319 lines
12 KiB
Plaintext
319 lines
12 KiB
Plaintext
|
PS-MPC
|
|||
|
|
Pretty Slick Multimedia Personal Computer
|
|||
|
|
(WRONG!)
|
|||
|
|
Phalcon/Skism Mass-Produced Code Generator 0.91<EFBFBD>
|
|||
|
|
Created by Dark Angel
|
|||
|
|
17 August 1992
|
|||
|
|
|
|||
|
|
"It's not a bug, it's a feature!"
|
|||
|
|
|
|||
|
|
TABLE OF CONTENTS
|
|||
|
|
|
|||
|
|
TABLE OF CONTENTS i
|
|||
|
|
DEDICATION i
|
|||
|
|
DISCLAIMER ii
|
|||
|
|
PURPOSE ii
|
|||
|
|
WHAT IS THE PS-MPC? 1
|
|||
|
|
USING THE PS-MPC 1
|
|||
|
|
NO ACTIVATION ROUTINES 1
|
|||
|
|
WHY NO IDE 2
|
|||
|
|
SOURCE CODE AVAILABILITY 2
|
|||
|
|
PROBLEMS 2
|
|||
|
|
FUTURE ENHANCEMENTS 2
|
|||
|
|
HISTORY OF VIRUS TOOLKITS A
|
|||
|
|
|
|||
|
|
DEDICATION:
|
|||
|
|
|
|||
|
|
The author hereby releases this program and its source code into the
|
|||
|
|
public domain as "freeware." All code generated by the program must,
|
|||
|
|
however, retain the designation of said program, although all other parts
|
|||
|
|
may be modified at the user's discretion. The author dedicates this
|
|||
|
|
program to both the virus and anti-virus communities, both of which profit
|
|||
|
|
from the introduction of the Phalcon/Skism Mass-Produced Code Generator.
|
|||
|
|
|
|||
|
|
Thanks are due to NoWhere Man for his excellent program VCL, which
|
|||
|
|
served as the inspiration for this package.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
PS-MPC Documentation - i - Phalcon/Skism 1992
|
|||
|
|
|
|||
|
|
|
|||
|
|
DISCLAIMER
|
|||
|
|
|
|||
|
|
This program may cause either the intentional or unintentional
|
|||
|
|
disruption of normal brain wave activity of the user due to the extreme
|
|||
|
|
shock quality of the program. The author hereby absolves himself of all
|
|||
|
|
liability. Persons with pacemakers beware!
|
|||
|
|
|
|||
|
|
The code produced by the Phalcon/Skism Mass-Produced Code Generator
|
|||
|
|
is not designed to be damaging; however, the author is not responsible for
|
|||
|
|
incidental damages caused by use of the program. Further, the author is
|
|||
|
|
not responsible for damages caused by changes to the code generated by the
|
|||
|
|
PS-MPC. The author does not condone the illegal spread of executable code
|
|||
|
|
created in part by the PS-MPC. All source code and executable files
|
|||
|
|
created with the aid of the PS-MPC must be distributed with the recipient's
|
|||
|
|
full knowledge of the contents. Malicious use of the code is strictly
|
|||
|
|
prohibited.
|
|||
|
|
|
|||
|
|
PURPOSE
|
|||
|
|
|
|||
|
|
The Phalcon/Skism Mass-Produced Code Generator is not designed to
|
|||
|
|
create malicious code; rather, it is a learning tool from which a person
|
|||
|
|
may learn to write effective viral code. The code generated by the PS-MPC
|
|||
|
|
is highly optimised for both size and speed and is therefore the code
|
|||
|
|
generated can be used by the fledgling virus writer as a model for future
|
|||
|
|
endeavours.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
PS-MPC Documentation - ii - Phalcon/Skism 1992
|
|||
|
|
|
|||
|
|
|
|||
|
|
WHAT IS THE PS-MPC?
|
|||
|
|
|
|||
|
|
The Phalcon/Skism Mass-Produced Code Generator is a tool which
|
|||
|
|
generates viral code according to user-designated specifications. The
|
|||
|
|
output is in Masm/Tasm-compatible Intel 8086 assembly and it is up to the
|
|||
|
|
user to assemble the output into working executable form. The features of
|
|||
|
|
the PS-MPC include the following:
|
|||
|
|
|
|||
|
|
o Over 150 encryption techniques, randomly generated during each run of
|
|||
|
|
the PS-MPC
|
|||
|
|
o Compact, commented code, much tighter than VCL
|
|||
|
|
o COM/EXE infections
|
|||
|
|
o Both resident and nonresident viruses
|
|||
|
|
o Two types of traversals for nonresident viruses
|
|||
|
|
o Three types of high memory residency routines for TSR viruses
|
|||
|
|
o Optional infection of Command.Com
|
|||
|
|
o Critical error handler support
|
|||
|
|
|
|||
|
|
USING THE PS-MPC
|
|||
|
|
|
|||
|
|
The syntax of the PS-MPC is simple:
|
|||
|
|
|
|||
|
|
PS-MPC <file1> <file2> <file3>...
