..o( Vampirism )o.........................................[G9N-01.01].. : : : Brief Description: A New Concept/Technicque : : G9N issue Date: May 2000 : : Author: The Spy : :.....................................................................: What is: ~~~~~~~ This is a new design time technicque that may help u make ur virus smaller, smarter, larger, n a lot of things more. It bases in that in a system file, can b a lot of bytes that can help us, in a lot of ways. For example, if my virus ve da same some bytes that a system file ve, why i dont steal them?!? A Very Stupid Example: ~~~~~~~~~~~~~~~~~~~~~ Lets c a very stupid example, that shows only how to steal da bytes, from a file. Of courz it is shitty, but it explain how to implement vampirism. If we ve a file called kchalot.dll that contents this 11 bytes: B4 09 BA 03 01 CD 21 B4 4C CD 21 we can code that simple program: --[sv_3.asm]-----------------------8<---------------------------------- .model tiny .code org 100h main_begin: jmp skip fname db 'kchalot.dll',00h stopit db 13,10,'$' skip: mov ax,3D00h lea dx,fname int 21h jc sayno xchg ax,bx mov ah,3Fh mov cx,11 lea dx,sayyes int 21h jmp sayyes sayno: mov ah,9 lea dx,nofile int 21h mov ah,4Ch int 21h nofile db 'kchalot.dll is not in this directory','$' sayyes: end main_begin --[sv_3.asm]-----------------------8<---------------------------------- EB 10 90 6B 63 68 61 6C 6F 74 2E 74 78 74 00 0D 0A 24 B8 00 3D BA 03 01 CD 21 72 0B 93 B4 3F B9 11 00 BA 27 01 CD 21 B4 09 BA 32 01 CD 21 B4 4C CD 21 6B 63 68 61 6C 6F 74 2E 64 6C 6C 20 69 73 20 6E 6F 74 20 69 6E 20 74 68 69 73 20 64 69 72 65 63 74 6F 72 79 24 ^. '- Here i append. ----------------------------------------------------------------------- If kchalot.dll is in da current directory, it will steal 11 bytes from it, n then execute it. If kchalot.dll isnt in da current directory, it will prompt u da nofile error msg. Whats da deal? ~~~~~~~~~~~~~ Da deal is that u can build ur virus at runtime, stealin blocks of bytes from da system files. Always if u know which bytes to steal. How to: ~~~~~~ How to find this bytes? U can make a searching proggie, that looks for da same bytes ur virus ve in all of da system files. I ve designed one, that bases in generate a lot of blocks from da original one. Why? cuz may b, in da system file there r not da same bytes, but there r very similar bytes. WHAT? lets c an example: virus bytes: 12 34 56 78 9A BC DE F0 system file bytes: 13 35 57 79 9B BD DF F1 As u can c, da system file, ve very similar bytes than da virus, n i ve only to dec every byte to ve da correct sequence of bytes i need. Btw, u can find that: virus bytes: 12 34 56 78 9A BC DE F0 system file bytes: F0 DE BC 9A 78 56 34 12 In this case, u must turn da block, to ve da byte block u need. Well, in fact, i ve design my TSVT (The Spy's Vampirism Toolkit), to find da bytes in system files. It isnt finished yet, but it generate 512 diferent blocks. Design Time Work: ~~~~~~~~~~~~~~~~ In TSVT i ve implemented a simple idea, to generate a lot of blocks from da original one, da virus, that may help me to find more n better results. For example, i put da original block into an array: 34 21 02 12 55 89 96 07 ; Virus Original Block n then i generate a lot of similar blocks in a bidimensional array, [Block,Byte]: Block #][ Block Bytes 0][ 34 21 02 12 55 89 96 07 ; Original Block 1][ 35 22 03 13 56 8A 97 08 ; Original Block [+01h] 2][ 36 23 04 14 57 8B 98 09 ; Original Block [+02h] .][ . .][ . 255][ 33 20 01 11 54 88 95 06 ; Original Block [+FFh] 256][ 07 96 89 55 12 02 21 34 ; Original Block (I) 257][ 08 97 8A 56 13 03 22 35 ; Original Block (I) [+01h] 258][ 09 98 8B 57 14 04 23 36 ; Original Block (I) [+02h] .][ . .][ . 