..o( Vampirism )o.........................................[G9N-01.01]..
:                                                                     :
: Brief Description: A New Concept/Technicque                         :
: G9N issue Date: May 2000                                            :
: Author: The Spy                                                     :
:.....................................................................:

What is:
~~~~~~~

  This is a new design time technicque that may help u make ur virus
smaller, smarter, larger, n a lot of things more.
  It bases in that in a system file, can b a lot of bytes that can help
us, in a lot of ways. For example, if my virus ve da same some bytes
that a system file ve, why i dont steal them?!?

A Very Stupid Example:
~~~~~~~~~~~~~~~~~~~~~

  Lets c a very stupid example, that shows only how to steal da bytes,
from a file. Of courz it is shitty, but it explain how to implement
vampirism.
  If we ve a file called kchalot.dll that contents this 11 bytes:

  B4 09 BA 03 01 CD 21 B4 4C CD 21

  we can code that simple program:

--[sv_3.asm]-----------------------8<----------------------------------

.model tiny
.code
	org 100h

main_begin:
	jmp	skip

fname	db	'kchalot.dll',00h
stopit	db	13,10,'$'

skip:

	mov ax,3D00h
	lea dx,fname
	int 21h
	jc sayno

	xchg ax,bx
	mov ah,3Fh
	mov cx,11
	lea dx,sayyes
	int 21h
	jmp sayyes

sayno:
	mov ah,9
	lea dx,nofile
	int 21h
	mov ah,4Ch
	int 21h

nofile	db	'kchalot.dll is not in this directory','$'

sayyes:

end main_begin

--[sv_3.asm]-----------------------8<----------------------------------

EB 10 90 6B 63 68 61 6C 6F 74 2E 74 78 74 00 0D 
0A 24 B8 00 3D BA 03 01 CD 21 72 0B 93 B4 3F B9 
11 00 BA 27 01 CD 21 B4 09 BA 32 01 CD 21 B4 4C 
CD 21 6B 63 68 61 6C 6F 74 2E 64 6C 6C 20 69 73 
20 6E 6F 74 20 69 6E 20 74 68 69 73 20 64 69 72 
65 63 74 6F 72 79 24 
                     ^.
                       '- Here i append.

-----------------------------------------------------------------------

  If kchalot.dll is in da current directory, it will steal 11 bytes
from it, n then execute it.
  If kchalot.dll isnt in da current directory, it will prompt u da
nofile error msg.

Whats da deal?
~~~~~~~~~~~~~

  Da deal is that u can build ur virus at runtime, stealin blocks of
bytes from da system files. Always if u know which bytes to steal.

How to:
~~~~~~

  How to find this bytes? U can make a searching proggie, that looks
for da same bytes ur virus ve in all of da system files.
  I ve designed one, that bases in generate a lot of blocks from da
original one. Why? cuz may b, in da system file there r not da same
bytes, but there r very similar bytes. WHAT? lets c an example:

 virus bytes:

  12 34 56 78 9A BC DE F0

 system file bytes:

  13 35 57 79 9B BD DF F1

  As u can c, da system file, ve very similar bytes than da virus, n i
ve only to dec every byte to ve da correct sequence of bytes i need.
  Btw, u can find that:

 virus bytes:

  12 34 56 78 9A BC DE F0

 system file bytes:

  F0 DE BC 9A 78 56 34 12

  In this case, u must turn da block, to ve da byte block u need.
  Well, in fact, i ve design my TSVT (The Spy's Vampirism Toolkit), to
find da bytes in system files. It isnt finished yet, but it generate
512 diferent blocks.

Design Time Work:
~~~~~~~~~~~~~~~~

  In TSVT i ve implemented a simple idea, to generate a lot of blocks
from da original one, da virus, that may help me to find more n better
results.
  For example, i put da original block into an array:

  34 21 02 12 55 89 96 07 ; Virus Original Block

  n then i generate a lot of similar blocks in a bidimensional array,
[Block,Byte]:

Block #][ Block Bytes
      0][  34 21 02 12 55 89 96 07 ; Original Block
      1][  35 22 03 13 56 8A 97 08 ; Original Block [+01h]
      2][  36 23 04 14 57 8B 98 09 ; Original Block [+02h]
      .][  .
      .][  .
    255][  33 20 01 11 54 88 95 06 ; Original Block [+FFh]
    256][  07 96 89 55 12 02 21 34 ; Original Block (I)
    257][  08 97 8A 56 13 03 22 35 ; Original Block (I) [+01h]
    258][  09 98 8B 57 14 04 23 36 ; Original Block (I) [+02h]
      .][  .
      .][  .
    511][  06 95 88 54 11 01 20 33 ; Original Block (I) [+FFh]

  (I) = Invert(Block);
  [+xxh] = [Block,Byte]:=[Block,Byte]+xxh;

  As u can c, i ve generated 511 diferent blocks, n we also ve da virus
original block, so we ve, 512 diferent blocks to find into da system
files.
  TSVT its only capable to generate this 512 diferent blocks, but i ve
generated 1500 diferent blocks, but i vent coded them into TSVT. For da
next version, i guess.

Searchin:
~~~~~~~~

