HPAVC/HPAVC CD-ROM.iso/pc/CODBRK1.ZIP/Codbrk1/Codbrk11.txt

Text File | 1997-10-21 | 5.9 KB | 85 lines

                             Windows Grab-Bag
                                    By
                                Horny Toad


    For the longest time, I abated on how and what to write on the subject of windows
infection.  There is no question that windows needs to be discussed in greater detail than has been
in the past couple years.  Therefore, I have decided to conglomerate many issues that are on my
mind about windows and present them to you.  For the first issue, I will keep the concepts on the
easy side. (If windows does have an easy side!)  If you are a beginner to the virus field, maybe
you should read this article at a later time.  Learn basic assembly first, then work on 32-bit
programming.  Actually, beginners should read this article too so that they can put in perspective
what is out there and what lies ahead.

Windows 95, 98, 99...

    Ok, do you want the good news or the bad news first?  Yes, there is both good and bad
news about the future operating systems that Microsoft is providing us to infect.  I have had a
chance to mess around with Windows 98 beta.  The good news:  For all of you that adapted to the
new techniques of 32-bit programming, whether it be assembly, C++, VBA,... not much has
changed in the integration of the new OS.  The bad news:  Firstly, it will be that much harder to
create a unique W98 virus.  A close evaluation of changes in memory allocation and new
applications will be necessary to find exploitable vulnerabilities in the system.  Secondly, for all
of those pure DOS-based virus writers, you're going to have to advance with the times and learn
windows programming.  Yes, there will still be a need for traditional DOS virii, but to fully
exploit the new file formats and system design, you are going to need to go back school and
research.  Unfortunately, there isn't much out there concerning PE and windows infections.  Calm
down...I know that there are "some" articles out there on PE infection and techniques of using
the 32-bit API, but there really isn't much in relation to the vast encyclopedias that exist
describing DOS virii writing.  And even some of the information out there isn't very reliable.  I
have had the opportunity to view confidential reports from the AV community on their opinions
of the "progress" of virus writers in adapting to the new OS.  Frankly, they are laughing at us.
Many of the virii out there that infect PE's no longer work due to compatibility problems with
new software updates.
    What am I hinting at?  I would like to challenge virus writers to begin researching W95
apps and start submitting articles on your progress.  Only then, once we have educated the masses
in the changes in infecting 32-bit systems, will the virus community begin to have the strength
that we once had several years ago.

Concepts to Consider:

1. FAT 32 - The File Allocation Tool in Windows 98 is called FAT32, upgraded from the 16-
bit FAT.  Many of you might have already upgraded to FAT32 with the W95 updates,
otherwise, there is a conversion utility in Windows 98 that allows you to convert your
existing setup to FAT32.  So the fuck what?  For the normal computer geek, FAT32 will
allow smaller clusters of information to be stored, larger hard drives to be formatted as a
single drive, and in general, better disk memory storage.  Well, what does this mean for the
virus programmer?  In order to implement the new FAT32 changes, Microsoft has given us
new unique API to infect and memory allocation.  Unfortunately, I haven't seen examples of
all of the new API, but in the upcoming releases of the developer's guides, more and more
documentation will be released.  So, are we going to wait?  Hell no!  A number of the
Windows 95 SPY programs shouldn't have much difficulty in identifying the new calls.  So
what am I getting at?  The first Windows 98 virii!  We needed to find something specific to
the new OS...this is one exploitable feature.

2. As mentioned before, in the design of Windows 98, Microsoft intended their new OS to be
fully compatable with the previous Windows 95 OS.  What this means for the virus
programmer is that the jump to the next level of OS infecting will not be as major as we
might have expected.  Don't be afraid to begin studying Windows 95, it is essentially the
same thing.  MS's main goal was to increase the hardware and internet support of the OS,
while only slightly upgrading the software architecture of Windows 95.

3. The Ring 0 and 3 protection systems are still in place from the previous OS.  So when you are
looking at manipulating many low level system operations, alternative methods will have to
be looked at, such as VxD's, which we are already seeing show up in virus writing.
Unfortunately, writing the VxD's is only half of the problem.  You are still faced with
developing a concrete infection method of the new file types.  In the next edition of the mag,
I will be devoting more time and resources into opening up windows infection methods.  I
will also be discussing 32-bit programming methods along with introducing the concept an
method of calling the API's.


If you are stuck in the development phase in Windows infection, don't fret.  If you are still having
problems infecting new file types, consider the DLL's and VxD's that you can infect which in
turn will infect only normal EXE and COM files.  The definition that we are sticking with as to
Windows infection, comprises of both the virii that can infect the new file types, plus the ones
that are still DOS based that can survive in the new environment.

In the next editions, we will also be discussing the CryptoAPI and other encryption systems that
we can exploit.  Remember, this is not only a virus writing mag, but also a general hacking mag
too.  The breaking down of the new Windows system is a complete necessity in both fields.  The
more that you can know about your environment, the better.

Good Luck!