No Delta In EXE infections. Period
                               By: Techno Phunk
 

[Forward]

        I'd like to thank a friend of mine (who wishes to stay anonymous) for
telling me about this idea, and trick. It was a night of boredom, and he
gave me something to do! Anyhow, this article will tell you how to TOTALY
avoid the Delta offset in an EXE infector. Unlike Doxter L's method, this
method TOTALY eliminates the need for a delta offset, and, supprisingly, in
just a few code changes. This tutorial is 80% theory...to see it in full
action, look at my Sister.902 virus

[What you Need To Know]

        * Extreemly well, the theory/basis around normal EXE infection
        * How EXE's work.
        * How to keep sanity

[Things You Need]

        * Anything to calm your nerves so you don't wind up spiting on
          the screen ...  Eugh....
        * assembler
        * Brain [recomended]
        * A working knowledge of EXE's. (once agian -very much recomended)

O.k, all set? alright, hang on, and enjoy the ride!


[Intro to Theory]

 O.k, we are ALL familiar with the Delta offset routine:

                Call Delta
        Delta:
                Pop Bp
                Sub Bp, offset Delta

I hope that you understand this routine, and don't need it explained :P.

Now, in a file infector, this is, actualy, an EXTREEMLY common method. However,
in an EXE, you don't need this, not a single bit. It can easily be avoided due
to the structure/function of EXE's. Note that OVL's are the same as EXE's (if
they are true OVL's that is).

So, how to do it? Well, lets talk. First of all, we need to make sure to
pad the file (anyway you like) to the NEAREST 16 bytes. This allows our virus
to start out at a NEW paragraph. This also, allows us to elimate the delta
routine completly. For Example:

File1.exe      Size: 5000
                        Paded: 5008

Now, basicly, we are getting the size in paragraphs, perfectly even. This needs
to be done, so that we get the virus to start at a new paragraph.

Now, second step. We must find the new CS value. Note that the IP routine
doesn't change at all...but CS DOES!....

 Now then, our next step will be to figure out the new size, very
easily done. Just ADD. You then store this as the file size, and not let
the rest of the virus know that the host has already been played with. This
way, we can just infect as usual. But, first, we must find the value of CS,
which, we will have to store in the header at this time.
 Now, first we take the value at 8h in the Header, and divide it by 16. This
gives us size in paragraphs (agian) of header. Now, in our example of 5000,
lets say the header was 34 bytes, thus, 34/16 = 3. So, 313-3 = 310. This
is our CS value, and we will store it in the header, at offset 16h. Now, 
we are free from that EVIL +bp and delta offset routine.

[Now For the Code]

We can Acomplish this all by using a very simple routine. This routine does
a similar thing to my sisters virus, however, this routine is less optomised
than the one I used in sisters.


        Mov Al,02h                              ; goto eof
        Call Fptr                               ; this calls my File_Pointer routine
        Push Ax                                 
Let_Us_Pad:
        Mov Cx,Ax                               ; so we start at a new paragraph,
        Neg Cx              
        And Cx,0Fh                              ; Is this file perfect for us?
        Jz NoPadding                            ; ya, so we dun need any padding.
        Push Dx
        Mov Ah,40h                              ; no, we need to write some stuff 
        Lea Dx,[Heap]                           ; garbage.
        Int 21h                                 ; write it to end of host.
        Pop Dx                                  ; just as a precausion, I did this at last minute
        Jnc NoPadding                           ; if we had any problems, screw it.
        Db 0eah                                 ; A small-patch (to avoid nasty JUMPS)
        Dw Offset Close                         ; I needed this in my virus...JMP FAR


And...NoPadding...looks like this:

NoPadding:
        Pop Ax                                  
        Add Ax,Cx                               ; add new file size.
        Push Ax
        Push Dx

 [ Calculate IP now, and store ]


[Closing]

Lastly, I'd like to mention, that, when using this method, you should realy
have a good imagination, as, while your at it, you can do some FUN things
to the host file itself. Make the AV's work for their money, they should, after all
we all do...


                                                     - Techno Phunk -