HPAVC

home *** CD-ROM | disk | FTP | other *** search

/ HPAVC / HPAVC CD-ROM.iso / pc / VXAVTOOL.ZIP / EXEC-VIR.ZIP / GOATEXEC.ZIP / GOAT.DOC < prev next >

Wrap

Text File | 1997-04-03 | 59.8 KB | 1,217 lines

┌───────────────────────────┐ │ ╔══╗ ╔══╗ ╔══╗ ╔═╦═╗ │ Utility for │ ║ ║ ║ ╔══╣ ║ │ antivirus │ ║ ═╦ ║ ║ ║ ║ ║ │ researchers │ ╚══╝ ╚══╝ ╚══╚═ ═╩═ │ ┌─┴───────────────────────────┴───────────────────────────────────────┐ │ │ │ GOAT File Creator Package, Version 4.2 │ │ (c) MIG, Igor G. Muttik, 1997 │ │ │ └─────────────────────────────────────────────────────────────────────┘ ┌──────────────────────────────────────┐ │ NEW - CREATION OF NE-EXE AND PE-EXE │ │ FILES FOR WINDOWS 3.x AND WINDOWS 95 │ └──────────────────────────────────────┘ ┌───────┐ │PURPOSE│ ──┴───────┴─────────────────────────────────────────────────────────────────── GOAT package is a tool for the antivirus researchers. The GOAT file generator produces executable victim file(s) (COM, EXE or SYS), typically called "sacrificial goat file(s)". These output files are used as baits for the viruses. The purpose of the programs can be explained using the following diagram: ╔══════════╗ ┌──────────────────────┐ ║ Goats ╟────┬─┤ You need a goat file │ ┌─────────────────┐ ║ creation ║ │ │ with some special ├───────┤ use GOAT.COM in │ ║ task ║ │ │ internal structure. │ │ "just-one-file" │ ╚══════════╝ │ └──────────────────────┘ │ mode │ │ └─────────────────┘ │ ┌─────────────────────────┐ │ │ You need a series of │ ┌─────────────────┐ ├─┤ goat files of different ├────┤ use GOAT.COM in │ │ │ sizes. │ │ "series" mode │ │ └─────────────────────────┘ └─────────────────┘ │ │ ┌─────────────────────────┐ │ │ You need a set of files │ ┌─────────────────┐ ├─┤ of the same size with ├────┤ use GOATSET.BAT │ │ │ the different contents. │ └─────────────────┘ │ └─────────────────────────┘ │ │ ┌──────────────────────────┐ │ │ You need many identical │ ┌─────────────────────┐ ├─┤ samples to infect them ├──┤ use GOAT.COM in │ │ │ with the polymorphic │ │ "zillions-of-files" │ │ │ virus. │ │ mode │ │ └──────────────────────────┘ └─────────────────────┘ │ │ ┌──────────────────────────┐ │ │ You need many different │ ┌─────────────────────┐ └─┤ samples to infect them ├──┤ use GOAT.COM in │ │ with the polymorphic │ │ "zillions-of-files" │ │ virus. │ │ mode with /U switch │ └──────────────────────────┘ └─────────────────────┘ Using GOAT.COM you can manually select the size, the name of a sacrificial goat file and vary its internals to meet the criteria, which the virus uses when deciding "to infect or not to infect" the victim file. You can enter the size of a sacrificial goat file in any of given formats: decimal, hexadecimal or in kilobytes. Size of the victim files can be as small as 2 bytes and as much as many gigabytes (it is a 32-bit variable). GOAT.COM is very flexible - it can create COM, EXE, SYS(COM) and SYS(EXE) files, NE-EXE, PE-EXE with code at the beginning, in the middle, or at the very end of the goat file. Files can be filled with zeroes, NOPs, two types of pattern or even filled with random garbage. You can add stack segment for the EXE files, vary header size, and ... many other options are available. "Series" mode is intended to create a series of bait files with linearly increasing length. Length increase step is changeable. In "zillions-of-files" mode GOAT.COM can create unlimited (you will just run out of disk space long before) number of files. Then you can infect this set of files with a polymorphic virus to test its behavior and properties. This mode is turned on if '+' (plus) or /Fnnn or /D[nnn] is given in the command line. GOATSET.BAT produces some sort of "a standard set" of files of the same size. These files are different (internal contents or attribute are variable). GOATSET.BAT needs GOAT.COM for the execution. GOAT.COM should be located in the current directory, or it should be accessible via PATH environment variable. The "standard set" of goat files may help you to find out which files are prefered by the virus (ex.: virus may infect only COM files starting with JMP). Checking "a standard set" after virus attack, you can easily understand which files are infectable. A small batch file RUN-ALL.BAT will help you to run (i.e., infect, if you have a resident virus active) all generated bait files. Text of RUN-ALL.BAT is self-explanatory. Using GOAT.INI file you can change default behaviour of GOAT.COM to better meet your requirements. ┌────────┐ │EXAMPLES│ ──┴────────┴────────────────────────────────────────────────────────────────── Examine the following examples with comments: ───────────────────────── "just-one-file" mode ──────────────────── GOAT /? // gives help screen GOAT 2 c:\bait.com // create 2-byte file C:\BAIT.COM GOAT 100k // create 100k file GOAT000.EXE GOAT 10 /b/j // make short COM file with code at the bottom, without JMP instruction GOAT 34 /e2 // create EXE file with 32-byte header GOAT 8k /e100h // create long EXE header (100h=256para=4k) GOAT 200 /e10/9 // create EXE file with a 160-bytes header // and fill the file with NOPs GOAT 570 /e/b/j // make EXE with a standard 512-byte header, place code at bottom and avoid JMP GOAT 4000 /iE5h // make 4000 bytes COM file, fill with E5h GOAT 8k/r/t62 // make 8k COM file with readonly attribute and seconds field in timestamp = 62 sec GOAT 30000 t.exe // create 30000 bytes file T.EXE, but with internal COM structure, i.e., without EXE header GOAT 30000 t.exe /e // create 30000 bytes file T.EXE, with standard 512 bytes 'MZ'-header GOAT 2000h /e // create 8192 bytes file GOAT000.EXE GOAT 512k /#20h/w // create 512k NE-EXE file GOAT000.EXE with 20h relocation entries in the EXE header GOAT 1k /r7 // make 1k Hidden/System/Readonly COM file GOAT 300k /e40h/o/j/9 // make 300k EXE file, not overlaid, without JMP, filled with NOPs with 1k EXE header GOAT 300k /e40h/o/j/9/b // same, but code at bottom of file GOAT 300k /p/t18h // make 300k EXE file and fill it with 00, 01, 02, ... pattern, set seconds in the file timestamp = 18h = 24 GOAT 1k /n // make 1k COM file, filled with random bytes GOAT 1k /u // make 1k COM file, different from above GOAT 1k /y // make 1k SYS device driver GOAT 1k /y/e // make 1k SYS-EXE device driver GOAT 1k /e/k1k // make 2k EXE file with 1k STACK segment GOAT 1k /e/k810h // make 3088 bytes EXE file, code segment will take 1024 bytes, stack - 2064, and SP=810h, CS:IP=FFF0:100 GOAT 1k /e /k810h /M512 // make 3088 bytes EXE file, code segment will take 1024 bytes, stack - 2064, and SP=810h, CS:IP=0:0 ────────────────────────── "series" mode ────────────────────────── GOAT 1000-65000 1000 // create 65 COM files GOAT 1000-65000 1000 /E // create 65 EXE files GOAT 600-1600 100 /E/L // create 10 EXE files and assign them // a previous year's timestamp GOAT 1k-66k 32k /b/9 // create 3 files. First two will be COM files with 1k and 33k size, last will be EXE file. Names assigned: GOAT000.COM, GOAT001.COM and GOAT002.EXE. Code located at bottom, filled with NOPs GOAT 1000h-2000h 200h // create 9 files: GOAT000.COM (size= 4096) .. GOAT008.COM (size=8192) GOAT 50k-60k 10h /e2/b/v // create many EXE files with 32 byte EXE- header, code at bottom. All will have SS=CS, SP=IP GOAT 1024k-16384k 1024k // create 16 files, all EXE. Will probably result in "Not enough disk space" error, because files will take >120MB in total GOAT 100-1000 100/m50/p2 // make 10 COM files with JMP to the code located at byte 50, word-pattern filled GOAT 1k-10k 1k /y/e // make 10 SYS device drivers, organized as EXE files with 512-bytes header ────────────────────────── "zillions-of-files" mode ─────────────── GOAT 100 + // make 500 100-byte COM files in 10 dirs GOAT 1k /D // make 500 1k COM files in the current dir GOAT 1000 /F400/D5/Q65 // create 2000 COM files of size 1000 in five directories - DIRAAA...DIRAAE Names are GOATAAA.COM .. GOATCJJ.COM GOAT 12345h /E2/B/9/D1 // create 500 files. Files will be EXE, 74165 bytes in size, with short EXE header, NOPs filled, code will be placed at the end of the files. Names assigned: GOAT000.COM .. GOAT999.COM All in one subdirectory - DIR000 GOAT 2000 /F10000/D1000 // create 10 millions of 2000-byte files in 1000 directories ────────────────────────── "test-set" mode ──────────────────────── GOATSET 1024 // create 52 different files. Twelve COM files, 34 EXE files and 6 SYS files (2 nornal SYS and 4 SYS-EXE). See GOATSET.LOG for the report. GOATSET 30k // create 52 files. See GOATSET.LOG for the report. ────────────────────────── "running