Olimpo Informatico

[Zeus News]

Commenti all'articolo Il rootkit che si installa sulla scheda di rete
Sostituendo il firmware della scheda Ethernet si ottiene un rootkit che il sistema operativo non può rilevare.

[{paolo del bene}]

Commento fuori tema o non conforme al regolamento del forum.

[{brcm}]

una parte di codice

/* bnx2_fw.h: Broadcom NX2 network driver.
*
* Copyright (c) 2004-2010 Broadcom Corporation
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, except as noted below.
*
* This file contains firmware data derived from proprietary unpublished
* source code, Copyright (c) 2004-2010
* Broadcom Corporation.
*
* Permission is hereby granted for the distribution of this firmware data
* in hexadecimal or equivalent format, provided this copyright notice is
* accompanying it.
*/

static const u32 bnx2_TPAT_b06FwData[(0x0/4) + 1] = { 0x0 };
static const u32 bnx2_TPAT_b06FwRodata[(0x0/4) + 1] = { 0x0 };

static struct fw_info bnx2_tpat_fw_06 = {
/* Firmware version: 6.0.15 */
.ver_major = 0x6,
.ver_minor = 0x0,
.ver_fix = 0xf,

.start_addr = 0x08000490,

.text_addr = 0x08000400,
.text_len = 0x17d4,
.text_index = 0x0,
.gz_text = bnx2_TPAT_b06FwText,
.gz_text_len = sizeof(bnx2_TPAT_b06FwText),

.data_addr = 0x00000000,
.data_len = 0x0,
.data_index = 0x0,
.data = bnx2_TPAT_b06FwData,

.sbss_addr = 0x08001c00,
.sbss_len = 0x44,
.sbss_index = 0x0,

.bss_addr = 0x08001c44,
.bss_len = 0x450,
.bss_index = 0x0,

.rodata_addr = 0x00000000,
.rodata_len = 0x0,
.rodata_index = 0x0,
.rodata = bnx2_TPAT_b06FwRodata,
};

/* Initialized Values for the TX Patch-up Processor. */
static const struct cpu_reg cpu_reg_tpat = {
.mode = BNX2_TPAT_CPU_MODE,
.mode_value_halt = BNX2_TPAT_CPU_MODE_SOFT_HALT,
.mode_value_sstep = BNX2_TPAT_CPU_MODE_STEP_ENA,
.state = BNX2_TPAT_CPU_STATE,
.state_value_clear = 0xffffff,
.gpr0 = BNX2_TPAT_CPU_REG_FILE,
.evmask = BNX2_TPAT_CPU_EVENT_MASK,
.pc = BNX2_TPAT_CPU_PROGRAM_COUNTER,
.inst = BNX2_TPAT_CPU_INSTRUCTION,
.bp = BNX2_TPAT_CPU_HW_BREAKPOINT,
.spad_base = BNX2_TPAT_SCRATCH,
.mips_view_base = 0x8000000,
};

