Rant to microsoft!

[chovynz]

:facepalm:

...

http://en.wikipedia.org/wiki/Source_code

Example source code.

Code:

/* chdir_kmod.c by detour@metalshell.com
*
* This simple module will recieve system calls
* to change the directory and log them.  This can
* be very useful if you want to create a sandbox for
* users on your system, or just log general activity.
*
* Compile:
*  gcc -Wall -DLINUX -D__KERNEL__ -DMODULE -c chdir_kmod.c
*
* Install:
*  insmod chdir_kmod
*
* Note: Do not load it twice, or you could lose the pointer
*       to the original kernel function and be unable to
*       change directories.
*
* http://www.metalshell.com/
*
*/

#include <linux/kernel.h>
#include <linux/module.h>
#include <sys/syscall.h>

#if CONFIG_MODVERSIONS==1
#define MODVERSIONS
#include <linux/modversions.h>
#endif

extern void *sys_call_table[];

/* Pointer to original chdir function, we must call this
&nbsp;&nbsp; from our intercept function to allow for normal directory
&nbsp;&nbsp; changes.&nbsp;&nbsp;This will also be used to restore the syscall pointer
&nbsp;&nbsp; when this module is unloaded. */
int (*old_sys_chdir)(const char *);

int (*sys_getuid)();

int sys_chdir_intercept(const char *path) {
&nbsp;&nbsp;printk("%d %s\n", sys_getuid(), path);

&nbsp;&nbsp;return old_sys_chdir(path);
}

int init_module() {
&nbsp;&nbsp;// Outputted to your syslog

&nbsp;&nbsp;printk("Module loaded..\n");

&nbsp;&nbsp;old_sys_chdir = sys_call_table[__NR_chdir];
&nbsp;&nbsp;sys_call_table[__NR_chdir] = sys_chdir_intercept;

&nbsp;&nbsp;sys_getuid = sys_call_table[__NR_getuid];

&nbsp;&nbsp;return 0;
}

void cleanup_module() {
&nbsp;&nbsp;// Outputted to your syslog

&nbsp;&nbsp;printk("Module unloaded..\n");

&nbsp;&nbsp;sys_call_table[__NR_chdir] = old_sys_chdir;
}

Example of what happens when you look at the FL file with a Hex editor.

Code:

00011E7A0: 00 8D 74 24 48 8D 7C 24 18 F3 A5 8B 4C 24 10 89 .ıt$Hı|$.??‹L$.‰
00011E7B0: 44 24 3C A1 C8 52 67 00 85 C0 89 4C 24 40 89 54 D$<??Rg.…?‰L$@‰T
00011E7C0: 24 44 75 0A E8 17 8C 09 00 A3 C8 52 67 00 8B 08 $Du.?.OE..??Rg.‹.
00011E7D0: 8D 54 24 18 52 8D 93 14 02 00 00 52 8D 54 24 74 ıT$.Rı“....RıT$t
00011E7E0: 52 50 FF 51 1C 8D 7B 04 B9 0C 00 00 00 8D 74 24 RP?Q.ı{.?....ıt$
00011E7F0: 6C F3 A5 C6 43 34 01 5F 5E 5B 81 C4 90 00 00 00 l???C4._^[ı?ı...
00011E800: C2 04 00 90 90 90 90 90 90 90 90 90 90 90 90 90 ?..ııııııııııııı
00011E810: 8B 89 F8 00 00 00 85 C9 B0 01 74 0C 8B 01 51 FF ‹‰?...…?.t.‹.Q?
00011E820: 50 54 83 F8 04 0F 94 C0 C3 E8 4B 2B EE FF 90 90 PT??..”???K+??ıı
00011E830: A1 A8 C2 5D 00 53 55 56 57 33 FF 85 C0 74 43 8B ???].SUVW3?…?tC‹
00011E840: 6C 24 18 8B F5 8A 10 8A 1E 8A CA 3A D3 75 1E 84 l$.‹??.?.??:?u.„
00011E850: C9 74 16 8A 50 01 8A 5E 01 8A CA 3A D3 75 0E 83 ?t.?P.?^.??:?u.?
00011E860: C0 02 83 C6 02 84 C9 75 DC 33 C0 EB 05 1B C0 83 ?.??.„?u?3??..??
00011E870: D8 FF 85 C0 74 22 8B 04 FD B0 C2 5D 00 47 85 C0 ??…?t"‹.??].G…?
00011E880: 75 C1 8B 54 24 1C 5F 5E 5D C7 02 00 00 00 00 B8 u?‹T$._^]?.....?
00011E890: FD FF FF FF 5B C2 0C 00 8B 04 FD AC C2 5D 00 85 ????[?..‹.??].…
00011E8A0: C0 79 21 8B 4C 24 14 25 FF FF FF 7F 8B 34 08 8B ?y!‹L$.%???‹4.‹
00011E8B0: 06 56 FF 50 04 8B 4C 24 1C 5F 89 31 5E 5D 33 C0 .V?P.‹L$._‰1^]3?
00011E8C0: 5B C2 0C 00 8B 54 24 14 8D 34 10 8B 06 56 FF 50 [?..‹T$.ı4.‹.V?P
00011E8D0: 04 8B 4C 24 1C 5F 89 31 5E 5D 33 C0 5B C2 0C 00 .‹L$._‰1^]3?[?..
00011E8E0: 8B 44 24 04 8B 48 04 41 89 48 04 8B C1 C2 04 00 ‹D$.‹H.A‰H.‹??..

Without the source code We can't modify the things. (yes we could hack it but then MS would sue us/the person, Much better to do things legally, And with patience,)

A programmer would be able to explain more better, but this is a simplification for the purposes of explaining why Just Hex editing wouldnt work.

---

Seek fun and you shall find it. Seek stuff to Q_Q about and you'll find that, too. I choose to have fun.