Tag: Computers

Ooh! this one really annoys me. I’m using iTunes for syncing with my iPod. But when I’m playing music on the desktop if I right-click on anything in the explorer and don’t select something really fast iTunes stops playing the music. What a piece of junk.

I got an email purporting to be from paypal, asking me to download a security tool that will help protect my computer. Well guess what, it doesn’t (well duh!). It turns out to be changing the NameServer entries for all the interfaces in in the registry keys under SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces to something else. Firing up a disassembler, we find out that the value it’s trying to set is:

aRstpuucpuucpur	db 90h			; DATA XREF: start+Ao start+101o ...
db  98h	;
db  92h	;
db  8Fh	;
db  93h	;
db  93h	;
db  96h	;
db  8Fh	;
db  93h	;
db  93h	;
db  96h	;
db  8Fh	;
db  93h	;
db  90h	;
db  99h	;
db    0	;

Not surprisingly, this is not a kosher string, it’s been encoded. One of the first things the code does is decode this, using the following bit of code

sub_0_40107E	proc near		; CODE XREF: start+Fp
arg_0		= dword	ptr  4
mov	eax, [esp+arg_0]
mov	ecx, eax
mov	dl, [eax]
loc_0_401086:				; CODE XREF: sub_0_40107E+15j
test	dl, dl
jz	short locret_0_401095
xor	dl, 0A1h
mov	[ecx], dl
mov	dl, [ecx+1]
inc	ecx
jmp	short loc_0_401086

<sarcasm>Terribly complicated</sarcasm>. The code xor’s each value in the string with 0A1h. We can step by step this, or you can trust me that it’s 193.227.227.218. A traceroute reveals that it’s probably somewhere in romania (.ro top level domain)

Tracing route to 193.227.227.218 over a maximum of 30 hops
1     1 ms    <1 ms    <1 ms  10.0.0.71
2    57 ms    21 ms    23 ms  b-ras1.lmk.limerick.eircom.net [159.134.155.24]
3    21 ms    22 ms    20 ms  ge15-2.corea.lmk.limerick.eircom.net [83.71.114.97]
4    36 ms    36 ms    35 ms  83.71.112.94
5    36 ms    40 ms    39 ms  london1-br2-fe0-0.rdsnet.ro [195.66.226.46]
6    54 ms    53 ms    52 ms  fra2-cr1-ge5-0.539.rdsnet.ro [62.231.127.89]
7     *        *        *     Request timed out.
8    89 ms    90 ms    87 ms  constanta1-cr1-vlan25.rdsct.ro [212.93.137.51]
9    94 ms    88 ms    96 ms  constanta1-fo-vlan10.rdsct.ro [212.93.137.10]
10    89 ms   101 ms    90 ms  81.196.163.89
11    95 ms    95 ms   101 ms  cr1.micos.ro [193.227.226.254]
12    91 ms    96 ms    97 ms  193.227.227.218

The short answer is never run code that you’re uncertain of the origin of, and 2. never run code that you’re uncertain of the origin of.

Quick XOR tutorial. Exclusive OR. Either A is true or B is true but not both. so 0 xor 0 = 0, 0 xor 1 = 1, 1 xor 0 = 1, 1 xor 1 = 0. Each hex digit is a run of 4 binary numbers. 0 = 0000, 9 = 1001, A = 1010, F = 1111.
90h xor 0A1h == 1001 0000 xor 1010 0001 = 0011 0001 = 31
Conveniently, 30h = ‘0’, 39h = ‘9’ and 2eh = ‘.’, so it’s easy to translate them.