static u8 bnx2_TXP_b06FwText[] = {
0x9d, 0x7b, 0x0b, 0x70, 0x5c, 0xd5, 0x99, 0xe6, 0x77, 0x6e, 0xb7, 0xa4,
0x6e, 0x3d, 0x5a, 0x57, 0xa6, 0x6d, 0x5a, 0x13, 0x67, 0xdc, 0x97, 0xbe,
0x57, 0x6a, 0x90, 0x6c, 0x6e, 0xcb, 0x32, 0x96, 0x33, 0xdd, 0xb8, 0x23,
0xcb, 0x96, 0xfc, 0xc2, 0x02, 0x94, 0x8c, 0x3c, 0xc3, 0x0e, 0x1a, 0x5b,
0x60, 0x81, 0x0d, 0x88, 0xa0, 0xcd, 0x8a, 0x2c, 0x13, 0x35, 0x92, 0x6c,
0x8c, 0xdd, 0xd2, 0x95, 0x68, 0x2b, 0x32, 0x53, 0x5b, 0x13, 0x61, 0xc9,
0xc8, 0x40, 0xcb, 0x0d, 0x21, 0x49, 0x25, 0xbb, 0x93, 0x4a, 0xaf, 0x01,
0xe3, 0x24, 0x3c, 0x92, 0xdd, 0xd4, 0x14, 0x99, 0x9a, 0x99, 0xb8, 0x78,
0x18, 0xc3, 0xf2, 0x9a, 0xd9, 0x4c, 0xad, 0x9c, 0x01, 0xdf, 0xfd, 0xce,
0xbd, 0xdd, 0xb6, 0x93, 0x62, 0xa6, 0xa6, 0x46, 0x55, 0xaa, 0x6e, 0xdd,
0xc7, 0x7f, 0xfe, 0xf3, 0x3f, 0xbe, 0xff, 0xfb, 0xcf, 0x39, 0xba, 0x0e,
0x28, 0x47, 0xe1, 0xa7, 0x8a, 0xbf, 0x37, 0xf4, 0x0f, 0x0e, 0xc4, 0x56,
0x99, 0xab, 0xf8, 0x75, 0x0d, 0xaa, 0x51, 0x2a, 0xaf, 0xdf, 0x20, 0x80,
0x9e, 0xf7, 0xf1, 0x1f, 0xfa, 0x59, 0xf6, 0x1f, 0x7b, 0x0d, 0x07, 0xaf,
0x72, 0x3f, 0xff, 0xae, 0xe4, 0xf2, 0x35, 0x0f, 0xa0, 0x16, 0xf5, 0x94,
0xbf, 0xf0, 0x29, 0xf1, 0x70, 0xbc, 0x55, 0x87, 0xcf, 0x13, 0xff, 0x65,
0x62, 0xb7, 0x0e, 0x24, 0xb3, 0x0d, 0xe1, 0x0d, 0xf8, 0xcc, 0x4e, 0x05,
0xbd, 0x90, 0xd7, 0xbf, 0x18, 0xff, 0x74, 0xe8, 0x47, 0x6b, 0xb5, 0x4f,
0x66, 0x3c, 0xf0, 0xa9, 0xf1, 0x13, 0x50, 0xeb, 0xe0, 0x5b, 0xce, 0x77,
0xfe, 0x5b, 0xfd, 0x7f, 0x57, 0x10, 0x28, 0xca, 0x6a, 0xc1, 0x88, 0x85,
0x94, 0x2f, 0xde, 0x8f, 0xb2, 0x35, 0xc0, 0x3b, 0x69, 0xc3, 0x1c, 0x01,
0x26, 0x94, 0xb8, 0x11, 0x3e, 0x05, 0x13, 0xfb, 0x73, 0x61, 0xb4, 0xf1,
0x77, 0xb3, 0x75, 0xd1, 0x0e, 0x97, 0x20, 0xe5, 0xe1, 0x73, 0xbb, 0x9a,
0x81, 0x8d, 0x69, 0x13, 0x07, 0x2c, 0xf8, 0x6a, 0xe3, 0x0f, 0x61, 0x1d,
0x3f, 0x03, 0xf1, 0x41, 0xbc, 0x36, 0x16, 0x09, 0x3f, 0x09, 0xad, 0x5b,
0xf7, 0x68, 0x83, 0x40, 0x43, 0x5f, 0xaf, 0xd0, 0x7a, 0x5e, 0x17, 0x5a,
0xe7, 0x98, 0x80, 0x4f, 0xf0, 0xb9, 0x86, 0xac, 0xfc, 0x1c, 0xc4, 0x75,
0x59, 0x1f, 0xce, 0x7a, 0xe4, 0xf8, 0x5f, 0xa6, 0xfd, 0x05, 0xbc, 0x7a,
0x0b, 0x46, 0xa9, 0x43, 0x49, 0x5c, 0xe0, 0x58, 0xb3, 0x11, 0x1a, 0x86,
0xbc, 0x1f, 0xc6, 0x86, 0x9c, 0xfc, 0xd4, 0x38, 0x6b, 0xdb, 0x1e, 0x35,
0x6d, 0xfb, 0xb8, 0x59, 0x86, 0x94, 0xaa, 0x85, 0x00, 0x81, 0x61, 0x53,