|
|||
|
|
|
|||
|
|
The parameters given to the PS-MPC are the names of the configuration
|
|||
|
|
files. For example, to create two separate viruses using the configuration
|
|||
|
|
files FOOBAR1.CFG and FOOBAR2.CFG, simply type "PS-MPC FOOBAR1.CFG
|
|||
|
|
FOOBAR2.CFG" at the prompt.
|
|||
|
|
|
|||
|
|
The configuration file is a text file containing a set of parameters
|
|||
|
|
which define the output of the PS-MPC. A sample configuration file,
|
|||
|
|
SKELETON.CFG is included with the package. This configuration file
|
|||
|
|
contains all the acceptable parameters to the PS-MPC. It also includes the
|
|||
|
|
defaults to each of these parameters. The configuration file is self-
|
|||
|
|
explanatory, so there is no need to go into further detail at this time.
|
|||
|
|
|
|||
|
|
When the Generator has completed creating the source code file/s,
|
|||
|
|
simply assemble the output file/s with your favorite assembler/linker
|
|||
|
|
combination. A multi-pass assembler is recommended. Masm is a poor choice
|
|||
|
|
for an assembler; try Tasm. Masm requires the code to include extra
|
|||
|
|
segment overrides which unnecessarily add to the code length. Masm 6.0 may
|
|||
|
|
fix these problems (I'm not sure since I don't have it). Tasm, on the
|
|||
|
|
other hand, is an excellent, fast, multipass assembler far superior to
|
|||
|
|
Masm.
|
|||
|
|
|
|||
|
|
When linking resident viruses, it is important to have EXE2BIN or an
|
|||
|
|
equivalent. For ease of coding, resident viruses are generated with org 0.
|
|||
|
|
However, TLink refuses to generate a COM file from the OBJ. Simply create
|
|||
|
|
an EXE file and run it through EXE2BIN. Note that some options are not yet
|
|||
|
|
available with resident viruses. This will be fixed in the next release.
|
|||
|
|
|
|||
|
|
NO ACTIVATION ROUTINES
|
|||
|
|
|
|||
|
|
I have not included any activation routines in the package simply
|
|||
|
|
because I do not think the power of creating potentially-destructive
|
|||
|
|
viruses should be in the hands of persons incapable of coding a simple
|
|||
|
|
activation routine in assembly. If you can rip a simple FAT-annihilator
|
|||
|
|
out of another trojan, then I cannot stop you from doing so. But just
|
|||
|
|
remember that the most memorable viruses are not necessarily those that
|
|||
|
|
cause the most damage, but are usually those that have unusual activation
|
|||
|
|
|
|||
|
|
PS-MPC Documentation - 1 - Phalcon/Skism 1992
|
|||
|
|
|
|||
|
|
|
|||
|
|
routines.
|
|||
|
|
|
|||
|
|
Upon finding activation conditions, the PS-MPC will generate a short
|
|||
|
|
stub for the activation routine. This is located immediately after the
|
|||
|
|
code for the restoration of the executable files. It is identified by the
|
|||
|
|
label "activate" and is followed by a return. Insert your own activation
|
|||
|
|
routine between those two lines.
|
|||
|
|
|
|||
|
|
WHY NO IDE (Integrated Development Environment)
|
|||
|
|
|
|||
|
|
Everyone agrees that Microsoft Windows is for cripples. Obviously,
|
|||
|
|
you, the user of the PS-MPC, are no cripple, so you need no puny IDE with
|
|||
|
|
colourful, deluxe windows to aid you. If you are a cripple, go ahead and
|
|||
|
|
create the configuration file in your favorite Windows text editor. Hell,
|
|||
|
|
port the code to the Macintosh and you can be truly crippled (although
|
|||
|
|
you'll have your pretty windows and icons).
|
|||
|
|
|
|||
|
|
SOURCE CODE AVAILABILITY
|
|||
|
|
|
|||
|
|
This program is distributed with full source code. Although the
|
|||
|
|
source should be self-explanatory, I have gone back and commented several
|
|||
|
|
portions in order to facilitate understanding. The program was written in
|
|||
|
|
Turbo C 2.0 and compiled in the tiny memory model. Make sure the unsigned
|
|||
|
|
characters option is on or else the code will not compile properly. It is
|
|||
|
|
in the Options/Compiler menu. I trust that you will not hack this program
|
|||
|
|
and call it your own. Source code is available only because I think it
|
|||
|
|
will aid in your understanding of the program.
