Mail Archives: cygwin/2001/06/29/17:58:59
Randall R Schulz:
> Hi,
>
> Well, this is curious. There's a c++.exe in my bin, and I
> take it that it's
> present in that of all Cygwin installs that include the C++
> compiler, right?
>
> Here's the output of sum on /bin/c++.exe in my Cygwin install
> (the latest
> release versions of everything currently present on mirrors.rcn.net):
>
> % sum /bin/c++.exe
> 02568 71
>
> % c++ --version
> 2.95.3-5
>
>
> What's interesting is that '+' and ',' are adjacent ASCII
> codes (0x53 vs.
> 0x54 -- '+' vs. ','). So there's a three-bit difference
> between "c++.exe"
> and "c+,.exe"
>
Yes, I did notice that.
> How could that have happened without triggering an ECC detection or
> correction? It couldn't happen over the net and it couldn't
> happen on a
> hard drive. I assume it could not happen in GZIP or BZIP2 compression.
>
> Non-parity RAM would seem the only possibility.
>
> Curious, no?
I'm going to have to assume that it must be a virus infected file.
I did a diff on them and they are the same except for the c+,.exe
file has a different beginning and end. I tried debugging the
"infected" file and it made several subroutine calls that have no
apparent function (like a cmp instruction immediately followed by
a return, and upon returning immediately subtract something from
eax), and eventually it came to an instruction that has no
mnemonic (0xD6).
I did find another .exe that is a copy of a program and the last
letter for the filename is also 1 character away from the original
name, although going in the other direction, but the file sizes
are nearly identical, whereas the c+,.exe file is 50K larger than
c++.exe. I guess I'll deal with it.
Thanks for your replies, guys.
Matt
--
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
Bug reporting: http://cygwin.com/bugs.html
Documentation: http://cygwin.com/docs.html
FAQ: http://cygwin.com/faq/
- Raw text -