HPAVC

home *** CD-ROM | disk | FTP | other *** search

/ HPAVC / HPAVC CD-ROM.iso / pc / NUTILS20.ZIP / NWHRUTIL.DOC < prev next >

Wrap

Text File | 1992-09-05 | 30.1 KB | 640 lines

Documentation for The Nowhere Utilities --------------------------------------- Introduction ------------ During my time a viral developer, I've quickly discovered many operations that are quite useful for creating virii, trojans, and logic bombs that DOS and most popular utility programs (PC-Tools, Norton Utilities, etc.) either can't do or require too much time to do. Some other operations, such as being able to alter the effective size of a file, are useful in many non-viral situations. So I developed a set of thirteen utilities, presented here, to help the aspiring rogue programmer in his quest for electronic mayhem. (Several of these are derived from ideas originally used in the now infamous C-Virus.) So without further adieu, I give you (drum roll) **The Nowhere Utilities**! General notes ------------- The following applies to all of the Nowhere Utilities: all will give a command summary if "/?" is given as the first parameter; all utilities preserve file date, time, and attributes, unless they are specifically meant to change them (FIXATTR and FIXTIME in specific); all utilities will work on read-only files (they automatically remove the attribute if any writing needs to be performed and reset it when .COM format for faster load times. All of the utilities were finished); and all programs are in the written entirely in Borland C++ v3.0 using the tiny memory model (needed to create .COM files), and all were written by myself, Nowhere Man, with some suggestions and comments provided by friends, especially Rigor Mortis, Leeking Virus, and Guido Sanchez. Thanks guys. Now, on with the utilities... The utilities and their many uses --------------------------------- Included in this set of utilities are ten separate programs. Below is a list of them, as well a short summary of what they do and possible uses for them. In addition to the summaries below, running any Nowhere Utility with /? as a parameter displays the syntax for the program. CIPHER ------ CIPHER is just that: a cipher. Give CIPHER a 32-bit decimal number as a key, followed by one or more file names (wildcards allowed), and it will encrypt the files. To unencrypt them, run CIPHER again with the same key. As you've probably guessed, CIPHER uses an XOR-type encryption method, but I've thrown a few modifications in to make it harder to crack. Suggested uses: to encrypt things you don't want other people to see (duh). I'd advise encrypting any sensitive data that could be used against you in court, such as passwords, card numbers, and phreaking codes (assuming, of course, you actually keep these things in files). When you need these things, simply decipher them. Nowhere Utilities v2.0 - 1- (C) 1992 Nowhere Man and [NuKE] This way if the feds ever seize your computer while your at work or school, there is no data for them to use as evidence during your trial. This is also good for encrypting important E-Mail: tell the receiver, either over the phone or on a different board, what the key will be. Then run CIPHER on the program and use DBGSCRPT (see below) to generate a DEBUG script to re-create the file. Do an ASCII upload of the DEBUG script. The receive can just run the script through DEBUG, use CIPHER to decrypt it, and the read the message, run the file, whatever. Great for use on untrustworthy or suspicious boards, or places where the sysop likes to snoop through other peoples' private mail. CRYPTCOM -------- CRYPTCOM is handy utility that allows you to encrypt .COM files but still leave them executable. To invoke CRYPTCOM, just type "CRYPTCOM" followed by one or more files that you wish to protect; wildcards are allowed, and the ".COM" extension is assumed if none is given. They key is chosen by CRYPTCOM automatically, so you don't need to supply one. This program works by encrypting your .COM program and adding some decryption code to the end. The file decrypts itself in RAM at run-time, leaving the actual file unaltered with each execution of the encrypted program. Suggested use: encrypting virii to slip past virus scanners. It's rather obvious what to do: just run CRYPTCOM on the virus. It is now unscannable, and it still runs normally. However, just like the PKLITE trick of old, all subsequent infections will contain the original virus, so basically, this just gets the virus in the front door. Unlike PKLITE, though, no scanner (as of yet, at least) can decrypt a CRYPTCOMed file and scan it, so you don't have to worry about recent versions of SCAN catching you. (Also see NOLZEXE below for another