goats" ──────────────────────── RUN-ALL // run all generated GOAT???.COM and GOAT???.EXE files ┌─────────────────┐ │USAGE OF PROGRAM │ ──┴─────────────────┴───────────────────────────────────────────────────────── You can see the correct usage of all programs, specifying the "help" command line switch "/h" (or /?): GOAT /h GOATSET /h Printout of GOAT.COM's help screen is given below: ┌──────────────────────────────────────────────────────────────────────────── │ │GOAT - Version 4.2 - (C) MIG, 1997 │ │Usage: GOAT Size [Filename] [/switches] - "just-one-file" │ GOAT StartSize EndSize [Increment] [/switches] - "series mode" │ GOAT Size [+] [/D[nnn]] [/Fnnn] [/switches] - "zillions-of-files" │ │Size - dec, hex or kbytes (Ex.: 1000, 65530, FE00h, 31k, 512K, 2048k) │If [Filename] is not given creates GOAT000, GOAT001... │ │Switches: /N[nnnn] RND filled (nnnn = seed) │ /Annnn set SYS driver Attribute /P,/P2 use byte or word pattern │ /B code at Bottom /Qnn use char 'nn' instead of '0' │ /D[nnnn] Directories (default = 10) /R[nn] make file Readonly/Hidden/Sys │ /E[nnn] EXE file (nn = header size) /Tnn seT seconds = nn (<63, even) │ /Fnnnn Files in dir (default = 500) /U Unique RND fill │ /Gnn use 'nn' as NOP replacement /W[nnnn] Make NE header at offset nnnn │ /Inn fIll byte = nn (/9 for NOP) /X[nn] replace E9 00 00 with 'nn's │ /J no JMP at code start /Y create device driver (SYS) │ /Knnnn add STACK seg of nnnn size /Z use 'ZM' EXE header │ /L[nnnn] set year = nnnn (/L = oLd) /#[nnn] put nnn EXE relocations │ /Mnnnn put code at offset 'nnnn' /! Make PE executable (Win-95). │ The square brackets denote optional parameters. ┌────────┐ │SWITCHES│ ──┴────────┴────────────────────────────────────────────────────────────────── Short reference of all available switches is given below in the alphabetical order. Note that any switches having a parameter could be entered either in decimal or hexadecimal notation (ex., /i100 or /iE5h). /Annnn - set SYS device Attribute (default=0C853h). Have no sense without /Y switch. (May be placed in the INI file to change default device driver attribute.) /B - place code at bottom of file (default is at start) /C[n] - set GOAT.COM selfcheck level (by default equals to 2, the highest) (/C means /C0, i.e., no checks at all) /D[nnnn]- create maximum nnnn subdirectories (default=10) /D (or /D0) means make goat files in current directory. (this switch turns on "zillions-of-files" mode if it was given from the command line) /E[nn] - create EXE file (if size > 65280 - done automatically) If nn is given file will have an EXE header of nn paragraphs long (just /E will produce standard 512-bytes EXE header). Header size is limited to about 32k. /Fnnnn - create maximum nnnn files in a subdirectory (default=500) (this switch turns on "zillions-of-files" mode if it was given from the command line) /Gnn - use nn byte instead of NOP (when, say, /J/B are used) /Gnn should be used with *caution* - bad selection of nn will produce goats which hang when executed. This switch is useful when included in the INI file. See also /X. /H, /? - Help screen /Inn - use fill byte nn instead of standard zero-fill (ex., /i100 or /iE5h) /J - remove JMP at code start (by default it is present) /Knnnn - add nnnn bytes of STACK segment to the bottom of executable file (stack segment is filled with 'STACK' string by default) Can be placed in the INI file. Parameter /K given in the command line can supress /Knnnn definition given in the INI file. /L[nnnn]- assigns year 'nnnn' to a created goat file(s). If given without number (just /L) - assigns previous year (say, if current year is 1996 goat will get year 1995). Please note that /L switch affects both the timestamp of the file and the timestamp embedded in the PE-header. /Mnnnn - place code in the middle of the file exactly at offset nnnn (nnnn can be in the range 0..filesize, even when the file is >64k). /N[nnnn]- fill goat file with pseudorandom bytes. The parameter (if given) is a random number generator seed. RNG uses multiplicative congruental method with 2**32 period. /O - do not make long EXE (>256K) with internal overlay structure This option affects only EXE files longer than 256k. By default such EXE goats get number of pages in the EXE header like in a 