0x41, 0x52, 0x6d, 0x0d, 0x7b, 0xa1, 0x85, 0xee, 0xc0, 0xbf, 0x70, 0xce,
0xc9, 0x68, 0x09, 0xdc, 0xe7, 0x7b, 0x50, 0x86, 0xbc, 0xea, 0x5a, 0xed,
0x58, 0xda, 0xb6, 0x4f, 0xeb, 0x5e, 0x1c, 0xa7, 0x7d, 0x86, 0xb3, 0xff,
0x62, 0xe7, 0x69, 0x9b, 0x51, 0xbd, 0x38, 0xbe, 0x0f, 0x33, 0xaa, 0x6d,
0xcf, 0xf2, 0xde, 0x81, 0x6c, 0xd1, 0xce, 0xb6, 0xad, 0xe8, 0xb6, 0xbd,
0x5b, 0xff, 0xad, 0xbd, 0xeb, 0x77, 0x9e, 0xb5, 0xed, 0x43, 0xe6, 0x55,
0x38, 0x91, 0x69, 0x13, 0x5b, 0xe6, 0x97, 0x05, 0x36, 0x4f, 0xdb, 0x38,
0x6d, 0x42, 0x55, 0xe2, 0x9b, 0xc4, 0xe6, 0xf9, 0x0e, 0xb1, 0x31, 0x77,
0x8b, 0xd8, 0x34, 0xfb, 0x27, 0xa2, 0x63, 0xbe, 0x47, 0xb4, 0xe7, 0x42,
0x98, 0xb3, 0x82, 0x98, 0xb5, 0xba, 0x45, 0xdb, 0x7c, 0x97, 0x70, 0xe7,
0x31, 0x28, 0x5a, 0x73, 0x45, 0x59, 0x97, 0xed, 0xb8, 0x39, 0x4d, 0x6f,
0x5b, 0x65, 0x1c, 0x67, 0xd1, 0xfe, 0x51, 0xfd, 0x22, 0xe7, 0x69, 0xe2,
0xd1, 0xdc, 0x21, 0x6c, 0x9f, 0xb6, 0xed, 0x6c, 0x0c, 0xc8, 0xe6, 0x80,
0x67, 0xac, 0x48, 0x67, 0x9f, 0xb0, 0xed, 0x76, 0xc3, 0x5e, 0x71, 0xce,
0x6c, 0x88, 0xbe, 0x88, 0xff, 0x67, 0xcf, 0x04, 0x91, 0xaa, 0xa4, 0x8c,
0xc3, 0xf4, 0xd9, 0xdd, 0x63, 0xf0, 0x95, 0xc5, 0x47, 0xf1, 0x6e, 0x1a,
0xbe, 0xd2, 0x78, 0x0a, 0xa7, 0xd3, 0xc3, 0xaa, 0x0f, 0x91, 0xd0, 0x66,
0x91, 0x1a, 0x54, 0xa0, 0xf5, 0xbf, 0x05, 0x2d, 0x4c, 0x7f, 0x9c, 0x79,
0x41, 0x68, 0xf9, 0x17, 0xa1, 0x25, 0x7f, 0x2b, 0xb4, 0x8e, 0x5a, 0x0f,
0x92, 0x8a, 0xe1, 0xc3, 0x8f, 0xea, 0xa5, 0x4f, 0x46, 0xb1, 0xca, 0xf1,
0x4d, 0x0a, 0xd7, 0x5e, 0xf2, 0x0d, 0xed, 0x45, 0xbd, 0x0e, 0x50, 0xaf,
0x97, 0x4c, 0x2d, 0x74, 0x0c, 0xf6, 0x8a, 0x5e, 0xd3, 0xbd, 0x37, 0x9a,
0x6b, 0xc1, 0x23, 0x56, 0x12, 0x87, 0xac, 0x1f, 0x50, 0xe7, 0x36, 0xc6,
0x41, 0x12, 0xdf, 0xcf, 0xb5, 0xe1, 0xc7, 0xb9, 0x38, 0xbe, 0xc7, 0x7b,
0xdf, 0xcd, 0x35, 0xe3, 0xf9, 0x9c, 0x89, 0xef, 0xe4, 0x1a, 0xf1, 0x5c,
0x2e, 0x8a, 0x67, 0x73, 0x5e, 0xb1, 0xd1, 0xca, 0x62, 0xf3, 0x58, 0x0a,
0xed, 0x8c, 0xa5, 0x33, 0xe9, 0x48, 0xcb, 0x53, 0xd0, 0x9e, 0x65, 0x40,
0x07, 0x3a, 0x72, 0x6a, 0xa0, 0xcd, 0xd2, 0x3a, 0x80, 0x60, 0xa0, 0x2d,
0xa7, 0xe3, 0x54, 0x3a, 0x14, 0x68, 0xcd, 0x85, 0x02, 0x1b, 0xac, 0xe5,
0x81, 0x0d, 0x39, 0x43, 0x9c, 0x55, 0x05, 0x22, 0x2b, 0x7d, 0xd8, 0x9b,
0xf9, 0x25, 0x7a, 0x6a, 0xa4, 0x56, 0x2a, 0xee, 0xa5, 0x6d, 0x5e, 0x8d,

