262 lines
8.9 KiB
Plaintext
262 lines
8.9 KiB
Plaintext
|
||
|
||
|
||
MDL - Mass Destruction Library
|
||
Version 0.10b
|
||
Written by Evil Avatar
|
||
|
||
Table of Contents
|
||
-----------------
|
||
|
||
Table of Contents...................................................1
|
||
Greetings...........................................................1
|
||
License.............................................................2
|
||
What is MDL?........................................................2
|
||
How MDL works.......................................................2
|
||
Using the MDL.......................................................2
|
||
Source code availability............................................3
|
||
Problems............................................................3
|
||
The Future..........................................................4
|
||
Virus Toolkit History...............................................4
|
||
|
||
|
||
Greetings
|
||
---------
|
||
Greetings go out to Dark Angel, Hellraiser, the rest of the Phalcon/Skism
|
||
group, and Dark Avenger, who are, in my humble opinion, the greatest virus
|
||
authors today. MDL is dedicated to John McAfee, for he will benefit the most
|
||
from this package.
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
MDL Documentation -1- Evil Avatar 1993
|
||
|
||
|
||
|
||
License
|
||
-------
|
||
The author hereby releases this program as freeware. You are free to use
|
||
the MDL in viruses. It is prohibited to use it in other ways (i.e. Trojan
|
||
Horse). You may distribute this archive and associated files only to virus
|
||
programmers.
|
||
|
||
What is MDL?
|
||
------------
|
||
MDL is a library that can be linked to any virus. MDL has been written
|
||
using Intel 8086 assembly language. MDL is used as an easy method to destroy
|
||
data on a disk without having to do all the tedious coding.
|
||
|
||
How MDL works
|
||
-------------
|
||
MDL is distributed with many routines, seven of them intending to destroy
|
||
data. Some are very basic; some are fairly complex. One routine that is not
|
||
destructive is a random number generator. This is used by some routines in
|
||
the library. This can also be called for your own use to create random
|
||
numbers for an encryption system.
|
||
|
||
Using the MDL
|
||
-------------
|
||
MDL consists of several modules. I assume you are using assembly to
|
||
write your virus. If you are using a high level language then you are on your
|
||
own. At the beginning of your virus put this:
|
||
|
||
.model tiny
|
||
.code
|
||
|
||
extrn kill_br: near, pot_shot: near, pt_trash:near, sec_buf:near
|
||
extrn screw_file: near, alter_fat: near, fat_fuck: near, rip_hd: near
|
||
extrn rnd_num: near, load_sec: near
|
||
|
||
Then you just write your virus. When you are ready to kill some data, you
|
||
have several options, explained in detail below. Parameters are passed in
|
||
registers. All is left is to link MDL.LIB to your virus. All registers are
|
||
preserved. Now to create havoc!
|
||
|
||
1. KILL_BR
|
||
This is your first option. This call to the MDL will overwrite the boot
|
||
record of any disk you specify with data that you get to specify. All
|
||
parameters are mandatory. They are as follows.
|
||
|
||
AL - Drive number (i.e. A=0, B=1, C=2, etc.).
|
||
|
||
DS:BX - Start of text/code you want the boot sector to be overwritten
|
||
with. You can get real creative with this. You can kill the
|
||
disk with the right text. You might even want this to point to a
|
||
new boot record of your own!
|
||
|
||
2. POT_SHOT
|
||
This option will destroy a sector of your choice on the default drive.
|
||
You can also choose a random sector to destroy.
|
||
|
||
AX - Sector to destroy (to get a random number, call RND_NUM just
|
||
previous to calling this command).
|
||
|
||
|
||
|
||
|
||
MDL Documentation -2- Evil Avatar 1993
|
||
|
||
|
||
|
||
3. PT_TRASH
|
||
With this routine, you can kill the Partition table on the hard disk.
|
||
This will make all data there inaccessible. There are no parameters to this
|
||
routine.
|
||
|
||
4. SCREW_FILE
|
||
The fifth option will open a specified file and overwrite it with random
|
||
data. There is only one parameter.
|
||
|
||
DS:BX - Offset to the name of the file to screw.
|
||
|
||
Note: The file name cannot be a wildcard. Changes are also made to the
|
||
date/time stamp, so if you want stamp kept the same, you will have to do it
|
||
yourself. I thought that this would help in flexability.
|
||
|
||
5. ALTER_FAT
|
||
This will change random bytes in both FATs. This will irrevocably cause
|
||
crosslinks. There are no parameters.
|
||
|
||
6. FAT_FUCK
|
||
This routine will overwrite both copies of the FAT with random data
|
||
making the data on the disk inaccessible. There are no parameters.
