LinuxCategory

The tutorial for today is about debugging and FASM with fdbg tool. For debugging and testing you can use any debugger, but you can use the You can here all version for these operating system: GUI for Windows x64, Windows x64, Linux x64 and UEFI x64. I used the Linux… Continue Reading Programming with FASM – the format ELF executable – part 007 .

You need a USB stick to put the Windows 10 from the official website image with a size of 5.4 Gb.

Shell
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
# woeusb -v --device  Win10_1909_English_x64.iso /dev/sdc --target-filesystem NTFS
trap_return: INFO: returning from process_commandline_parameters
WoeUSB v3.3.1
==============================
determine_target_parameters: Info: Target device is '/dev/sdc'.
determine_target_parameters: Info: Target partition is '/dev/sdc1'.
Mounting source filesystem...
Wiping all existing partition table and filesystem signatures in /dev/sdc...
/dev/sdc: 2 bytes were erased at offset 0x000001fe (dos): 55 aa
/dev/sdc: calling ioctl to re-read partition table: Success
Ensure that /dev/sdc is really wiped...
Creating new partition table on /dev/sdc...
Creating target partition...
Making system realize that partition table has changed...
Wait 3 seconds for block device nodes to populate...
Cluster size has been automatically set to 4096 bytes.
Creating NTFS volume structures.
mkntfs completed successfully. Have a nice day.
--2020-04-02 23:04:52--  https://github.com/pbatard/rufus/raw/master/res/uefi/uefi-ntfs.img
Resolving github.com (github.com)... 140.82.118.4
Connecting to github.com (github.com)|140.82.118.4|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://raw.githubusercontent.com/pbatard/rufus/master/res/uefi/uefi-ntfs.img [following]
--2020-04-02 23:04:52--  https://raw.githubusercontent.com/pbatard/rufus/master/res/uefi/uefi-ntfs.img
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 151.101.112.133
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|151.101.112.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 524288 (512K) [application/octet-stream]
Saving to: ‘/tmp/WoeUSB.o2ZmsU.tempdir/uefi-ntfs.img’
 
uefi-ntfs.img       100%[===================>] 512,00K  1,56MB/s    in 0,3s    
 
2020-04-02 23:04:53 (1,56 MB/s) - ‘/tmp/WoeUSB.o2ZmsU.tempdir/uefi-ntfs.img’ saved [524288/524288]
 
1024+0 records in
1024+0 records out
524288 bytes (524 kB, 512 KiB) copied, 0,214865 s, 2,4 MB/s
Mounting target filesystem...
Applying workaround to prevent 64-bit systems with big primary memory from being unresponsive during copying files.
Copying files from source media...
...
INFO: Copying "./sources/imagingprovider.dll"...
11%
INFO: Copying "./sources/inf/setup.cfg"...
11%
INFO: Copying "./sources/input.dll"...
11%
INFO: Copying "./sources/install.wim"...
11%
...
INFO: Copying "./support/logging/winsetupetw.dll"...
Installing GRUB bootloader for legacy PC booting support...
Installing for i386-pc platform.
...
Warning: command "echo 0 > /proc/sys/vm/dirty_bytes" - returned code  $?
Unmounting and removing "/media/woeusb_source_1585857878_9470"...
Unmounting and removing "/media/woeusb_target_1585857878_9470"...
You may now safely detach the target device
Done :)
The target device should be bootable now

Reboot with the USB stick with the boot set on USB Device and you can install the Windows 10.

Let’s read from a text file named new_file.txt with an assembler program.

Assembly (x86)
1
2
3
4
5
6
[mythcat@desk fasm]$ vim read_file.fasm
[mythcat@desk fasm]$ ./fasm.x64 read_file.fasm
flat assembler  version 1.73.16  (16384 kilobytes memory, x64)
2 passes, 261 bytes.
[mythcat@desk fasm]$ ./read_file
FASM : Hello, world![mythcat@desk fasm]$

The source code is easy to understand. This source code shows you how you can use a macro for print. The base of this source code use INT 0x80 with a rax register for many functions like… Continue Reading Programming with FASM – the format ELF executable – part 006 .

Let’s write into a text file named new_file.txt with an assembler program. First, you need to create this text file using the command touch.

Assembly (x86)
1
2
3
4
5
6
7
8
9
[mythcat@desk fasm]$ vim write_file.fasm
[mythcat@desk fasm]$ ./fasm.x64 write_file.fasm
flat assembler  version 1.73.16  (16384 kilobytes memory, x64)
2 passes, 256 bytes.
[mythcat@desk fasm]$ touch new_file.txt
[mythcat@desk fasm]$ cat new_file.txt
[mythcat@desk fasm]$ ./write_file
[mythcat@desk fasm]$ cat new_file.txt
FASM : Hello, world!

