OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Topic created on: August 27, 2008 14:27 CDT by bunn .

Hey, does anyone know a way to detect weather you are in a windows or linux environment? Assuming the program magically works in both linux and windows. My guess would be to read from the PEB, but that would probably cause an exception, and I don't know how to start an exception handler on linux. I'm also assuming if you try to create an SEH, it would be different for both Windows and Linux as well.

GynvaelColdwind		August 27, 2008 15:31.18 CDT
Hmm... Maybe fopen "wb" a file, write \r\n, and later fopen "r" the file and check if we find \r\n (linux) or \n (windows) ? fopen is in the ANSI C standard, so it is guaranteed to exists in the environment (both linux and windows)

bunn		August 27, 2008 15:38.10 CDT
Well, you can't use API or syscalls because you don't know if you're in linux or windows. (Think shellcode)

noglorp		August 27, 2008 17:46.03 CDT
Are you saying this compiles under both Linux and Windows, or the same exact executable runs under both Linux and Windows? If it is being compiled, use #IFDEF WINDOWS. Lemme think about the other case (more likely your actual question).

bunn		August 27, 2008 18:08.06 CDT
@noglorp, That's not what I want to do. I write the code to a remote dummy application in either O/S. The code will then figure out if it's running Linux or Windows and decide what to do from there.

noglorp		August 27, 2008 18:40.15 CDT
Figured. Gotta boot linux and check something out real fast.

cseagle		August 27, 2008 20:18.56 CDT
Quick and dirty if you are in user space, esp < 0x80000000 is probably Windows, while esp > 0xb0000000 is probably a Unix flavor.

bunn		August 27, 2008 20:27.14 CDT
Thanks cseagle, that's a start. Any more stuff like that is good.

GynvaelColdwind		August 28, 2008 01:38.50 CDT
Another thing is the segment registers. FS under Linux has a 0 value by default, and under Windows its non zero. Other segment regs under windows tend to have values around 0x2X or 0x%X, and on the other hand, most Linux segment regs have the value around 0x7X or 0x3X.

noglorp		August 28, 2008 06:43.08 CDT
Evil Gyn beats me to the punch :D. Testing on Knoppix, programs have read+write access to segments 30-33 and 78-7b. Windows programs have r : 18-1b r+w: 20-23 r+w: 38-3b r+w: 40-43 r : e0-e3 Here is an app to list all readable/writeable segments (using verr and verrw). segs.s ------ .intel_syntax .text .global _main _main: xor ecx,ecx loop: xor eax,eax push ecx verr cx sete al push eax xor al,al verw cx sete al push eax xor al,al push ecx push offset format add eax,dword ptr ss:[esp+0xC] test eax,eax je short skip call _printf skip: add esp,0x10 pop ecx inc cx jnz short loop exit: ret format: .ascii "%4x:%1i:%1i\n\0" .def _printf; .scl 3; .type 32; .endef A check the would work would be verr e0 jz windows

noglorp		August 28, 2008 06:44.22 CDT
Btw, VERR sets ZF if segment is readable, VERW does same if it is writeable.

GynvaelColdwind		August 28, 2008 07:20.31 CDT
@noglorp Very interesting, using VERR and VERW ;> Nice ;>

bunn		August 28, 2008 12:30.28 CDT
Awsome. Thanks guys, that's probably enough, if I find anything more I'll post it.

noglorp		August 28, 2008 15:08.51 CDT
If you wanna try it on some other distros for me and see if it's the same as for knoppix, that would be sweet. Having trouble with my ubuntu install :(. Gyn, do you idle anywhere or have instant message so I can bug you in real time? :D

GynvaelColdwind		August 29, 2008 03:37.04 CDT
@noglorp I've sent You a message ;>

Note: Registration is required to post to the forums.

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit