______________________________________________________________
| |
| Save your fingers - get your fake names from the i-net |#
| »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» |#
| |#
| by DiA/rrlf (c)2005 |#
| www.vx-dia.de.vu :: DiA_hates_machine@gmx.de |#
|______________________________________________________________|#
###############################################################
_Overview___________________________________
| |
| 1_Intro |#
| 2_How to do? |#
| 3_Gimme a code, please! |#
| 4_Outro |#
|____________________________________________|#
#############################################
.Disclaimer
»»»»»»»»»»
The author of this article is NOT responsible for possible damages in case
of informations you getting here. You do your own things with your own risk,
please don't do anything stupid for your own security. This document is for
educational purpose only. If you do NOT agree this, please close this for
your own pleasure!
.1_Intro
»»»»»»»
Maybe you know this situation, you write a pretty good massmailer, i-net or
P2P worm and you need some ideas for the fake names. You are sick seeing names
like "Damn_Fine_Porn.mpg .exe" or "Photoshop Crack working!.exe". So
what to do? Get some inspiration from the internet, go to some warez/crackz
sites and copy and paste some real crack names including application name,
exact version number and maybe the author of the crack. Looking a bit realer
then "Micr0soft all products keygen.exe", huh?!
You wanna do some good stuff, including many names... you are now copy and
paste your name number 34, stupid work, no? At this point I ask you, why do
you copy and paste a already existing huge database of names? Just write a
simple but effective code and get thousends of names at runtime :). So read on
and see how easy it is...
.2_How to do?
»»»»»»»»»»»»
OK, what we need for this tutorial is a internet connection. Without it will
not work of course. Now save this file - http://crack.ms/cracks/a_1.shtml -
local as - fakenames.txt -. Take a look, at the head of this file you see some
uninteressting stuff, like popup scripts, meta tags and links. But if you go to
the end of this file you see a huge list of the crack names. Thats what we want.
Let's pick out one link including the name that we want to extract:
<a href="crack.ms?id=19003" target=_blank>ABCalculator 1.1.0 by DBC</a>
And one more:
<a href="crack.ms?id=1882535" target=_blank>Aare CD Ripper v3.2 by HTBTeam</a>
Fine, now when you have a look you will fast see that every name is between
(dword - 4 bytes) "ank>" and "</a>". So we have to find "ank>" and we have the
start of the name. Byte by byte we search for the end "</a>" and so we have
the length of the name. We know the start of the name and the length, sweet,
we can extract it ;). With this method we can do so name by name, until we are
at the end of the file.
Remember that this is only a example, there are more then 1.000.000 crackz/
warez/serialz sites on the internet, you only have to know how the structure
of the HTML files they use is.
Let's do a little to-do list for our example application:
1. Make a random valid URL (eg w_2.shtml)
2. Download this file
3. Open the file
4. Get the file size
5. If it's not big enough goto 1.
6. Free enough memory
7. Read whole content in memory
8. Close File
9. Find start of next fake name "ank>"
10. Find end of next fake name "</a>"
11. Extract fake name
12. What you wanna do with this name (in example log in a .htm file)
13. If end of file goto 15.
14. Jump to 9.
15. Exit
If it sounds hard to do for you, then the only reason for this is my shitty
english ;D. Just take a look at the small code, and you will see that it is
pretty easy to do.
.3_Gimme a code, please!
