161 lines
7.3 KiB
Plaintext
161 lines
7.3 KiB
Plaintext
|
||
|
||
°± ±° ÜÜ tm
|
||
°± ±° ÛÛßßß Ûßßß Version
|
||
°±±° ÛÛ ÛÛ Ûßßß 0.5
|
||
°± ÛÛ ÛÛÜÜÜ ÛÜÜÜ
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
ûirogen's Irregular Code Engine
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
(c)1995 ûirogen [NuKE]
|
||
|
||
"A Virus Is Only As Great As It's Polymorphic Engine"
|
||
-ûirogen
|
||
|
||
|
||
|
||
****************************************************************************
|
||
DISCLAIMER: This polymorphic engine is actually part of a conspiracy
|
||
against you. Every living thing on this planet has made a mutual agreement
|
||
to conspire to make your life a living hell.
|
||
****************************************************************************
|
||
|
||
|
||
Introduction
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
Welcome to ûirogen's Irregular Code Engine v0.5. This is a new polymorphic
|
||
tool which can easily be included into any virus. It generates 100%
|
||
polymorphic decryptors which are extremly variable in both code and action.
|
||
You should find this engine quite effective.
|
||
With this version, I include the entire source code. One reason is because
|
||
I don't plan on updating this polymorphic engine any furthur. I'm sure
|
||
it can be improved, but those improvments will be done with a completly
|
||
new engine done from scratch; which I'll do eventually. This engine is
|
||
just done, I need to start from scratch again.
|
||
|
||
|
||
How to Use
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
Add the following line to your latest super-virus:
|
||
|
||
extrn _vice:near
|
||
|
||
Then call the routine from your code with the following parameters:
|
||
|
||
CS:SI = address of code to encrypt
|
||
CS:DI = address to put decryptor+encrypted code. (Be sure to reserve
|
||
an extra 850 bytes for the decryptor code if garbage is
|
||
turned on. If garbage is off then 50 bytes should suffice.)
|
||
CX = total code size (don't forget to add in the size of ViCE,
|
||
1995 bytes)
|
||
DX = offset where decryption routine will be run from.
|
||
(i.e. The offset where the decryptor will start on the infected
|
||
file)
|
||
AL = options byte, defined as follows:
|
||
76543210
|
||
³³³³³³³ÀÄ 0=CS: Segment Override In Decryptor, 1=No CS: Override
|
||
³³³³³³ÀÄÄ 0=Garbage Code Off, 1=Garbage Code On
|
||
³³³³³ÀÄÄÄ reserved
|
||
³³³³ÀÄÄÄÄ reserved
|
||
³³³ÀÄÄÄÄÄ reserved
|
||
³³ÀÄÄÄÄÄÄ reserved
|
||
³ÀÄÄÄÄÄÄÄ reserved
|
||
ÀÄÄÄÄÄÄÄÄ reserved
|
||
|
||
bit 0=This bit specifies whether or not to force use of the CS
|
||
segment in the decryptor. Typically, this bit should
|
||
be set to 0 when infecting a COM file, and 1 when
|
||
infecting an EXE.
|
||
bit 1=This bit turns garbage code on or off. Garbage code
|
||
greatly increses the size of the decyptor, but adds even
|
||
more variability to the code.
|
||
|
||
|
||
|
||
Returns:
|
||
CX = Total length (virus code+decryptor)
|
||
|
||
|
||
|
||
|
||
Specifications
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
ViCE
|
||
|
||
Current Version: 0.5 05-08-95
|
||
Procedure Name: _VICE
|
||
Code Size: 1995 bytes
|
||
Regs Destroyed: None. CX=Code Length
|
||
|
||
Decryptors Generated
|
||
|
||
Size: Approx. 13 - 850 bytes
|
||
Encryption Type: ADD,SUB, and XOR - combinations of any. Direct, load
|
||
into register and manipulate, or load key into register
|
||
and directly crypt.
|
||
Regs Destroyed: Everything except segment registers
|
||
Garbage Code: Random number of bytes between each functional operand.
|
||
Detection: None.
|
||
|
||
|
||
|
||
Obtaining The Latest Version / Contacting ûirogen
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
The latest version of this engine can be downloaded from the West Coast
|
||
Institute Of Virus Research. I can be reached via NuKENet.
|
||
|
||
|
||
|
||
History
|
||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||
v0.1á = 02-05-95: þStarted coding.
|
||
02-09-95: þFirst Beta Release. Getting too anxious to release
|
||
this mother fucker.
|
||
v0.2á = 02-11-95: þFixed bug which rarely caused lockups when the decryptor
|
||
size became too large for the loop construct. As a
|
||
result, decryptor sizes have been reduced.
|
||
þRandom Number seed wasn't being initialized correctly,
|
||
fixed. No biggie, but things were predictable everytime
|
||
it started with a seed of 0.
|
||
þAdded capability of garbage code between a couple of
|
||
operands it didn't before.
|
||
þImproved Anti-TBSCAN code significantly
|
||
þOptimized code; this version ended up being only 15
|
||
bytes larger.
|
||
þThis version is released under [NuKE].
|
||
v0.3á = 02-21-95: þRewrote garbage code engine. Now much more diverse.
|
||
þFixed bug which occasional resulted in only partially
|
||
encrypted viruses.
|
||
þFixed bug in that the new total code size returned in
|
||
CX was accidently being added to the run offset of the
|
||
decryptor. This caused the virus size to be larger than
|
||
it really was in some cases.
|
||
v0.4á = 02-24-95: þImproved engine power.
|
||
-Added new technique of encryption which is very
|
||
variable.
|
||
-Added new possible operand combinations in some
|
||
functions.
|
||
-Decryptors may now be larger, be sure to reserve up
|
||
to 250 bytes.
|
||
þThis will probably be the last version for a while, I'm
|
||
taking a break from coding for a bit. The next version
|
||
will be a big jump. Probably v1.0 provided nothing new
|
||
happens ; this will be the final of this engine.
|
||
v0.5 = 05-07-95: þWent through and commented the code, optimized some of
|
||
it.
|
||
þRemoved Anti-TBSCAN code (as version 6.34 circumvents
|
||
it) and replaced it with larger decryptors.
|
||
þRemoved possiblity of garbage code generated which made
|
||
a CMP or TEST to the same register. (i.e. TEST AX,AX).
|
||
þAll ADD and SUB operands which function on the AX
|
||
register now are written in the short form.
|
||
þNow sets up its own stack.
|
||
þNo longer tolerates ES or DS segments which aren't
|
||
equal to CS.
|
||
þRemoved option to turn off JMPS in garbage code.
|
||
þReleased complete source code.
|
||
þTHIS IS THE LAST VERSION OF THIS ENGINE [I think]. I
|
||
think I can do better with a newly designed engine.
|
||
|
||
ûirogen [NuKE]
|