The assembler FASM let us to write in the file using the INT 80 and some functions used with rax, rbx, rcx, rdx registers. For… Continue Reading Programming with FASM – the format ELF executable – part 005 .

The tutorial for today is a simple one. I will show you how to delete the file created with in the last tutorial. Let’s create a new file named delete_file.fasm and used to delete the new_file.txt.

1
2
3
4
5
6
7
8
9
10
11
[mythcat@desk ~]$ cd fasm/
[mythcat@desk fasm]$ vim delete_file.fasm
[mythcat@desk fasm]$ ./fasm.x64 delete_file.fasm
flat assembler  version 1.73.16  (16384 kilobytes memory, x64)
2 passes, 170 bytes.
[mythcat@desk fasm]$ ls new_file.txt
new_file.txt
[mythcat@desk fasm]$ ./delete_file
[mythcat@desk fasm]$ ls new_file.txt
ls: cannot access 'new_file.txt': No such file or directory
[mythcat@desk fasm]$

In the file delete_file.fasm I used the int 0x80 and mov rax, 10.… Continue Reading Programming with FASM – the format ELF executable – part 004 .

If you want to learn assembly programming for Windows O.S. or Linux with the Intel C.P.U. then you need the FASM tool and this manual. Today I will show you how to create a file using my Fedora 31 Linux distro and FASM tool. The name of this file will… Continue Reading Programming with FASM – the format ELF executable – part 003 .

This is a common report error and this doesn’t actually refer to the amount of storage space, but to the amount of inotify watches that are available for a given file system Linux show me this:

1
2
3
4
5
6
(0x7ffedb2c1390) Critical: inotify_add_watch(/home/mythcat/.config/lxqt/lxqt.conf) failed: (No space left on device)
(0x7ffedb2c1390) Critical: inotify_add_watch(/usr/share/icons/breeze/icon-theme.cache) failed: (No space left on device)
(0x7ffedb2c1390) Critical: inotify_add_watch(/home/mythcat/.config/lxqt/lxqt.conf) failed: (No space left on device)
(0x7fffe9047930) Critical: inotify_add_watch(/home/mythcat/.config/lxqt/lxqt.conf) failed: (No space left on device)
(0x7fffe9047930) Critical: inotify_add_watch(/usr/share/icons/breeze/icon-theme.cache) failed: (No space left on device)
(0x7fffe9047930) Critical: inotify_add_watch(/home/mythcat/.config/lxqt/lxqt.conf) failed: (No space left on device)

You can fix with this command:

1
echo fs.inotify.max_user_watches=65536 | sudo tee -a /etc/sysctl.conf && sudo sysctl -p

This tool is provided by R-fx Networks.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
[mythcat@desk ~]$ wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
[mythcat@desk ~]$ tar -xf maldetect-current.tar.gz
[mythcat@desk ~]$ cd maldetect-1.6.4/
[mythcat@desk maldetect-1.6.4]$ su
Password:
[root@desk maldetect-1.6.4]# ./install.sh
Failed to enable unit: Unit file maldet.service does not exist.
Linux Malware Detect v1.6.4
            (C) 2002-2019, R-fx Networks <proj@r-fx.org>
            (C) 2019, Ryan MacDonald <ryan@r-fx.org>
This program may be freely redistributed under the terms of the GNU GPL
 
installation completed to /usr/local/maldetect
config file: /usr/local/maldetect/conf.maldet
exec file: /usr/local/maldetect/maldet
exec link: /usr/local/sbin/maldet
exec link: /usr/local/sbin/lmd
cron.daily: /etc/cron.daily/maldet
maldet(31046): {sigup} performing signature update check...
maldet(31046): {sigup} local signature set is version 201907043616
maldet(31046): {sigup} new signature set 2019081912001 available
maldet(31046): {sigup} downloading https://cdn.rfxn.com/downloads/maldet-sigpack.tgz
maldet(31046): {sigup} downloading https://cdn.rfxn.com/downloads/maldet-cleanv2.tgz
maldet(31046): {sigup} verified md5sum of maldet-sigpack.tgz
maldet(31046): {sigup} unpacked and installed maldet-sigpack.tgz
maldet(31046): {sigup} verified md5sum of maldet-clean.tgz
maldet(31046): {sigup} unpacked and installed maldet-clean.tgz
maldet(31046): {sigup} signature set update completed
maldet(31046): {sigup} 15552 signatures (12740 MD5 | 2035 HEX | 777 YARA | 0 USER)
[root@desk maldetect-1.6.4]# vim /usr/local/maldetect/conf.maldet

Change this row to scan_user_access=1 Now you can run it:

1
[mythcat@desk ~]$ /usr/local/sbin/maldet -a