»»»»»»»»»»»»»»»»»»»»»»»
;-----ExtractNames.asm-----cut-----start---------------------------------------------
include "%fasminc%\win32ax.inc" ;equates
ExtractNames:
call MakeURL ;make a random url (a-z,1-9)
invoke URLDownloadToFile,\ ;download it baby
0,\ ;no activeX required
FakeNamesURL,\ ;download this file
FakeNamesFile,\ ;save local to this file
0,\ ;reserved
0 ;no interface
cmp eax, 0 ;error if it is not null
jne ExtractNames ;then make new URL and download again
WaitForDownload:
invoke CreateFile,\ ;open downloaded file
FakeNamesFile,\ ;open this file (in current folder)
GENERIC_READ,\ ;only need read access
FILE_SHARE_READ,\ ;---""---
0,\ ;dont need security attributes
OPEN_EXISTING,\ ;we want to open the file
FILE_ATTRIBUTE_NORMAL,\ ;normal attributes
0 ;no template file
cmp eax, INVALID_HANDLE_VALUE ;if error then the download is not finished
je WaitForDownload ;try to open again
mov dword [FileHandle], eax ;save file handle
invoke GetFileSize,\ ;get file size of downloaded file
dword [FileHandle],\ ;via file handle
0 ;just get low size
mov dword [FileSize], eax ;save file size
cmp eax, 7000d ;if its <7000 bytes, then its the error page from crack.ms
ja GetMemory ;if not go to get memory
invoke CloseHandle,\ ;close handle
dword [FileHandle] ;to delete it
invoke DeleteFile,\ ;delete invalid fake names file
FakeNamesFile ;delete this
jmp ExtractNames ;repeat all
GetMemory:
invoke GlobalAlloc,\ ;get enough memory
GMEM_MOVEABLE,\ ;allocation attribute, moveable
dword [FileSize] ;that mich memory we need
mov dword [MemHandle], eax ;save handle
invoke GlobalLock,\ ;get memory start
dword [MemHandle] ;via handle
mov dword [MemStart], eax ;save start
invoke ReadFile,\ ;read whole content from file
dword [FileHandle],\ ;open file, handle
dword [MemStart],\ ;buffer start
dword [FileSize],\ ;read that much
BytesRW,\ ;bytes read
0 ;no overlapped structure
invoke CloseHandle,\ ;we can close the file
dword [FileHandle] ;via handle
;***only for this example***
invoke CreateFile,\ ;make the output file
OutputFile,\ ;file name
GENERIC_WRITE,\ ;with write access
FILE_SHARE_WRITE,\ ;---""---
0,\ ;no security
CREATE_ALWAYS,\ ;create it
FILE_ATTRIBUTE_NORMAL,\ ;normal attributes
0 ;no temp file
mov dword [FileHandle], eax ;save handle
;***only for this example***
mov ebx, dword [MemStart] ;get memory start in ebx
add ebx, 3667d ;go over the file header (scripts, meta, links...)
;(keep in mind that this is the structure
; of files on crack.ms, if you use another site
; the structure is different!)
push ebx ;save to stack
FindMoreNames:
pop ebx ;get file position from stack
xor ecx, ecx ;set name length counter to null
GetStartOfName:
cmp dword [ebx], "</bo" ;end of html file (you know </body></html>)
je FindNamesEnd ;then goto end
cmp dword [ebx], "ank>" ;start of fake name?
je GetEndOfName ;if so then get end of name
inc ebx ;search next byte
jmp GetStartOfName ;go get it dude
GetEndOfName:
cmp dword [ebx], "</a>" ;end of fake name?
je ExtractName ;if so then extract the name
inc ecx ;to get fake name length
inc ebx ;next place
jmp GetEndOfName ;search it
ExtractName:
push ebx ;save current position in file
sub ebx, ecx ;go to the start of string
add ebx, 4d ;go after "ank>"
sub ecx, 4d ;delete that "</a>"
push ecx ;save length of name
mov esi, ebx ;source
mov edi, FakeName ;destination
rep movsb ;copy the whole name to FakeName
mov dword [edi], 0 ;clear all after
;****************************************
;****************************************
; at this point you can do whatever you want
; with the fake file name! pointer to fake name
; is "FakeName"...
;****************************************
;****************************************
;***only for this example***
pop ecx ;get length of name
invoke WriteFile,\ ;write the fake name to file
dword [FileHandle],\ ;via handle
FakeName,\ ;write this
ecx,\ ;length of fake name
BytesRW,\ ;bytes written
0 ;overlapped, fuck off
invoke WriteFile,\ ;write <br> to the file
dword [FileHandle],\ ;via handle
Break,\ ;write <br>
4,\ ;length
BytesRW,\ ;bytes written
0 ;overlapped, fuck off
;***only for this example***
jmp FindMoreNames ;go get next name
FindNamesEnd:
;***only for this example***
invoke CloseHandle,\ ;close output file
dword [FileHandle] ;via handle
;***only for this example***
invoke GlobalUnlock,\ ;unlock memory
dword [MemHandle] ;handle
invoke GlobalFree,\ ;free it!
