Playing With TBclean By: Techno Phunk / Ti All these methods tested under the latest buld - current date: 1-19-99 [Introduction] Well, most of us know about TBclean, a program included with TBAV that will clean up a generic, or otherwise Viruses that it can emulate. Well, most emulation tricks that work on the scanner, unfortunatly, don't really work here. And some that work on TBclean, don't work on TBscan. It's a strange world isn't it :). Anyhow, this article will explain a few methods of really screwing with TBclean, and thus, make your "unscanable" virus, also, uncleanable by TB...well, for the time being anyhow. [What We Do] Basicly, we must understand a few things about TBclean. In this example I'll use the example of an EXE or OVL infector (they're the same #@$@ thing folks). Now, here is the bigest mistake. After you infect, you think that yer just gonna jmp back to the host, and say: well, gee....Life is good. And go on your jolly way. Sorry, dun exactly work this way. TBclean, from what I can see, is VERY dependent that you jmp back to the host at some point...(assuming in this article that it must emulate). Now, that's just to restore the host (and belive me, it's pretty good about decrypting the host (whatever you do, will be used agianst you in the court of TB). Anyhow, TBclean has a emulator that isn't exactly the best in the world (what else from ThunderByte, sheesh). It can emulate all opcodes (that I am currently aware of)...I may have to check on some of the undocumented ones. Anyhow, it also has a list of certain interupts, and functions, and their return values. However, from what I can see, it skips all the infection routines, sorta, basicly just skims them. TBclean's rules (that I have discovered so far) for knowing when to stop: * Is the loop "neverending" (does it go around several 10000 times.) * Any Input from devices such as keyboard? * Invalid op codes anywhere in the code? * End of File. Now then, these are just some of the common ones, their are also many others. So, a few things we can put our usage up there. Anyhow, what we must do, is somehow "determin", wether or not TBclean is emulating us. We can do this in a few ways, and basicly we just trick TB as it doesn't emulate correctly. [Anti-Emulation - Method i] O.k, this is pretty straight forward. I'll use urgo's routine for an example, this time. Xor Ax,Ax Int 15h Cmp Ah,86h Jne FupTB [...] FupTB: ----Pretty descent. Another thing we can do, is use the fact that TB ASSUMES that Int 20h is always a "quit". And also, we can exploit the fact that it doesn't allow interupts to be changed around. Mov Ax,3520h Int 21h Mov Al, 0cfh ; op code of IRET Xchg Byte Ptr Cs:[Bx],Al; replace int 20h for a moment. TbGoBye: Int 20h ; does nothing in this case. LifeIsSweet: Xchg Byte Ptr Cs:[Bx],Al; it can be restored now. <...> Now, TBclean dies at the Int 20h :)....TB will have to reprogram to fix this exploit of their program. Another think you can do with above, is use it to make TB think a Call of the keyboard input is being preformed. Just change the int 20h stuff to 16h.. and of course, you may need to put xor ax,ax before the code to change it all. just be sure that int 16h = iret in the end. ------------ Another thing we can do, is implement some TB-f'ing code into our 'anti-debuging' also. This simply causes an "aproaced stack crash" (in TB) but nothing in normal mode. Neg Sp Neg Sp The above example "program" will really tick of TBclean. First of all it will die at the Neg Sp, and say "apporached stack crash". [Nested loops - Method iii] Another method, and VERY commonly exploited, will ALSO screw over TBSCAN. Well, the CBers at one time had a loop that they used...and I told opic to optomise just a bit, and he did in his Odesa (the Dec Cx optomisation, no biggy)....anyhow, it was a resurection of the old "f-prot" loopy. Well, I got news, it don't work on f-prot at all (from what I've seen)..but it DOES on TB. Basicly, as the program progresses, it gets more smart to whats a REAL "long" loop, and what is a garbage loop. So, we must get crafty. so, make a loop that "does something" (not really though)...and make it nested 3 to 4 times...and you should be good. Self-explanitory, you don't need an explanation. -------------- O.k, now what we need to talk about is DON'T USE COMMON CODE! sheesh, we've seen some codes repeated agian and agian...and guess what...they are flaged for example: Cmp Word Ptr [Bp+Header],'ZM' is flaged....and most every virus that I have seen uses this! Be creative...BillyBel suggested an Add of the two bytes, and a cmp. you could do a sub also, just anything besides that... Just be really creative in your viruses, and you'll be o.k....also note that TBAV will flag any time/date activation try something original! like, how many times a infected file is ran....or how many times a TXT file is activated. Or you can do a simple: In Al,40h ; timer value Or Al, Al ; 0? Jz Payload ; wasn't that simple [...] This basicly reads the current timer value (CMOS)...and checks if it's 0..this is a 1/256 chance. IF it is 0, it'll activate your payload. Finnaly, delete Anti-Vir.Dat, because it'll tatle on you, unless you have full stealth that also intercepts TBAV. You also could register TBAV by overwriting tbav.key with the registered key file. This is available in this mag in DL's article on making scan strings for your virii. This makes them lose some money and also makes them mad at you ;) I hope this small 5-minute article helps you in making your virus both more original and not detectable by TBAV. Have fun, -Techno Phunk-