                             Playing With TBclean
                             By: Techno Phunk / Ti

   All these methods tested under the latest buld - current date: 1-19-99
  
[Introduction]

   Well, most of us know about TBclean, a program included with TBAV that
will clean up a generic, or otherwise Viruses that it can emulate. Well, most
emulation tricks that work on the scanner, unfortunatly, don't really work
here. And some that work on TBclean, don't work on TBscan. It's a strange
world isn't it :). Anyhow, this article will explain a few methods of really
screwing with TBclean, and thus, make your "unscanable" virus, also, uncleanable
by TB...well, for the time being anyhow.


[What We Do]

Basicly, we must understand a few things about TBclean. In this example I'll
use the example of an EXE or OVL infector (they're the same #@$@ thing folks).

Now, here is the bigest mistake.

After you infect, you think that yer just gonna jmp back to the host, and say:
well, gee....Life is good. And go on your jolly way. Sorry, dun exactly work
this way.

TBclean, from what I can see, is VERY dependent that you jmp back to the host
at some point...(assuming in this article that it must emulate).

Now, that's just to restore the host (and belive me, it's pretty good about
decrypting the host (whatever you do, will be used agianst you in the court
of TB).
        Anyhow, TBclean has a emulator that isn't exactly the best in the
world (what else from ThunderByte, sheesh). It can emulate all opcodes (that
I am currently aware of)...I may have to check on some of the undocumented
ones. Anyhow, it also has a list of certain interupts, and functions, and
their return values. However, from what I can see, it skips all the infection
routines, sorta, basicly just skims them.

TBclean's rules (that I have discovered so far) for knowing when to stop:

        * Is the loop "neverending" (does it go around several 10000 times.)

        * Any Input from devices such as keyboard?

        * Invalid op codes anywhere in the code?

        * End of File.

Now then, these are just some of the common ones, their are also many others.


So, a few things we can put our usage up there. Anyhow, what we must do, is
somehow "determin", wether or not TBclean is emulating us. We can do this in
a few ways, and basicly we just trick TB as it doesn't emulate correctly.

[Anti-Emulation - Method i]

O.k, this is pretty straight forward. I'll use urgo's routine for an example,
this time.

Xor Ax,Ax
Int 15h
Cmp Ah,86h
Jne FupTB

<restore>

[...]

FupTB:
<see later for explanation of kind of code to put here>

----Pretty descent.

Another thing we can do, is use the fact that TB ASSUMES that Int 20h is always
a "quit". And also, we can exploit the fact that it doesn't allow interupts
to be changed around.

        Mov Ax,3520h
        Int 21h
        Mov Al, 0cfh       ; op code of IRET
        Xchg Byte Ptr Cs:[Bx],Al; replace int 20h for a moment.

TbGoBye:
        Int 20h                 ; does nothing in this case.

LifeIsSweet:
        Xchg Byte Ptr Cs:[Bx],Al; it can be restored now.

<...>

Now, TBclean dies at the Int 20h :)....TB will have to reprogram to fix
this exploit of their program.

Another think you can do with above, is use it to make TB think a Call of
the keyboard input is being preformed. Just change the int 20h stuff to 16h..
and of course, you may need to put xor ax,ax before the code to change it all.
just be sure that int 16h = iret in the end.


------------
Another thing we can do, is implement some TB-f'ing code into our 'anti-debuging'
also. This simply causes an "aproaced stack crash" (in TB) but nothing in normal
mode.

Neg Sp
Neg Sp

The above example "program" will really tick of TBclean. First of all it will
die at the Neg Sp, and say "apporached stack crash".


[Nested loops - Method iii]

Another method, and VERY commonly exploited, will ALSO screw over TBSCAN.

Well, the CBers at one time had a loop that they used...and I told opic to
optomise just a bit, and he did in his Odesa (the Dec Cx optomisation, no
biggy)....anyhow, it was a resurection of the old "f-prot" loopy.

Well, I got news, it don't work on f-prot at all (from what I've seen)..but
it DOES on TB. Basicly, as the program progresses, it gets more smart to whats
a REAL "long" loop, and what is a garbage loop. So, we must get crafty. so,
make a loop that "does something" (not really though)...and make it nested
3 to 4 times...and you should be good.

Self-explanitory, you don't need an explanation.
--------------

O.k, now what we need to talk about is DON'T USE COMMON CODE! sheesh, we've
seen some codes repeated agian and agian...and guess what...they are flaged

for example:

Cmp Word Ptr [Bp+Header],'ZM'

is flaged....and most every virus that I have seen uses this!

Be creative...BillyBel suggested an Add of the two bytes, and a cmp.
you could do a sub also, just anything besides that...

Just be really creative in your viruses, and you'll be o.k....also note that
TBAV will flag any time/date activation try something original! like, how many
times a infected file is ran....or how many times a TXT file is activated.
Or you can do a simple:

In Al,40h  ; timer value
Or Al, Al  ; 0?
Jz Payload ; wasn't that simple

[...]

This basicly reads the current timer value (CMOS)...and checks if it's 0..this
is a 1/256 chance. IF it is 0, it'll activate your payload.

Finnaly, delete Anti-Vir.Dat, because it'll tatle on you, unless you have
full stealth that also intercepts TBAV. You also could register TBAV by overwriting
tbav.key with the registered key file. This is available in this mag in DL's
article on making scan strings for your virii. This makes them lose some money
and also makes them mad at you ;)

I hope this small 5-minute article helps you in making your virus both more original
and not detectable by TBAV.

                                                           Have fun,
                                                              -Techno Phunk-

