Cracking Encrypted Viruses by Nemesis


        As you've flipped through the pathetic list of articles you may
        noticed that I do alot of virus disassembly. I do it because I
        learn best by observing other's code, I always wonder how
        someone did a certain thing or why a virus is 4k in size. (4k
        viruses worry me, what the fuck are they doing in 4k?)

        Viruses with encryption are easy to disassemble if you have the
        original compiled virus that is yet to be encrypted. If you are
        unfortunate enough to get a copy of a virus that has been run,
        encrypted, and attached to another file then you're going to
        have to decrypt it before you can disassemble it.

        To decrypt the virus you will need to create a small empty file
        for the virus to append to such as this:

;--------------------------8<----------------------------------------------
; This is assuming it's a COM file, if not make an EXE
;
        .model tiny
        .code
         org 100h

start:
        int     20h

fillspace dw 256 dup (90h)

end start

;--------------------------------------------------------------------------

        Compiling this will give you a nice clean file for your virus to
        append to. Next load your virus into Turbo Debugger (or your
        debugger of choice) and trace through the code. It should go
        through the process of decrypting your virus into memory.
        Once decrypted the virus will jmp to the infect routine.

        When encrypting to infect your trap file, the virus will get an
        encryption value from the clock. In turbo debugger the routine
        should look something like this:

        mov ah,2Ch              ; Get System Time
        int 21h                 ; Clique
                                ; DX=time

        mov ds:[bp+028E],dx

        Before executing the last line of code go to the modify/evaluate
        function in TD and modify the value of DX, setting it to zero.
        Then finish running the program. With the value of the
        encryption routine set to zero your trap file will be infected
        with a clean, unecrypted copy of the virus and you can easily
        disassemble it.

        Cheers go out to Borland International for making such wonderful
        tools such as Turbo Pascal, Turbo Assembler, Grep, Make, Turbo
        Debugger, and more.