/* bnx2_fw2.h: Broadcom NX2 network driver.
*
* Copyright (c) 2004-2010 Broadcom Corporation
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, except as noted below.
*
* This file contains firmware data derived from proprietary unpublished
* source code, Copyright (c) 2004-2010
* Broadcom Corporation.
*
* Permission is hereby granted for the distribution of this firmware data
* in hexadecimal or equivalent format, provided this copyright notice is
* accompanying it.
*/

static u8 bnx2_COM_b09FwText[] = {
0xc5, 0x7c, 0x7d, 0x70, 0x1c, 0xe7, 0x79, 0xdf, 0xb3, 0x7b, 0x7b, 0xc0,
0x01, 0x04, 0xc1, 0x05, 0x78, 0x42, 0x4e, 0x34, 0x4c, 0xdd, 0x01, 0x8b,
0x0f, 0x89, 0x90, 0xb2, 0x44, 0x8f, 0x14, 0x54, 0xad, 0xa4, 0xf3, 0x1d,
0x48, 0x41, 0x8e, 0xac, 0x42, 0x12, 0x8d, 0xaa, 0x0d, 0x27, 0x45, 0x0e,

/* bnx2.h: Broadcom NX2 network driver.
*
* Copyright (c) 2004-2010 Broadcom Corporation
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation.
*
* Written by: Michael Chan (mchan@broadcom.com)
*/


#ifndef BNX2_H
#define BNX2_H

#if defined(__VMKLNX__) && (VMWARE_ESX_DDK_VERSION >= 41000)
#define VMWARE_ISCSI
#endif

#if defined(__VMKLNX__) && \
(VMWARE_ESX_DDK_VERSION >= 40000)
#define BNX2_VMWARE_BMAPILNX
#endif

#if defined(__VMKLNX__)
#define HAVE_LE32 1
#define HAVE_IP_HDR 1
#define NEW_SKB 1
#define BNX2_NEW_NAPI 1
#endif

#ifndef ADVERTISE_1000XFULL
#define ADVERTISE_1000XFULL 0x0020
#define ADVERTISE_1000XHALF 0x0040
#define ADVERTISE_1000XPAUSE 0x0080
#define ADVERTISE_1000XPSE_ASYM 0x0100
#endif

#ifndef ADVERTISE_PAUSE_CAP
#define ADVERTISE_PAUSE_CAP 0x0400
#define ADVERTISE_PAUSE_ASYM 0x0800
#endif

#ifndef MII_CTRL1000
#define MII_CTRL1000 0x9
#define MII_STAT1000 0xa
#endif

#ifndef BMCR_SPEED1000
#define BMCR_SPEED1000 0x0040
#endif

#ifndef ADVERTISE_1000FULL
#define ADVERTISE_1000FULL 0x0200
#define ADVERTISE_1000HALF 0x0100
#endif