|
||
|
||
7. RIP_HD
|
||
Last of the destruction routines, RIP_HD will overwrite the contents of
|
||
the entire disk, making recovery of data impossible. Once again, there are
|
||
no parameters. This command does not return. It keeps formating until the
|
||
computer locks up, or there is an exception error.
|
||
|
||
8. RND_NUM
|
||
This routine will generate 16-bit random numbers. The random number is
|
||
returned in ax.
|
||
|
||
9. LOAD_SEC
|
||
This routine will load a specified sector into a buffer. This routine
|
||
has two parameters.
|
||
|
||
AL - Drive number (i.e. 0=A, 1=B, etc.).
|
||
DX - Logical sector to read.
|
||
|
||
This option returns with ES:BX pointing to the start of the sector buffer.
|
||
|
||
Source code availability
|
||
------------------------
|
||
Source code is made available partly because I think by the time this
|
||
program is a threat to anyone, the virus scanners will be able to detect it,
|
||
partly because It'll help you learn how to create your own malicious code,
|
||
and partly because it'll help me out by allowing others to check for bugs in
|
||
my code. This code is to be used as a learning tool. It is to allow real
|
||
virus writers to spend their time on stealth techniques and other things then
|
||
having to worry about activation routines. This is not to be used with PS-MPC
|
||
or any other code generator and distributed. That is not virus writing. This
|
||
program was written in Turbo Assembler 2.02. I trust that you will not alter
|
||
it and re-release it as your own.
|
||
|
||
Problems
|
||
--------
|
||
This code was written over a weekend and very hastily. It is not very
|
||
|
||
|
||
|
||
MDL Documentation -3- Evil Avatar 1993
|
||
|
||
|
||
|
||
optimized. Also, I didn't give it alot of testing (I don't have a spare hard
|
||
drive to kill). However, I did test some routines on floppy disks and they
|
||
worked fine. This code is bound to have tons of bugs (note the 0.10b
|
||
release). Report any bugs to Evil Avatar. If you can, please suggest
|
||
alternate code (you will be given credit for it).
|
||
|
||
The Future
|
||
----------
|
||
For the future of MDL, I plan on fixing all bugs. I also plan on adding
|
||
any other routines that come to my head (one that comes to mind is a file
|
||
crosslinker). I don't plan on spending too much time to this project as I
|
||
don't endorse the idea of trashing every hard drive in existence. I made MDL
|
||
to see if I could do it. I am only releasing it in hopes that someone can
|
||
learn from it. Remember the most memorable viruses don't always have
|
||
malicious code! For my future, I plan on releasing more toolkits
|
||
(i.e. polymorphic engine, construction kits, etc.). I also plan on joining a
|
||
virus group and creating more viruses.
|
||
|
||
Virus Toolkit History
|
||
---------------------
|
||
GENVIR - This was the first attempt at a virus toolkit. If was written in
|
||
1990 by a French virus writer. It was never released as a functional program.
|
||
|
||
Virus Construction Set (VCS) - VCS was written in 1991 by Verband Deutscher
|
||
Virenliebhaber, a German group. VCS is very primitive compared to modern
|
||
construction kits.
|
||
|
||
MuTation Engine (MtE) - MtE was written in 1991 in Bulgaria by Dark Avenger.
|
||
It is a polymorphic engine that allows a virus to exist in over 4 billion
|
||
variants.
|
||
|
||
Virus Construction Lab (VCL) - VCL was written in 1992 by Nowhere Man of NuKE.
|
||
It uses a graphical user interface to allow a user to create a virus.
|
||
|
||
Phalcon/Skism Mass Produced Code Generator (PS-MPC) - PS-MPC was written in
|
||
1992 by Dark Angel of Phalcon/Skism. It is based on VCL, however, it creates
|
||
more compact code than VCL.
|
||
|
||
Instant Virus Production Kit (IVP) - IVP was written be Admiral Bailey of YAM
|
||
(Youngsters Against McAfee). It is rumored to be a rewrite of PS-MPC with
|
||
some rudimentary changes.
|
||
|
||
TridenT Polymorphic Engine (TPE) - TPE was written in late 1992 by the TridenT
|
||
group. It is similar to MtE.
|
||
|
||
G2 (G squared) - G2 was written in 1993 by Dark Angel of Phalcon/Skism. It
|
||
is the most powerful construction kit to date. It allows the use of different
|
||
code packages to do different tasks.
|
||
|
||
Evil Avatar's Mass Destruction Library (MDL) - MDL was written in 1993 by Evil
|
||
Avatar. It is a library that allows easy destruction of data.
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
MDL Documentation -4- Evil Avatar 1993
|
||
|