tactic.) DBGSCRPT -------- DBGSCRPT creates, as its name suggests, DEBUG scripts. DBGSCRPT takes two arguments: the input file and the name of the file to contain the script. To re-create the original file from the script, just type "DEBUG < (scriptname)" and watch it do it's work. Note that wildcards are not allowed by this program, and also note that DEBUG will not allow itself to write .EXE files. If you are creating a script from an .EXE file, rename it to a different extension before running DBGSCRPT, and instruct whomever is receiving the script to change it back to an .EXE when DEBUG is done. Suggested uses: creating scripts from binary files to include in text files or E-Mail. This way you could post your latest creation on your favorite virus board without having to upload anything and without having to post your valuable source. You can also include it in text files you put out (magazines, etc.) so you don't have to distribute the virus in a separate file; the reader just cuts out the script and runs it through DEBUG (40-Hex magazine is fond of this technique). Again, no source code needs to change hands. Quite useful, in the right situations. Nowhere Utilities v2.0 - 2- (C) 1992 Nowhere Man and [NuKE] DECRYPT ------- DECRYPT is, as far as I know, a one-of-a-kind utility -- it will crack almost all 8-bit and many 16-bit encryption schemes. There's only one catch: you must know at least five consecutive characters in the original (unencrypted) data. This string is passed as the first parameter. The remaining arguments are the names of files to be decrypted, wildcards allowed. DECRYPT will go through each file given, attempting to decrypt it with a special proprietary algorithm which will crack most standard 8- and 16-bit encryption schemes in under ten seconds. If the file can be decrypted then DECRYPT will tell you which encryption method and what key was used, and a file with the same base name as the original and an extension of .DEC will be created containing the decrypted contents of the file. Sometimes DECRYPT will give a false positive, an invalid decryption; this is a normal side-effect of the ultra-quick algorithm it uses (if you do get a false positive, chances are the file couldn't be decrypted anyway). DECRYPT has many uses. It's great for decrypting a virus attached to a program, so long as you know a string in the virus ("*.COM" is a good bet), or can be used to view those annoying encrypted data files that too many programs seem to come with. Please note that not every file can be decrypted; DECRYPT will break the most common algorithms used in most low-security applications (ie: adding/subtracting a constant, XORing by a constant, etc.). Also make sure that the file you're dealing with is indeed encrypted. Not every unreadable file is encoded, and unless you're pretty sure your just wasting your time (albeit very little of it). Files must be under 32k for DECRYPT to work (DECRYPT loads the entire file into memory for speed, so larger files will overflow the buffer). Outside of these restrictions, DECRYPT is a valuable tool for any aspiring hacker. FAKEFILE -------- Picture this: you've just written up a great trojan or virus and you've placed it into an executable file (or REPLACEd one). What's the problem? Well, wouldn't you be suspicious if you downloaded a ZIP file that was supposed to be a "Great shareware text editor" and all that was in it was one lousy 5k .EXE? Ignoring the problem of documentation, FAKEFILE is a great way to create phoney data files to go with your virii and trojans. Now instead of renaming .ROL files to .DATs (as I've observed in one lame trojan), you can make your own. FAKEFILE takes two or more arguments. The first one is the size of the dummy file. Here you can either give a fixed number, or use the -r switch, which will make each file a random length between 100 and 33767 bytes. The remaining parameters are the names of the fake files to create. Wildcards are not allowed (duh). In addition to filling the files with random bullshit, if FAKEFILE recognizes the extension on your filename (.EXE, .GIF, .OBJ, etc.) then it will add a fake header to the file to make it "legit" to programs that read those types of files. For example, if you typed "FAKEFILE 30345 HOTSEX.GIF" FAKEFILE would create a 30345-byte file containing the header "GIF87a" and 30339 bytes of random data. Of course when you go to view the "GIF" you'll get errors... Another tip: avoid "even" file sizes for most files. It may seem suspicious, depending on the nature of the files. Nowhere Utilities v2.0 - 3- (C) 1992 Nowhere Man and [NuKE] As you might have guessed by now, there is another, and in my .GIFs, .ROLs, even whole