On 03/10/2012 03:51 AM, [email protected] wrote: > http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duqu_Framework > > Haven't seen this (or much discussion around this) here yet, so I > figured I'd share.
From the description, it looks like someone pushed some code from a Lisp[1] variant (like Common Lisp, which is preprocesed into ANSI C by GCL, for example, before compilation) into a C++ DLL. Normal in the deper end of Linux dev or Hurd communities, but definitely not standard practice in any established industry that makes use of Windows. I could be wrong, I didn't take the time to walk myself through the decompile with any thoroughness and compare it to code I generate. Anyway, I have no idea the differences between how VC++ and g++ do things -- so my analysis would probably be trash. But from the way the Mr. Soumenkov describes things it seems this, or something similar, could be the case and why the code doesn't conform to what's expected in a C++ binary. -IY 1. [Caveat] I say "Lisp" but some other languages come to mind as well; maybe Haskell would come out that way. I'm not sure because I'm most familiar with Lisp and know it can be cobbled with C/C++ without complications because of the way most of its C-based implementations work. Anyway, if I were looking for a lock on how this code was produced, I would ignore C-based languages and focus instead on languages that behave this way natively first, because I think that's the least exotic explanation for the features this segment of code exhibits. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