|
|||
|
|
|
|||
|
|
If you make any improvements to the source code, please show me a
|
|||
|
|
copy; I may incorporate the changes into the next release of the PS-MPC.
|
|||
|
|
Please note the changes in the source.
|
|||
|
|
|
|||
|
|
PROBLEMS
|
|||
|
|
|
|||
|
|
This program was written hastily. The bulk of the coding was
|
|||
|
|
completed in under two days. Features were added by the process of
|
|||
|
|
accretion during the following week. Needless to say, the code is now
|
|||
|
|
extremely unmanageable. If there is enough interest in the package, I will
|
|||
|
|
rewrite it in order to alleviate the strain caused in maintaining such
|
|||
|
|
code. This will help in adding features as the need arises.
|
|||
|
|
|
|||
|
|
Version 0.91<EFBFBD> is somewhat better coded than 0.90<EFBFBD>, but I will be
|
|||
|
|
continuing to work on improvements as time permits. Please report any bugs
|
|||
|
|
to me and I will send you a fixed version as soon as I can.
|
|||
|
|
|
|||
|
|
FUTURE ENHANCEMENTS
|
|||
|
|
|
|||
|
|
As you may have already noticed, this is a pre-1.0 release version of
|
|||
|
|
the Generator. There are several features which I wish to add before
|
|||
|
|
version 1.0. These include, but are not limited to limited stealth
|
|||
|
|
techniques, padded-EXE infections (shorter routine), and better
|
|||
|
|
documentation(!). A few surprises will be thrown in as well. I do not
|
|||
|
|
plan on increasing the size of the PS-MPC.COM file dramatically, so with
|
|||
|
|
every addition will come code to keep the increase in file size to a
|
|||
|
|
minimum. I do not intend to devote too much time to the project as I
|
|||
|
|
personally don't actually use the generator to spew out code for the group.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
PS-MPC Documentation - 2 - Phalcon/Skism 1992
|
|||
|
|
|
|||
|
|
|
|||
|
|
HISTORY OF VIRUS TOOLKITS
|
|||
|
|
|
|||
|
|
The first known virus toolkit was called VCS, or Virus Construction
|
|||
|
|
Set. This program generated a new virus each time it was run. However,
|
|||
|
|
there were no code differences at all between any two viruses generated by
|
|||
|
|
VCS. All viruses generated were 1077 bytes in length and all could be
|
|||
|
|
detected with the identical scan string. The advantage in this approach
|
|||
|
|
was that the user needed absolutely no knowledge of 8086 assembly to take
|
|||
|
|
advantage of this program. This program of limited usefulness spawned only
|
|||
|
|
one well-known variant called Manta. It is not even worth mentioning here.
|
|||
|
|
|
|||
|
|
The second virus toolkit was CrazySoft, Inc.'s Dark Avenger Mutation
|
|||
|
|
Engine (MtE). This magnificent work of Bulgarian coding allowed virus
|
|||
|
|
authors to create viruses with an almost limitless number of decryption
|
|||
|
|
routines. Although the author needed to know how to write 8086 assembly
|
|||
|
|
code, no knowledge of the inner workings of MtE save the entry parameters
|
|||
|
|
was needed to use this toolkit. It has since spawned several viruses,
|
|||
|
|
including Dedicated, Pogue, Fear, and Groove.
|
|||
|
|
|
|||
|
|
The next virus toolkit to be released was VCL, or Virus Construction
|
|||
|
|
Laboratory. This was written by NoWhere Man of NuKE. This toolkit allowed
|
|||
|
|
the user many options, including the creation of parasitic COM infectors,
|
|||
|
|
spawning EXE infectors, trojan horses and logic bombs. Since it could only
|
|||
|
|
handle parasitic infections of the COM file format, it was of limited
|
|||
|
|
usefulness. Additionally, it incorporated only one decryption formula,
|
|||
|
|
once again limiting its usefulness. Further, the initial release included
|
|||
|
|
a quirky installation program which failed to install properly under
|
|||
|
|
certain conditions. However, this package contained a colourful IDE
|
|||
|
|
loosely based on the Borland interface. This IDE was incredibly simple to
|
|||
|
|
use and even the average Joe could understand how to use it without
|
|||
|
|
understanding 80x86 assembly. Unfortunately, the activation routines
|
|||
|
|
included with the package were of limited usefulness. Most of these
|
|||
|
|
involved manipulating the BIOS memory area at segment 40h.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
PS-MPC Documentation - A - Phalcon/Skism 1992
|
|||
|
|
|
|||
|
|
|