#ifndef SPEED_2500
#define SPEED_2500 2500
#endif

#ifndef SUPPORTED_2500baseX_Full
#define SUPPORTED_2500baseX_Full (1 size = size;
skb_shinfo(skb)->nr_frags = i + 1;
#else
skb_fill_page_desc(skb, i, page, off, size);
#endif
}

#ifndef NETIF_F_GSO
static inline void netif_tx_lock(struct net_device *dev)
{
spin_lock(&dev->xmit_lock);
dev->xmit_lock_owner = smp_processor_id();
}

static inline void netif_tx_unlock(struct net_device *dev)
{
dev->xmit_lock_owner = -1;
spin_unlock(&dev->xmit_lock);
}
#endif

#if !defined(HAVE_NETDEV_PRIV) && (LINUX_VERSION_CODE != 0x020603) && (LINUX_VERSION_CODE != 0x020604) && (LINUX_VERSION_CODE != 0x20605)
static inline void *netdev_priv(struct net_device *dev)
{
return dev->priv;
}
#endif

#ifdef OLD_NETIF
static inline void netif_poll_disable(struct net_device *dev)
{
while (test_and_set_bit(__LINK_STATE_RX_SCHED, &dev->state)) {
/* No hurry. */
current->state = TASK_INTERRUPTIBLE;
schedule_timeout(1);
}
}

static inline void netif_poll_enable(struct net_device *dev)
{
clear_bit(__LINK_STATE_RX_SCHED, &dev->state);
}

static inline void netif_tx_disable(struct net_device *dev)
{
spin_lock_bh(&dev->xmit_lock);
netif_stop_queue(dev);
spin_unlock_bh(&dev->xmit_lock);
}

#endif

#if (LINUX_VERSION_CODE >= 0x20418) && (LINUX_VERSION_CODE < 0x2060c)
static inline int bnx2_set_tx_hw_csum(struct net_device *dev, u32 data)
{
if (data)
dev->features |= NETIF_F_HW_CSUM;
else
dev->features &= ~NETIF_F_HW_CSUM;

return 0;
}
#endif

#ifndef VLAN_GROUP_ARRAY_SPLIT_PARTS
static inline void vlan_group_set_device(struct vlan_group *vg, int vlan_id,
struct net_device *dev)
{
if (vg)
vg->vlan_devices[vlan_id] = dev;
}
#endif

#ifdef NETIF_F_TSO
#ifndef NETIF_F_GSO
static inline int skb_is_gso(const struct sk_buff *skb)
{
return skb_shinfo(skb)->tso_size;
}
#define gso_size tso_size
#define gso_segs tso_segs
#endif
#ifndef NETIF_F_TSO6
#define NETIF_F_TSO6 0
#define BCM_NO_TSO6 1
#endif
#ifndef NETIF_F_TSO_ECN
#define NETIF_F_TSO_ECN 0
#endif

#ifndef HAVE_IP_HDR
static inline struct iphdr *ip_hdr(const struct sk_buff *skb)
{
return skb->nh.iph;
}
#endif

#ifndef NEW_SKB
static inline int skb_transport_offset(const struct sk_buff *skb)
{
return (int) (skb->h.raw - skb->data);
}

static inline unsigned int ip_hdrlen(const struct sk_buff *skb)
{
return ip_hdr(skb)->ihl * 4;
}

static inline struct tcphdr *tcp_hdr(const struct sk_buff *skb)
{
return skb->h.th;
}

static inline unsigned int tcp_optlen(const struct sk_buff *skb)
{
return (tcp_hdr(skb)->doff - 5) * 4;
}

#endif
#endif /* #ifdef NETIF_F_TSO */

#ifndef VMWARE_ESX_40_DDK
#if ((LINUX_VERSION_CODE >= 0x20617) && !defined(NETIF_F_MULTI_QUEUE)) || defined(__VMKLNX__)

#define BCM_HAVE_MULTI_QUEUE

#else

static inline void netif_tx_wake_all_queues(struct net_device *dev)
{
netif_wake_queue(dev);
}

static inline void netif_tx_start_all_queues(struct net_device *dev)
{
netif_start_queue(dev);
}

