118 lines
3.7 KiB
Plaintext
118 lines
3.7 KiB
Plaintext
|
||
Phantasie Mutation Engine for Windows <tm> Version 0.00
|
||
Written by Burglar in Taipei, Taiwan. (95/07/16)
|
||
|
||
|
||
1. License
|
||
|
||
You are free to include this Engine in your Windows virii, and
|
||
your Windows virii don't injure anything. Injure anything is
|
||
prohibited.
|
||
|
||
|
||
2. How to use it
|
||
|
||
when you want use it, you must declare below at first in code
|
||
segment.
|
||
|
||
EXTRN PMEW:NEAR, PMEW_END:NEAR
|
||
|
||
Then you write your Windows virii as usual. When you need to
|
||
encrypt the code, you just call the Engine. Put the following
|
||
instruction in your code:
|
||
|
||
CALL PMEW
|
||
|
||
You also need to supply the parameters for the Engine. They are
|
||
passed in registers. Results are also passed in registers.
|
||
|
||
Of course, you must link the PMEW.OBJ module to your Windows virii
|
||
!
|
||
|
||
PMEW_END labeled the tail of your virii that includes the engine,
|
||
and you can use OFFSET PMEW_END to get the length of your Windows
|
||
virii that includes the engine.
|
||
|
||
|
||
3. Input parameters
|
||
|
||
All parameters are mandatory. Description follows:
|
||
|
||
ES:DI => Work space
|
||
|
||
The Engine needs work space. For placing product (decrypt code
|
||
& encrypted code) which is generated by PME/W.
|
||
|
||
DS:SI => Code to encrypt
|
||
|
||
On entry, just set DS:SI to point to the code you want to be
|
||
encrypted.
|
||
|
||
CX = Length of code to encrypt
|
||
|
||
On entry, just set CX to the length of the code you want to be
|
||
encrypted.
|
||
|
||
DX:AX => Relocation fixup information
|
||
|
||
When your virii has relocation records (such as you may call the
|
||
Windows APIs to do something, or your virii will pass control to
|
||
host program via intersegment jump, etc.) , you have to pass
|
||
pertinent information to PME/W.
|
||
|
||
Format of relocation fixup information:
|
||
Offset Size Description
|
||
00h WORD number of relocation items
|
||
02h 2N BYTEs relocation items
|
||
Offset Size Description
|
||
00h WORD offset within segment
|
||
|
||
ATTENTION!
|
||
Your Windows virii must be zero start! (i.e. begin running with
|
||
CS:0000)
|
||
|
||
|
||
4. Results
|
||
|
||
The Engine returns the following values in registers:
|
||
(all other except for the listed below will be PRESERVED)
|
||
|
||
CX = Length of the decryption routine
|
||
|
||
CX now has the length of decryption routine.
|
||
ATTENTION! (mere length of decryption routine)
|
||
|
||
The product (decryption routine & encrypted code) which generated
|
||
by PME/W is placed in Work space (i.e. pointed by ES:DI)
|
||
|
||
|
||
5. Final Notes
|
||
|
||
SPECIAL THANKS:
|
||
|
||
qark (for your Windows infection theory & WinSurfer)
|
||
quantum (for WinSurfer & grin me !@#$%^&*)
|
||
metabolis (for leading vlad magazine & tons of stuff)
|
||
malware (for NE format detail)
|
||
lookout (for tons of stuff)
|
||
kdkd (for tons of stuff & blah.gif - fxxx with horse !@#$%^&*)
|
||
horde (for tons of stuff - cvdq.arj)
|
||
dread (for giving me a account in Russia)
|
||
theora (you are the only one female interested in virii, could you
|
||
be my girl friend ?!)
|
||
slash (hehe... my teacher & confident)
|
||
|
||
|
||
Well, that's for now. No time for more. No demonstration program
|
||
.
|
||
|
||
Pass the Engine (all files together in an archive) to Windows virii
|
||
programmers.
|
||
|
||
|
||
Greetings to all virii programmers
|
||
|
||
Burglar
|
||
|
||
Taipei, Taiwan.
|
||
|