dword [MemHandle] ;via handle
invoke DeleteFile,\ ;delete downloaded file
FakeNamesFile ;this
invoke MessageBox,\ ;show a msgbox that it's done
0,\
"fake names extracting done",\
FakeNamesURL,\
0
invoke ExitProcess,\
0 ;end my friend
MakeURL: ;procedure
invoke GetTickCount ;we only want random stuff in al
CharMakeValid:
cmp al, 97d ;if its under "a"
jb CharAdd ;then add some stuff
cmp al, 122d ;if its above "z"
ja CharSub ;then sub some stuff
jmp CharIsValid ;kewl, now its valid
CharAdd:
add al, 18d ;add 18 and see if its now valid
jmp CharMakeValid ;check it
CharSub:
sub al, 18d ;sub 18
jmp CharMakeValid ;now a valid character?
CharIsValid:
mov edi, FakeNamesURL ;pointer to url
add edi, 23d ;go to the end of the string
stosb ;save char at end (eg http://crack.ms/cracks/m)
invoke GetTickCount ;get al again
DigitMakeValid:
cmp al, 49d ;if its under "1"
jb DigitAdd ;the add somethin
cmp al, 57d ;if its above "9"
ja DigitSub ;then subtract it
jmp DigitIsValid ;make whole name
DigitAdd:
add al, 3d ;add 3
jmp DigitMakeValid ;check if its now valid
DigitSub:
sub al, 3d ;sub 3
jmp DigitMakeValid ;chek if it is valid now
DigitIsValid:
mov byte [edi], "_" ;eg http://crack.ms/cracks/m_
inc edi ;go behind the "_"
stosb ;save digit (eg http://crack.ms/cracks/m_2)
mov dword [edi], ".sht" ; http://crack.ms/cracks/m_2.sht
mov dword [edi + 4], "ml" ; http://crack.ms/cracks/m_2.shtml
ret ;return to call
Datas:
FakeNamesURL db "http://crack.ms/cracks/",0 ;site to download file from
rb 10d ;space for file name (random)
FakeNamesFile db "fake.names",0 ;filename to save
FileHandle dd ? ;file handle to save
FileSize dd ? ;file size to get enough memory
MemHandle dd ? ;handle for allocate memory
MemStart dd ? ;start of memory
BytesRW dd ? ;number of bytes read/write
OutputFile db "FakeNames.htm",0 ;save here the names
FakeName rb 100d ;save here the fake name
Break db "<br>",0 ;just to make a break
Imports:
data import ;import all needed api's
library kernel32, "KERNEL32.DLL",\
user32, "USER32.DLL",\
urlmon, "URLMON.DLL"
import kernel32,\
CreateFile, "CreateFileA",\
GlobalAlloc, "GlobalAlloc",\
GlobalLock, "GlobalLock",\
ReadFile, "ReadFile",\
GetFileSize, "GetFileSize",\
CloseHandle, "CloseHandle",\
GlobalUnlock, "GlobalUnlock",\
GlobalFree, "GlobalFree",\
WriteFile, "WriteFile",\
DeleteFile, "DeleteFileA",\
GetTickCount, "GetTickCount",\
ExitProcess, "ExitProcess"
import user32,\
MessageBox, "MessageBoxA"
import urlmon,\
URLDownloadToFile, "URLDownloadToFileA"
end data
;-----ExtractNames.asm-----cut-----end-----------------------------------------------
.4_Outro
»»»»»»»
Funny, no? That small code and that much names ;). But keep in mind that
this is only a basic example. For advanced usage you need, for example, to
check if there is an internet connection or not. Also you don't need to
extract only fake names for your worms. What's about subject's or body's?
Maybe a report from a AV site about a new dangerous worm in the wild, and
you send the cleaning program?! Or what about newsgroups and there post's.
It's now in your hand to find usefull sites for your fake names, fake
subjects and fake bodys. Be creative ;), have a nice day and happy coding!
DiA/rrlf :: 08.02.2005