utilities, .EXE and all, and upload them opinion, very lame, use for this utility. You can create fake to boards for extra file points. I HIGHLY DISCOURAGE THIS. If everyone went around doing this then you'd spend most of your time downloading crap, and BBSing would die. Of course this is a great use if your dealing with a real lame board; upload tons of dummy games and .GIFs under several user names. The other users will get pissed at the sysop, and his board will go down in no time. PLEASE ONLY DO THIS TO LAMERS; good boards deserve to live. Again, heed my warning and don't be an asshole; if you ever do download a wasteful file on any board, please report it to the sysop. If you are a sysop and are reading this, I'd encourage you to blacklist anyone who does such a stupid thing. FAKEWARE -------- If you're like me, then lame k-rad k00l "ELITE" boards probably annoy the shit out of you. What better way to say "I hate you" then with a virus, the gift that keeps on giving... Unfortunately, some of these people actually know that games have more than one file, etc. and won't run suspicious looking programs. FAKEWARE takes care of all of this. With one command you can create a realistic looking .ZIP of a "0-30 day ware" containing a virus or trojan of your choice. First, prepare the virus or trojan by RESIZEing or REPLACEing it. Then just execute "FAKEWARE (trojan/virus name)." In a minute or two FAKEWARE will have generated a completely bogus game, right down to the .ZIP comment. FAKEWARE creates a fake title for your game, then creates between five and twenty-five fake data files of random length and content (and compressibility!). It includes your virus or trojan under as the main .EXE, and even generates a fake .NFO file from either RAZOR, INC, or TDT, complete with program description, cracking information, and greets to all those cool pir8 doodz you know and love. FAKEWARE executes PKZIP (which must be in the current directory or in your PATH in order for FAKEWARE to work correctly), and adds a .ZIP comment, an ad for a completely fake, yet very realistic, warez board. All temporary file are deleted, of course. Now just upload the .ZIP as the game that FAKEWARE tells you and you're all set; all you have to do now is get the loser to run it... FAKWARE will also generate a fake .EXE if no argument is given, allowing you to send up tons of bogus wares to a stupid board to discredit the sysop and create chaos. Unlike some other utilities, I couldn't care less if you misuse it; I never did like warez boards anyway... FIXATTR ------- This program lets you alter the attributes of files. Quite simple and very legitimate. You can use either "+", "-", or "=", followed by one or more of the following letters: A, H, R, and S. Using a plus sign will add the specified attributes to the files' current attributes; a minus sign will remove those attributes, if set; and the equals sign Nowhere Utilities v2.0 - 4- (C) 1992 Nowhere Man and [NuKE] will set the files' attributes to the ones given, removing any existing ones. The letters above stand for (A)rchive, (H)idden, (R)ead-only, and (S)ystem, respectively. Attributes for subdirectories cannot be modified, but wildcards and multiple file names may be given after the attributes. This is essentially the same as the DOS 5.0 or 4DOS ATTRIB command, but it is usable by anyone, even those without DOS 5.0 or 4DOS. Suggested uses: hiding and/or write-protecting sensitive files (or unhiding those pesky hidden files that some games still use), or whatever else you can think of that requires attribute changes. This utility is pretty basic, so I'm sure you'll think of other applications for it. FIXTIME ------- FIXTIME is a basic "touch" utility, similar to those found under UNIX and those that come with compilers such as Turbo C and Microsoft C (although FIXTIME is superior to most compiler "touch" programs, as it lets you set the file time to anything; more on that later). FIXTIME can either take zero, one, or two arguments, followed by one or more file names (wildcards allowed). If no other arguments are given besides the file name(s), FIXTIME will set the time stamp of any and all matching files to the current system time and date (which may not be correct, if you're one of those people too lazy to set your system clock). If a time is given, it must precede the file name(s) and be in the standard 24- hour format (hh:mm:ss). All applicable files will have their times set to that time; if no date is give then the system date will be used. If a date is specified, it must precede the file name(s) and be in the American date format (MM-DD-YY or MM/DD/YY, where the year is any year between 1980 and 1999). As usual, no