#endif
#else
#define BCM_HAVE_MULTI_QUEUE
#endif


#ifndef NET_SKB_PAD
#define NET_SKB_PAD 16
#endif

#if (LINUX_VERSION_CODE < 0x02061e)
static inline void skb_record_rx_queue(struct sk_buff *skb, u16 rx_queue)
{
}
#endif

#if defined(HAVE_SET_RX_MODE) || (LINUX_VERSION_CODE > 0x20621)
#define BCM_HAVE_SET_RX_MODE 1
#endif

#ifdef NETDEV_HW_ADDR_T_MULTICAST
#define BCM_NEW_NETDEV_HW_ADDR
#endif

#ifndef netdev_uc_count
#if (LINUX_VERSION_CODE < 0x2061f)
#define netdev_uc_count(dev) ((dev)->uc_count)
#else
#define netdev_uc_count(dev) ((dev)->uc.count)
#endif
#endif

#ifndef netdev_for_each_uc_addr
#define netdev_for_each_uc_addr(ha, dev) \
list_for_each_entry(ha, &dev->uc.list, list)
#endif

#ifndef netdev_for_each_mc_addr
#define netdev_for_each_mc_addr(mclist, dev) \
for (mclist = dev->mc_list; mclist; mclist = mclist->next)
#endif

#if (LINUX_VERSION_CODE < 0x020600)
#define dev_err(unused, format, arg...) \
printk(KERN_ERR "bnx2: " format , ## arg)
#else
#ifndef HAVE_DEV_ERR
#ifndef HAVE_DEV_PRINTK
#define dev_printk(level, dev, format, arg...) \
printk(level "bnx2 %s: " format , (dev)->bus_id , ## arg)
#endif
#define dev_err(dev, format, arg...) \
dev_printk(KERN_ERR , dev , format , ## arg)
#endif
#endif

#if !defined(DECLARE_MAC_BUF) || (LINUX_VERSION_CODE >= 0x020621)
#ifndef MAC_FMT
#define MAC_FMT "%02x:%02x:%02x:%02x:%02x:%02x"
#endif

static inline char *print_mac(char *buf, const u8 *addr)
{
sprintf(buf, MAC_FMT,
addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
return buf;
}
#endif

#ifndef DECLARE_MAC_BUF
#define DECLARE_MAC_BUF(var) char var[18]
#endif


#ifndef ARRAY_SIZE
#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
#endif

#if (LINUX_VERSION_CODE >= 0x020618)
#define BNX2_NEW_NAPI 1

#if (LINUX_VERSION_CODE < 0x02061b)

static inline void netif_napi_del(struct napi_struct *napi)
{
#ifdef CONFIG_NETPOLL
list_del(&napi->dev_list);
#endif
}

#endif
#endif

static inline void bnx2_msleep(unsigned int msecs)
{
#if (LINUX_VERSION_CODE < 0x20607)
current->state = TASK_UNINTERRUPTIBLE;
schedule_timeout((msecs * HZ / 1000) + 1);
#else
msleep(msecs);
#endif
}

static inline unsigned long bnx2_msleep_interruptible(unsigned int msecs)
{
#if (LINUX_VERSION_CODE < 0x20609)
current->state = TASK_INTERRUPTIBLE;
return schedule_timeout((msecs * HZ / 1000) + 1);
#else
return msleep_interruptible(msecs);
#endif
}

#ifndef HAVE_BOOL
typedef int bool;
#define false 0
#define true 1
#endif

#if defined (__VMKLNX__)
/**
* THIS FUNCTION SHOULD BE REMOVED ONCE PR 379263 IS RESOLVED
*/
static inline void *bcm_memmove(void *dest, const void *src, size_t count)
{
char *tmp;
const char *s;

if (dest

[MaXXX eternal tiare]

Non ho esperienza nell'aggiornare schede di rete ma un virus "x" su un pc win potrebbe cambiarmi il firmware così in silenzio? la stessa cosa era stata fatta per il bios non efi delle schede madri ma era ritenuta (se non mi sono perso qualcosa) inefficacie perchè bisognava avere l'accesso fisico del pc e quindi essere l'utente stesso.