256k EXE file (i.e. the rest of the file is not loaded in memory when the file is executed). /P[n] - fill free file space with pattern. Switch /P or /P1 means byte pattern, while /P2 - word pattern. Byte pattern looks like is - 00, 01, .. FE, FF, 00, .. Word pattern is - 0000, 0001, ...FFFF, 0000. Both types of patterns are "anchored" to the location (i.e., byte pattern at, say, offset 2BCE will be CE CF D0 D1...; word pattern at the same location will be CE 2B D0 2B D2 2B...). /Qnn - use char 'nn' (ex., 65='A') instead of '0' when naming goat files (ex., /Q65 will do: GOATAAA.COM, GOATAAB.COM,...) /R[nn] - setting nn in range 1..7 you can produce any combination of Readonly/Hidden/System attributes (/R or /R1 sets Readonly bit, /R2 - Hidden, /R4 - System). /S - turn off selfchecking of the created goat file. Also makes goat code a bit shorter (about 80 bytes instead of 286). See also switch /7. /Tnn - set timestamp seconds field = nn. DOS stores the seconds of the file creation in the rounded to the closest even value. So odd values are not allowed. Seconds field should be in the range 0..62 and even (ex., 0, 1Eh, 62,...) /U - guarantees that contents of each generated file is unique (fills file with random bytes and and do not reset random generator before creation of each file). However, if you make a set of files (in "series mode" or "zillions-of-files mode") many times - you will get an identical set every time (as the same seed produces the same pseudorandom sequence). In "just-one-file" mode PC clock is used to give a seed for pseudorandom generator and therefore you will get unreproducible garbage filling for each goat. /V - set SS:SP equal to CS:IP /W[nnnn]- make NE-EXE file. By default NE-EXE header will be located at offset 400h. The offset value is rounded to the closest 32-bit boundary. NE-EXE header should be in the first 64k of the EXE file, so offset limits are [40..FF8C] (but it shouldn't also overlap with the code or with relocations, if any). See also /2 switch. /X[nn] - kills E9 00 00 and replaces it with given bytes. Switch /X without parameter is useful only when the code is not at the goat file start (/B or /Mnnnn were used). Otherwise it has the same effect as just /J. /Xnn should be used with *caution* - bad selection of nn might produce goats which hang when executed. If there are values patched in the body of the program where [90 90 90] was - they are used in the first place. /Y - create device driver (SYS file). May be combined with /E to make SYS-EXE files. /Z - make 'ZM' EXE header instead of 'MZ'. /2 - merely changes target OS in the NE-EXE header to OS/2 (default is Windows). Can be specified twice to get "unknown" target OS. For PE executables increases OS MAJOR, USER MAJOR and SUBSYS MAJOR fields (defaults are, 1, 0 and 3, respectively). Can be placed in the INI file. /9 - fill free file space with NOPs (default - with zeroes) (it is just a shortcut for /i90h). /7 - enables beeping when selfcheck fails (works both for selfcheck of GOAT.COM generator and for produced goat files which have selfchecking code). /#[nnnn]- specifies the number of dummy relocation entries in the EXE header. Relocation make happy a couple of viruses, which refuse to infect goats with no relocations. Relocations are dummy - they do not affect the goat code. If the code of the goat is at the file start (just after EXE header), then relocations will affect bytes just after the goat code (after B4 4C CD 21). If code is at file end (/B), or in the middle (/Mnnnn), then relocations are made to the bytes just after file end (or to the stack area if it's present). Switch /# without parameter can suppress /#nnn definition given in the INI file. For normal EXE files relocations start at 1Ch, for Windows NE/PE executables - at offset 40h. /! - Make PE-executable file. By default PE-header will be at offset 100h. Any generated PE executable has exactly 5 sections (CODE, .icode, DATA, .idata and .reloc). Option /! also sets size of the EXE header to 40h bytes (use /Ennnn to change if you wish). See also /2 switch. The switches in the command line (like /E) give you the control over the victim creation. You can place the code at the beginning of the goat file or at the bottom. You can select the filling