511][ 06 95 88 54 11 01 20 33 ; Original Block (I) [+FFh] (I) = Invert(Block); [+xxh] = [Block,Byte]:=[Block,Byte]+xxh; As u can c, i ve generated 511 diferent blocks, n we also ve da virus original block, so we ve, 512 diferent blocks to find into da system files. TSVT its only capable to generate this 512 diferent blocks, but i ve generated 1500 diferent blocks, but i vent coded them into TSVT. For da next version, i guess. Searchin: ~~~~~~~~ From da system files, i get a block of da same size of da virus, n i start to compare byte to byte with every block. So i only compute da consecutive bytes, but in future versions of TSVT it can find blocks like: virus block: 12 34 56 78 ... system file: 12 ?? 34 ?? 56 ?? 78 ... Its very simple, but i vent time to code it yet. I know, that da TSVTs searchin method isnt da best, but i was da faster one to code, so i ve decided implement it. Anyway it really found a lot of blocks. How to implement it: ~~~~~~~~~~~~~~~~~~~ TSVT informs u all that u need to find da block: -)Blocksize: 778 bytes -)File: C:\Windows\System\blablabla.ext -)[Block,Offset] Amount bytes - Block # of da File When TSVT report u a result u can use it. If TSVT tells u, [257,3] 7 bytes - Block 21 of da File Now u know that, in this current system file, in da offset blocksize*21+3, u ve 7 consecutive bytes, that matches exactly with da block 257 that TSVT ve generated, that is Original Block (I) [+01h]. For this version of TSVT: From block 1 to 256, u ve da blocks [+ # of block in hex] From block 257 to 512, u ve da same blocks in same order but Inverted In TSVT 0.3b u can also set da accuracy report. How to generate more blocks: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ If u r tryin to build ur own program that searches into da system files for da bytes blocks u need. U must generate a lot of diferent blocks, n here r a few simple ideas: 34 21 02 12 55 89 96 07 ; Original Block - u can add da offset of da byte into da block, to itself. N also combinatin with da other generated blocks. Bloke #][ Bytes dl Bloke .][ . .][ .0 .1 .2 .3 .4 .5 .6 .7 512][ 34 22 04 15 59 8E 9C 0E ; Original Block <+p> 513][ 35 23 05 16 5A 8F 9D 0F ; Original Block [+01h] <+p> 514][ 36 24 06 17 5B 90 9E 10 ; Original Block [+02h] <+p> .][ . .][ . 767][ 33 21 03 14 58 8D 9B 0D ; Original Block [+FFh] <+p> 768][ 07 97 8B 58 16 07 27 3B ; Original Block (I) <+p> 769][ 08 98 8C 59 17 08 28 3C ; Original Block (I) [+01h] <+p> 770][ 09 99 8D 5A 18 09 29 3D ; Original Block (I) [+02h] <+p> .][ . .][ . 1023][ 06 96 8A 57 15 06 26 3A ; Original Block (I) [+FFh] <+p> <+p> = [Block,Byte]:=[Block,Byte]+Byte; - n turn it again to gain new blocks! Bloke #][ Bytes dl Bloke .][ . .][ .0 .1 .2 .3 .4 .5 .6 .7 1024][ 0E 9C 8E 59 15 04 22 34 ; Original Block <+p> (I) 1025][ 0F 9D 8F 5A 16 05 23 35 ; Original Block [+01h] <+p> (I) 1026][ 10 9E 90 5B 17 06 24 36 ; Original Block [+02h] <+p> (I) .][ . .][ . 1235][ 0D 9B 8D 58 14 03 21 33 ; Original Block [+FFh] <+p> (I) 1236][ 3B 27 07 16 58 8B 97 07 ; Original Block (I) <+p> (I) 1237][ 3C 28 08 17 59 8C 98 08 ; Original Block (I) [+01h] <+p> (I) 1238][ 3D 29 09 18 5A 8D 99 09 ; Original Block (I) [+02h] <+p> (I) .][ . .][ . 1535][ 3A 26 06 15 57 8A 96 06 ; Original Block (I) [+FFh] <+p> (I) - well, use all that ur mind imagine. More Complex Algorithms: ~~~~~~~~~~~~~~~~~~~~~~~ All of this blocks, r very simple to implement in asm, add xxh to every byte, turn a block, etc But when u think to implement somethin more complex like an algorithm code it in asm, may b a very hard work. Anyway, there r a lot of kewl algorithms we can use, like Fibonacci's one, that isnt so dificult to code. The Spy, Gentlemen, Start ur Minds