101 lines
7.7 KiB
Plaintext
101 lines
7.7 KiB
Plaintext
Multipartite Infection
|
||
~~~~~~~~~~~~~~~~~~~~~~
|
||
|
||
OK, you've seen them floating around... these whiz-bang you-bewt mongrel
|
||
viruses which never seem to go away, even after you disinfect every file
|
||
in existence... Huh... How the fuck did that come back?! Well it's really
|
||
quite simple, and I'm sure not all of you out there are complete idiots.
|
||
The fact is that the virus isn't even in any files! ...It's hiding in
|
||
the partition table, or the boot sector!
|
||
|
||
There are only a few viruses out there with the capability for
|
||
multipartite infection, or "boot/file virus". Tequila, Anthrax and
|
||
Invader are a few examples. My own creation, D„eM†ˆn, is another, going
|
||
a step further than any other boot/file virus has ever gone before, by
|
||
infecting almost everything possible.
|
||
|
||
The principle is VERY simple, in fact I kicked myself when I worked out
|
||
a way to do it. The idea is simple, and it's the very same principle
|
||
employed in any other TSR method... to hook interrupt 21h (DOS). This is
|
||
fine. BUT the only hitch is that DOS automatically overwrites the old
|
||
vector when it loads! So there's no point hooking it as soon as your
|
||
code loads up off the disk. So what can we do?
|
||
|
||
We will obviously have to wait for DOS to change the interrupt, so we
|
||
can hook it. But there's one problem! Other stupid programmers were
|
||
being selfish and change the i21 pointer as a marker so that they can
|
||
tell if it's been changed... like Invader puts in a -1 in the IP value of
|
||
int 21h... so if something like DaeMaen is also on the sytem, it thinks
|
||
it's DOS changing the pointer, hooks it and crashes the entire system...
|
||
|
||
The way I waited for the pointer to change was to hook interrupt 13
|
||
TWICE! (huh?) Pretty simple. What I did was have my int-check routine
|
||
hooked onto i13 first, then my i13 handler over the top. The reason why
|
||
you can't have it the other way is that in case another "program" hooks
|
||
i13 over the top, and you can't disable your int-check routine... so
|
||
it'll keep re-hooking and fuck up the system. (You could do it with
|
||
flags, but I try and use as few flags as possible to keep code size down
|
||
to a minimum).
|
||
|
||
At boot-up, the program checks to see if it's already TSR (via an
|
||
illegal call to some interrupt, and checking the return code) and if it
|
||
isn't, it steals some memory (something F-Prot and friends can pick up,
|
||
but who gives a fuck, plus I can get around that now...<hehe>), hooks
|
||
int 13h with the int-check routine, hooks it again with our i13 handler,
|
||
then save the current interrupt 21h vector. On every disk call, it
|
||
compares the value of i21 with the saved value... if it's different, the
|
||
int-check routine hooks it and then change the vector that our int 13h
|
||
handler calls, so it no longer calls our int-check routine but goes
|
||
straight to the real i13.
|
||
|
||
That's the essentials of boot/file management. Anyhow, here's the code
|
||
to do what I just said, as it appears in the source code of D„eM†ˆn...
|
||
|
||
new13_2: ; the guts of multipartite infection
|
||
; check to see if i21 has changed... if so, hook it
|
||
call save ; save registers
|
||
push cs
|
||
pop es
|
||
xor ax, ax
|
||
mov ds, ax
|
||
mov si, 21h*4
|
||
mov di, offset oldvect+8
|
||
cld
|
||
cmpsw
|
||
je nochange
|
||
cmpsw
|
||
je nochange
|
||
call capture_21
|
||
push cs
|
||
pop ds
|
||
mov si, offset oldvect+0 ; copy over other ptr so
|
||
lea di, [si+4] ; that our i13 doesn't call
|
||
movsw ; here any more [i21 has
|
||
movsw ; been hooked]
|
||
nochange: call restore ; restore registers
|
||
jmp dword ptr cs:[oldvect+0]
|
||
|
||
|
||
This method can be used on either floppy boot sector infection or the HD
|
||
partition table infection.
|
||
|
||
As with many of my routines, stuff which took many other virus writers a
|
||
few pages of code took me one page... that's not bad! I have many other
|
||
goodies up my sleeve, like a 387-byte generic COM/EXE parasitic infector
|
||
on execution, the smallest of its kind in the WORLD... (with room for
|
||
improvement!).
|
||
|
||
Anyway, next InfoJournal will include the source codes to two of my
|
||
prerelease Mutation Engines, both of which are fully functional in their
|
||
own right. They have evolved far beyond my dreams, and I hope to have
|
||
the world's best mutation engine finished by the end of February/March.
|
||
(but it can't be the best at everything, but it sure generates a bucket
|
||
fuckload of arcane bullshit instructions. Heuristical nightmare...)
|
||
|
||
Anyway, have fun screwing around with this little piece of research
|
||
material...
|
||
|
||
T„L”N/NuKE
|
||
|
||
|