  From da system files, i get a block of da same size of da virus, n i
start to compare byte to byte with every block. So i only compute da
consecutive bytes, but in future versions of TSVT it can find blocks
like:

 virus block:

   12 34 56 78 ...

 system file:

   12 ?? 34 ?? 56 ?? 78 ...

  Its very simple, but i vent time to code it yet.
  I know, that da TSVTs searchin method isnt da best, but i was da
faster one to code, so i ve decided implement it. Anyway it really
found a lot of blocks.

How to implement it:
~~~~~~~~~~~~~~~~~~~


  TSVT informs u all that u need to find da block:

-)Blocksize: 778 bytes
-)File: C:\Windows\System\blablabla.ext
-)[Block,Offset] Amount bytes - Block # of da File

  When TSVT report u a result u can use it. If TSVT tells u, 

[257,3] 7 bytes - Block 21 of da File

  Now u know that, in this current system file, in da offset
blocksize*21+3, u ve 7 consecutive bytes, that matches exactly with da
block 257 that TSVT ve generated, that is Original Block (I) [+01h].

  For this version of TSVT:

  From block 1 to 256, u ve da blocks [+ # of block in hex]
  From block 257 to 512, u ve da same blocks in same order but Inverted

  In TSVT 0.3b u can also set da accuracy report.

How to generate more blocks:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

  If u r tryin to build ur own program that searches into da system
files for da bytes blocks u need. U must generate a lot of diferent
blocks, n here r a few simple ideas:

  34 21 02 12 55 89 96 07 ; Original Block

  - u can add da offset of da byte into da block, to itself. N also
combinatin with da other generated blocks.

Bloke #][ Bytes dl Bloke
      .][  .
      .][  .0 .1 .2 .3 .4 .5 .6 .7
    512][  34 22 04 15 59 8E 9C 0E ; Original Block <+p>
    513][  35 23 05 16 5A 8F 9D 0F ; Original Block [+01h] <+p>
    514][  36 24 06 17 5B 90 9E 10 ; Original Block [+02h] <+p>
      .][  .
      .][  .
    767][  33 21 03 14 58 8D 9B 0D ; Original Block [+FFh] <+p>
    768][  07 97 8B 58 16 07 27 3B ; Original Block (I) <+p>
    769][  08 98 8C 59 17 08 28 3C ; Original Block (I) [+01h] <+p>
    770][  09 99 8D 5A 18 09 29 3D ; Original Block (I) [+02h] <+p>
      .][  .
      .][  .
   1023][  06 96 8A 57 15 06 26 3A ; Original Block (I) [+FFh] <+p>

 <+p> = [Block,Byte]:=[Block,Byte]+Byte;

  - n turn it again to gain new blocks!

Bloke #][ Bytes dl Bloke
      .][  .
      .][  .0 .1 .2 .3 .4 .5 .6 .7
   1024][  0E 9C 8E 59 15 04 22 34 ; Original Block <+p> (I)
   1025][  0F 9D 8F 5A 16 05 23 35 ; Original Block [+01h] <+p> (I)
   1026][  10 9E 90 5B 17 06 24 36 ; Original Block [+02h] <+p> (I)
      .][  .
      .][  .
   1235][  0D 9B 8D 58 14 03 21 33 ; Original Block [+FFh] <+p> (I)
   1236][  3B 27 07 16 58 8B 97 07 ; Original Block (I) <+p> (I)
   1237][  3C 28 08 17 59 8C 98 08 ; Original Block (I) [+01h] <+p> (I)
   1238][  3D 29 09 18 5A 8D 99 09 ; Original Block (I) [+02h] <+p> (I)
      .][  .
      .][  .
   1535][  3A 26 06 15 57 8A 96 06 ; Original Block (I) [+FFh] <+p> (I)

  - well, use all that ur mind imagine.

More Complex Algorithms:
~~~~~~~~~~~~~~~~~~~~~~~

  All of this blocks, r very simple to implement in asm, add xxh to
every byte, turn a block, etc
  But when u think to implement somethin more complex like an algorithm
code it in asm, may b a very hard work.
  Anyway, there r a lot of kewl algorithms we can use, like Fibonacci's
one, that isnt so dificult to code.

 The Spy,
 Gentlemen, Start ur Minds