other aspects of the file (size, attributes, etc.) are changed. Suggested uses: to alter the time on documents that are past due :-), to fix the date/time stamp of files to which you have added a virus (though good virii always preserve the file's date and time), or to change the date for any other purpose you can come up with (to prevent someone from telling when you've written something, to change the file times of files you've edited/modified, etc.). None of these ideas really needs much elaboration; just be sure that if you're going to want to change a file back that you remember to write down the original time and date first... NOLZEXE ------- Don't you just hate it how executable-file compressors always leave an annoying signature to show they've been used? Until now the only way to remove these signatures to prevent people from UNLZEXEing or PKLITE -Xing your program was to go in by hand with DEBUG or any other hex editor and rip them out. Well, I've come up with this handy-dandy utility to automatically destroy these headers for you, preventing SCAN from detecting your PKLITEd virii and stopping assholes from trying to disassemble or reverse-engineer your code. When invoking NOLZEXE, all you must provide as parameters are the names of files you wish to protect. Wildcards are allowed, and if no extension is given Nowhere Utilities v2.0 - 5- (C) 1992 Nowhere Man and [NuKE] then .EXE is assumed (though .COM files are supported, too). NOLZEXE will then go through the files and completely cover all compressor headers with random bytes; if a file is not compressed nothing will happen to it. Versions 0.90 and 0.91 of LZEXE (the only versions currently released) and all versions of PKLITE are supported. (If anyone out there has found any other executable-file compressors that they'd like to see supported in the next version, see below on where to contact me.) The files will still execute properly and are otherwise unchanged; however no virus scanner, CHK4LZE, or CHK4LITE program will pick them out of the crowd. Suggested uses: as mentioned above, to remove the headers on LZEXEd and PKLITEd virii to prevent scanning (my ever-popular C-Virus used similar techniques), and to stop people from disassembling or reverse-engineering your products (use the compressor on them and then use NOLZEXE). This is also useful on trojans, as it can stop CHK4BMB-type utilities from picking up your damaging code; compress the trojan then NOLZEXE it. If your compressor refuses to work on the file because it's too small (all to often the case with virii), please read my notes about the subject under RESIZE below. REPLACE ------- Based upon an idea I had originally used in C-Virus, REPLACE performs a great service to trojan- and virus-disseminators everywhere. To put it bluntly, it just replaces one file (presumably a legitimate one) with another (presumably a nasty one). On a more detailed level, what REPLACE does is delete the original file, copy the new file to the original's name, then reset the attributes, date, time, and size as they were on the original file. Essentially, the new file has become the old one. For example, you could "REPLACE LEMMINGS.EXE DIR-2.COM" and then distribute "Lemmings" to all of the lame k-rad pir8 boards in the area (good pirate boards wouldn't take such an old game to begin with). As shown, .COMs may replace .EXEs, and vice-versa, with one exception: and .EXE which REPLACEs a .COM must be smaller than 64k, or else DOS will give an error when it is executed. Also note that REPLACEing a file with a larger one will cause excess bytes in the new file to be clipped (ie: if you replace a 1000 byte file with a 2000 byte one only the first 1000 bytes of the 2000 byte file will be copied), so don't try it on executable files. To run REPLACE, just provide two arguments, the first being the name of the old file and the second the name of the new one, the file to be replaced and the replacer, respectively. Wildcards are NOT allowed. Also, remember the size warnings in the previous paragraphs to avoid embarrassing mistakes (imagine how humiliating it would be to upload a trojan to Ross Greenberg's shitty BBS and have it get an error!). Have fun with this one. RESIZE ------ RESIZE is a file resizer: it lets you alter the size of an existing file, either making it larger or smaller. RESIZE may be invoked in several different ways. If the first parameter is "-r" then random byte filling is used (if the file size is being increased then Nowhere Utilities v2.0 - 6- (C) 1992 Nowhere Man and [NuKE] the extra space is padded with random bytes); otherwise blanks are used as padding. The other parameter, besides file name(s) is the size variation. This