Introduction to Viral Programming

> Chapter 1

> 1.1 Introduction
> 1.2 Choosing a Language
> 1.3 Types of Viruses
> 1.4 Problems With Windows

Introduction
Welcome to Mephistopheles' guide to viral programming. The reason I'm writing this guide for all of you is basically that I'm tired of the lack of documentation on writing viruses... and the documentation that is out there is so hideously written that either it is incorrect or cannot be read because there is a spelling mistake every other word. I plan to cover every aspect of viral programming in this guide but I'm bound to miss a few.

This guide assumes that you have a decent knowledge of 80x86 Assembly Language. All of the examples were written by me and can easily be assembled with Turbo Assembler, as I tend to use Ideal mode often. It's also a good idea to have a debugger (such as Turbo Debugger) handy, a memory mapper if you're writing a memory resident virus (such as MapMem), or a disk editor (such as Disk Editor) if you're writing a boot-infector, as these utilities will greatly assist you in all of the inevitable problems you'll have.

Another note that I think I should alert people to (although it should not have to be necessary), is that you can not get infected by a virus unless you run the virus (or an infected program). That means that you won't infect your system by viewing a picture on the web, by reading a mail, or even by download the virus. Only when you go out of your way to run an infected program or the virus itself will you get it. Also note, viruses can not do any physical damage to the computer hardware, all that they will damage is data... if they choose to (keep in mind that not all viruses cause damage, some just display a nice message once a year).

Choosing a Language
A virus can generally be written in any language that provides direct access to the CPU in which you're writing it for, in this case, the CPU is Intel's 80x86 line of processors. Assembly Language is not only the preferred language to write a virus in, but is undoubtedly the best language to write one in. C and Pascal have been known to spit out a few viruses here and there, but it is best that you stay away from these high level languages, as they provide a lot of unnecessary overhead code which is very bulky, slow, and not needed. Let's look over the pro's and con's of these three languages:

Language | Pro's | Con's
Pascal | none | Bulky overhead code Slower than Assembly
C | none | Bulky overhead code Difficult access to CPU's registers Slower than Assembly
Assembly | Small, compact code Fast, efficient Not as easily detected Easy to modify memory, and access interrupts. | Takes a while to learn (as does any language)

Perhaps I'm being a little bias, but I think that Assembly clearly has all of the advantages. Therefor, this guide will only cover viruses in this language, as I don't feel it's necessary to cover any other languages. If I receive requests to cover other languages (such as the above mentioned), I'll write a guide to cover other languages.

Types of Viruses
Viruses are usually simple little programs that range in size from approximately 130 to 2,500 bytes. Anything smaller is probably an overwriting virus (sometimes not even considered a virus, but rather a Trojan), and anything larger is probably just not necessary. Viruses can be categorized by several specific virus characteristics:

- What the virus infects
  - .COM Programs
    The .com infecting viruses, infect .com files by simply attaching itself to the end of the program to infect, and creating a jump in the beginning of the host program to jump to the virus located after it. It will then restore the original beginning of the host program and return control to it. So the user won't even notice a difference. It is the easiest type of program to infect, and requires the least code.

  - .EXE Programs
    The .exe infecting viruses, are more complicated than a .com infector, but it's definitely a better type of infector to have. Most of the .exe infectors do not support new-format .exe file headers (for programs for Windows, etc...), and consequently may render the .exe useless. A .exe infecting virus requires more code, is more difficult, and more complex... so you should only start writing these when you have already grasped the basics of .com infection.

  - .SYS Programs
    There are very few viruses that infect .sys programs, partly because there is little documentation on it, and partly because there's not much need to do so. It's not really a good idea to have a virus that infects strictly .sys programs, as it will not spread to other computers easily, or on the computer itself really. This should only be used when you want to write a virus that will infect absolutely everything infectable out there.

  - Boot Sectors
    Boot sector infectors infect the boot record (also called the Boot Sector) of a disk drive, or the hard drive. They are the most difficult type of infector to write, and especially to debug, but are well worth the fun you can have with them. Because you are infecting the boot record, your virus will always be the first thing that the computer runs when it boots, giving you special privileges, like being able to deny the user of booting their computer, and the ease of allocating memory (because you know nothing else is in memory).

  - Other
    The viruses that are in this category, do not infect programs, but rather source code files like ".PAS" or ".C" files. These are very rare, and very interesting.

- How the virus hides itself
  - Stealth
    Stealth viruses hide themselves from the user by employing special techniques such as polymorphism, encryption, on-the-fly disinfection, etc... They require a fair amount of additional code, and depending on which stealth technique you choose to have in you virus, it can make you virus rather complex.

  - Tight Code
    These viruses rely on their small size to hide itself from the user. They are usually restricted a little due to them having to be so small, so they often can't afford such luxuries as some stealth techniques.

  - Other
    These viruses are those that are not tightly coded, don't employ any stealth techniques, or just make it too easy for the user to see that the system is infected. Viruses that belong in this category are those that are overwriting, display a message or play a sound with every infection, etc...

- How the virus finds programs to infect
  - Runtime
    Runtime viruses will search through a directory (or sometimes several directories), when the infected program is ran looking for a file to infect. After it finds one, it will infect it and search for another file to infect. These will usually only infect a fixed number of programs in a single run, as not to infect the entire system to quickly. Runtime viruses are generally slower than memory resident ones, because they need to search for a file to infect.

  - Memory Resident
    Memory resident (or TSR, for Terminate and Stay Resident) viruses are usually smaller than runtime viruses, due to the fact that they don't need to search for a program to infect. They work by allocating memory for itself, storing itself there, and intercepting an interrupt. Whenever that interrupt is called by another program, it will actually call your virus. The best interrupt to intercept is interrupt 21h, and function 4Bh (execute program). This way you can infect any program that is ran.

When choosing how you want to infect the system, and what type of programs you want to infect, keep in mind that it will determine how fast the system is infected. For example, if you make you virus infect all .exe programs that are ran (memory resident, .exe infector), then the system will probably be infected at a moderate rate. Or if you have a directory-traversal runtime virus that infects all .com and .exe files it comes across, then the system will become entirely infected at blazing speed. The reason I bring this up, is because it might be less noticeable (or more fun) if you infect the user's system slowly, or you might want to infect the system fast, and not give it a chance. Also remember that survival is the key to your virus. If you infect the system too fast, and alert the user, or if you do it too slowly, and let the virus become extinct, then your virus has died.

Problems With Windows
The Windows Operating System creates a major problem when creating a memory resident virus due to the way that it takes control over memory. It will not allow you to keep your code in memory after it terminates. There are a few ways around this dilemma, but the two most obvious (and easiest) solutions are to either write a runtime virus instead of a memory resident one, or to write a boot infector, so it will load into memory before Windows. I know that there are other solutions, but since any modern version of Windows runs in protected mode, and I only program in real mode, I can't do much until I learn some about protected mode.

Contents