned elsewhere, a basic stack frame initialization in 8086 Intel code. See it as a scratchpad that is created at the start of every function where the function can store it's data and keep results.
* attempting reinit 080483be:
80483be: 8d 4c 24 04 lea 0x4(%esp), %ecx
80483c2: 83 e4 f0 and $0xfffffff0,%esp
80483c5: ff 71 fc pushl 0xfffffffc(%ecx)
80483c8: 55 push %ebp
However, this particular code was taken from https://www.owasp.org/index.php/Buffer_overflow_attack (credits to https://plus.google.com/u/0/+LeonZhao for finding it).
A stack overflow attack comes down to a user trying to manipulate the stack in such a way that they can get control over the flow of the program. This is done by writing more data on the stack than there is space for, which could corrupt the stack, stackpointer, instruction pointer, registers... This can be used to inject code into an existing program and redirect execution of the normal program to the injected code.
The 'attempting reinit' comment certainly makes it look like New Wave might be responsible for adding the code shown to the scanner in an attempt to restart ADA.
However, the code is not an exploit or attack itself, it is a vulnerable piece of code. By inserting this code NWR left the (back)door open to others... and that backdoor was used to insert the Jarvis audio into the scanner.
H. Richard Loeb Edgar Allan Wright
I'm curious if this is what ADA meant by "I'm being watched".
ReplyDeleteIf this snippet is essentially a "window" into the Scanner code, information could just as easily be passed out of it as it could be passed into it, correct? If so, anything in the memory locations the Scanner uses could be "watched".
thanks for sharing this!!
ReplyDeleteJeff Coleman It means that A Detection Algorithm lives.
ReplyDeleteJarvis hacked the scanner first. In beta you had to opt in to become enlightened And that only happened after Jarvis hacks your scanner and tells you about being ENL. Maybe the NwR found Jarvis's old back door.
ReplyDeleteThe Acolyte never said she was trying to destroy ADA only send ADA a message that would make her more manageable.
ReplyDelete