may be either relative or absolute. To modify a file's size absolutely, you just give a number; the file's size is then changed to that number. If you want the size to be relative, then you give the size of the change (in bytes), preceded by either a "+" (to make the file bigger) or "-" (to decrease it by the same amount). The remaining parameters are file names, wildcards allowed. Note that if you elect to make a file smaller, then the excess data will be forever lost, so don't go around trimming things without good cause thinking that you'll be saving disk space or something idiotic like that. If you do you'll deserve it. You might wonder "Why the -r option?" Well, it's there because if you try to PKZIP or otherwise compress a RESIZEd file that was blank-padded, then it will compress down to its original size (less whatever it would have gone down to had it not been RESIZEd). If you saw a 1000000 byte file in an archive being compress to 2000 bytes, I think you'd be just a bit suspicious (though I know at least one (ex-)sysop who wasn't, hehehe). With the random bytes the compressor is unable to pack that area much, keeping the illusion that the file is larger than it really is. Also, in case you were wondering, RESIZEd executable files will still run normally, RESIZEd .GIFs will still view properly, and so on. Suggested uses for RESIZE: to increase the size of virii and trojans and upload them to boards (renamed, or course); after all, would you download a 500-byte program labeled "really awesome virtual reality simulator?" You would if it were one megabyte, though. As I stated before, DO NOT ABUSE THIS PROGRAM AND UPLOAD INFLATED FILES TO GOOD BOARDS FOR CREDIT. If you want to do it to a lamer, go ahead, but like I said before, if everyone RESIZEd their files then everyone would be wasting time download tiny, useless, lame programs made out to be cool by their large size. Don't be lame and abuse these utilities; they were meant for causing mayhem, but don't inflict it on your friends. RESIZE has a few other uses. You can RESIZE (normally) a file which PKLITE or LZEXE refuses to compress; it will end up no larger, and this method sure beats the old UNDELETE procedure. An interesting side note. My friend Leeking Virus has discovered another use for this versatile utility. Here's a way he came up with (and tested, I might add) for crashing boards. When you go to upload (or even download, depending on the software), most BBSs will tell you how much space is free on the hard disk. What you do is RESIZE a small file to take up at least that much space and then upload it while no one's around (naturally boards with two gigabyte hard disks are pretty much immune to this, as your hard disk must be large enough to hold the RESIZEd file). You must be sure to NOT use the -r option, and NOT to PKZIP it. Unless you want to totally waste time, be sure to use JMODEM or another protocol with data compression. The file will still take what it originally would to download, but it will swell up on the receiver's hard disk to fill it up. Hehehe. On Telegard boards it has the added advantage of locking up the board; Telegard tries to log the fact that the disk is full to an error file, but since there's no room, it can't create the file, so it tries, to log that error, and so on, trapping the board in an infinite loop. Other BBS software might do this too, but so far Telegard is the only system that's been tested. At Nowhere Utilities v2.0 - 7- (C) 1992 Nowhere Man and [NuKE] the very least there'll be no more uploads that day. Another possibility is to RESIZE -r a file to the size of the target hard disk, give it the read-only attribute, ZIP it up and give it to a board that automatically PKUNZIPs files for scanning. Similar effects... USER2TXT -------- If you're into hacking boards, I'm sure you know the most prized possession you can take is the user list. The information in that file can get you accounts on many other boards all over the country (if the people are stupid enough to use the same password on every board they call, which many people are). But how do you take a user list, in binary format, and turn it into a readable form? If you have Telegard (or whatever other BBS it comes from) you could just copy it to your GFILES directory, use the (U) option, and flip through the users one by one, writing down the passwords and phone numbers. But what if you don't have the time, or you don't have Telegard, or you'd like a nice file for on-line reference from your comm program? USER2TXT fills that gap. To user USER2TXT, give it two parameters, the first being the name of the Telegard v2.5/v2.7 or X-Ot-Icks v3.8 user list (almost always USER.LST), and the