Finding Easter Eggs for fun but not for profit :P!

Posted by Matthieu Suiche on August 17, 2007 · 3 Comments 

Only the most skilled ninjas are able to find out easter eggs… Even Alice needed to follow the rabbit to find them… “We are all mad here!” hihi

O.S. Version: Windows 2003 SP1 Checked only
Module: diskdump.sys

; Exported entry  10. ScsiPortGetPhysicalAddress
; SCSI_PHYSICAL_ADDRESS __stdcall ScsiPortGetPhysicalAddress
; (PVOID HwDeviceExtension,
; PSCSI_REQUEST_BLOCK Srb,
; PVOID VirtualAddress,
;ULONG *Length)

 _ScsiPortGetPhysicalAddress@16: ; CODE XREF: StorPortGetPhysicalAddress(x,x,x,x)
                 mov     edi, edi
                 push    ebp
                 mov     ebp, esp
                 mov     edx, [ebp+arg_4]
                 test    edx, edx
                 push    esi
                 jz      loc_1308D
                 mov     eax, _DeviceExtension
                 cmp     byte ptr [eax+2B9h], 0 ; Magic byte inside DriverExtension's Buffer :)
                 jz      short Hidden_String
[...]
 Hidden_String:
                 push    offset aDiskdumpJeffLe ; "DISKDUMP: Jeff led me to believe this c"...
                 push    0
                 call    _ScsiDebugPrint
[...]
 aDiskdumpJeffLe  db 'DISKDUMP: Jeff led me to believe this code may never get executed.',0Ah,0

Never say never again :)

Filed under Windows · Tagged with