second being the name of the output file. USER2TXT will convert the binary data in the first file to readable ASCII. The second file will contain each user's name, real name, password, and phone number. The first user will always be the sysop. This program really has only one use, which I've already described above. This is a simple utility, but one that you'll find very useful. WIPE ---- WIPE is a little utility I wrote to totally wipe a file off of a disk. You run WIPE with one or more file names (wildcards allowed), which are the files to wipe. The files are unrecoverable by normal means (UNDELETE, QU, DISKEDIT, etc.), so be VERY careful with this; it DOES NOT prompt you to verify your choice. This was done because I figured if you were ever in the situation to need this program (a bust, etc.) you would not want to be slowed down constantly hitting "Y." I'd also advise renaming this program, as it's only a matter of time before some lamer develops an ANSI bomb that runs it. Suggested uses for this program: only one, really, and that's to destroy sensitive information in case of a bust. If I were you, I'd write a batch file called BUST.BAT, or something like that, that would automatically WIPE all of the files you needed destroyed. This program is much faster than Norton's DISKWIPE or WIPEFILE because mine doesn't need to meet some silly military standard. I'm sure if someone were REALLY REALLY desperate they could possibly get your files back, but they'd need sophisticated equipment that no police force would normally have. If you have the time (ie: you've been warned the cops are coming for you) then I'd advise using WIPEDISK or another military-standard wipe program, but WIPE is much faster in case you don't have the time. Like I said, BE VERY CAREFUL WITH IT. Nowhere Man and [NuKE] are NOT responsible if you fuck yourself over with this. It is only meant for desperate situations. Nowhere Utilities v2.0 - 8- (C) 1992 Nowhere Man and [NuKE] Revision Information -------------------- Version 2.00 (September 5, 1992) o DECRYPT, FAKEWARE and USER2TXT programs added. o Removed a bug in RESIZE that would create huge files if you attempted to make a file smaller than it's current size (ie: RESIZE -10000 TEST.DAT where TEST.DAT is only 5000 bytes long). Thanks to Guido Sanchez. o Major revisions to FIXTIME. The help message was revised to correctly indicate that several filenames can be used (v1.00's help message read "FIXTIME [hh:mm:ss [mm-dd-yy]] filename," but there should have been ellipses after "filename"). I've also changed FIXTIME so that it isn't necessary to specify a time in order to change file dates. Dates and times are also checked for invalid settings (for example, the time "99:99:99"). o CRYPTCOM's decryption routine has been changed, slightly increasing its size but making it faster and more compatible with certain (picky) programs. o NOLZEXE now recognizes files compressed with PKLITE v1.1x. o All programs that utilized random numbers have had their random-number generation routines updated. This will not effect the functioning of the programs. o Documentation cleaned up. Many spelling/grammatical errors were fixed, the layout was changed, and several inaccuracies (including a reference to a non-existent paragraph) were corrected. Version 1.00 (January 25, 1992) o Initial release. Closing comments ---------------- As you can see, the Nowhere Utilities are very powerful, but they also can be abused -- DON'T. I intended for the entire virus community to benefit from these, not for some losers to abuse them. Other than that little warning, I heartily encourage you to experiment with the utilities, to use them in new and interesting ways (if you find a novel use for a utility, let me know so I can mention it in the next version). Enjoy them. Nowhere Utilities v2.0 - 9- (C) 1992 Nowhere Man and [NuKE] As usual, greets go out to Rock Steady, Rigor Mortis, Leeking Virus and Murdak, all [NuKE] and SCP members and sites, Phalcon/SKISM, and all virus-writers everywhere. Thanks to anyone else who I forgot to mention; your input into this project is still greatly appreciated, even if I do forget a name here and there. If anyone has any questions, comments, complaints, or suggestions about this or any other fine product from Nowhere Man or [NuKE], I can be reached at The Hell Pit and FreeMatrix, both official U.S. distribution sites for [NuKE]. I also monitor most Chicago-area networks, as well as NuKENet, Swashnet, CyberCrime International, P/S Net, and FidoNet; responses to my products may be posted there also. Once again, so long, and happy virusing. -- Nowhere Man, [NuKE] '92 Nowhere Utilities v2.0 - 10- (C) 1992 Nowhere Man and [NuKE]