byte (00, 090h or even pattern), the presence of JMP at the code start. You can force creation of EXE file. You can even change size of EXE header and control values loaded in SS and SP. You can prohibit the creation of overlaid EXE files, etc. Most of the command line switches can be applied simultaneously. Value, specified in the switch /Mnnnn (nnnn is 32-bit value and you may use "k" and "h" modifiers), has the following limitations: for EXE: (header size) < nnnn < size-286 (no /S) for EXE: (header size) < nnnn < size-78 (with /S) for COM 3 < nnnn < size-2 If some switches are conflicting (say, "GOAT 1000 /P0/P2", where /P0 - byte pattern and /P2 - word pattern), - the last is used (same applies to the switches in the INI file). Some combinations of switches are not allowed. For example, you cannot set /J, /B and /P for any COM file simultaneously (if code is at bottom and no JMP is present - pattern will appear as a code at CS:100). Switch /Knnnn adds stack segment at the bottom of the file (always EXE). Size of the stack segment is limited: 16 < nnnn < 65536 Please avoid small and odd values in /K, because when the goat file created with such an odd stack is run it could easily hang a computer or cause "Exception #13" (QEMM frequent warning), when SP goes through the stack segment boundary (i.e., half of word is written at SS:0000 and other half - at SS:FFFF). Note, that the size specified in /Knnnn is added to the main size of the file (i.e., GOAT 1k /k1k will produce 2048 bytes EXE file). If the main size of the file does not end on the paragraph boundary (i.e., main size is not divisible with 16) - stack segment will start on the first paragraph after the end of the main file size. Switches /Fnnn and /Dnnn given in the command line automatically turns the program into a "zillions-of-files" mode (or use '+'). You can specify the desired number of files and subdirectories to create. By default, 10 subdirectories with 500 files in each are created. Note, that if any directory already exists (say, DIR004), it will be simply skipped and no new files will be created inside. If you specify just /D switch this will allow creation of zillions-of-files in the current directory (same as /D0). ┌────────┐ │INI FILE│ ──┴────────┴────────────────────────────────────────────────────────────────── You may like to put your preferences (signature, switches, filename templates, etc.) into a separate file - GOAT.INI Use any text editor to create or modify INI file. Note that not all switches are suitable for placing in the INI file as some of them are "direct-action". They immediately force certain mode of operation: say, if you place /E in the INI file you will no longer be able to create goats of COM type. Here is the list of switches suitable for INI file (although, the last five are not very useful in the INI): # 2 7 9 A C D F G I K L N O P Q S X and J R T U V The following are not suitable for the INI file (not mentioning /? or /H switches): ! B E M W Y Z The sample INI file is given below: ┌───────────────────────────────────────────────────────────────────── │; │; sample INI file │; │Motto="Antivirus test file." ;all output bait files will carry │ ;this string. │files=BAIT ;files will be BAIT000.COM, BAIT001.COM, ... │dirs=HEAP ;directories created - HEAP000, HEAP001, HEAP002 │STACKfill="*MYSTACK" ;fill stack with '*MYSTACK*MYSTACK*MYSTACK' │SYSnames="DRIVERXX" ;this string is inserted into SYS header. │Switches=/F800/D15 ;make 15 dirs, 800 files in each. 12000 in total. │Switches=/L ;always put previous year in a goat timestamp │Switches=/iF6h ;always fill free file space with 0F6h byte │Switches=/g40h ;use INC AX instead of NOP │Switches=/q65 ;use GOATAAA..GOATJJJ instead of GOAT000..GOAT999 │Switches=/O ;never make overlaid EXE files │Switches=/K200h ;if EXE - always add 512 bytes stack at eof │ GOAT.INI may be located in the current directory or in the path of started GOAT.COM. The first location has priority over the second. GOAT.INI may not exist. In that case program uses built-in defaults. The following statements are allowed in the INI file: Motto= ;defines signature for all created goat files ;(not present on default) files= ;filename template for GOAT.COM (default=GOAT) ;it can be empty (ex., files=) dirs= ;directories template for zillions-of-file mode ;it can be empty (ex., dirs=) STACKfill= ;stack fill string (default=STACK) SYSname= ;driver name (default=GOATXXXX) Switches= ;any switches you like (multiple lines allowed) Any comments may be added after a semicolon. Filename template (files=) and dir template (dir=) can be empty (this will make all letters of the name variable: 000-999 or whatever was defined by /Qnn). Motto string, defined in the INI file appears in the created goat COM file immediately after JMP (if any) or after the goat code (if no JMP). In the EXE file it appears after the goat code, if code is at the start. If space at the beginning is free (ex., /B or /Mnnnn switch moved goat code away from the beginning) - motto will appear at the EXE file start (after the EXE header). Motto string is limited to 64 symbols. To include spaces in the motto string use quotes. Note, that /J/B and /J/Mnnnn switch combinations supress motto in the goat file. Switches /F and /D given in the INI file just modify the built-in default values for the number of files and directories, created in "zillions-of-file" mode. This does not turn on this mode. To do so you will need to specify '+' (plus) in a command line explicitely. Filename and subdirectory templates are limited to 5 symbols, because programs always add '000' and then start incrementing this number until it becomes '999' (or 'AAA' ...'JJJ' if you, say, redefined the naming with /Q65 switch). Dot is not allowed in the template. Any string exceeding the limit of 5 symbols will give the error message: "Error in the INI file line #xxx" The processing will be aborted. The same error will appear if you give any wrong switch (say, /@) or parameter value (say, /T68 or /i500). Stack fill string is limited to 32 symbols (you can use even unprintable characters, like ASCII 01, etc.). The strings may be quoted. To enter a quote itself - duplicate it inside the quoted string - ex. "File is ""readonly""" will be converted to a string: 'File is "readonly"'. Driver name, defined using "SYSname=", is limited to 8 symbols. This name is right-padded with 'X' symbols, if name has less than eight symbols. Note that any INI file switch settings is overridden by command line switches. ┌────────────────┐ │SIZE LIMITATIONS│ ──┴────────────────┴────────────────────────────────────────────────────────── By default GOAT.COM produces sacrificial file of COM type. This applies to any given size, which meet the following criterion: 2 < Size_of_COM < 65280 The magic number 65280 is a maximum size of COM file, which should fit in a segment size (64k) taking off PSP size (256): 65536 - 256 = 65280. When placing the code at the bottom of the COM file having size about 64K, code may lay too close to SS:SP (for COM files: SS=CS, SP=FFFE) and the program may hang your system when run, because stack might overwrite the code. Therefore, if the spacing between IP and SP is less than 64 bytes, the goat generation is aborted and the goat file is not created (You will see a warning - "Goat IP will be too close to SP. Abort!"). If you absolutely need such a file - use switch /Mnnnn to place code at the very bottom of your file. With /M switch the test is not performed, because if you specify some value in /M switch you probably understand what you are doing! When the size specified in the command line is greater than 65280 (or equal to), EXE file is generated automatically (you do not need to write /E switch explicitly). Such a file will have an EXE header in the beginning. Because of the presence of EXE header, the size limitations are the following: 513 < Size_of_EXE < free_disk_space (with /E switch) 33 < Size_of_EXE < free_disk_space (with /E2 switch) When you need to create EXE file shorter than 65280 bytes, use /E (or /Z) command line switch explicitely. When creating a series of bait files in a "series" mode, the size can exceed 65280 bytes limit at some point. All files longer than 65280 will be automatically turned to default EXE files (i.e., with a standard 512 bytes 'MZ' header) and file extension will change to .EXE. ┌─────────────────────────────────┐ │BAIT FILES INTERNALS AND PRINTOUT│ ──┴─────────────────────────────────┴───────────────────────────────────────── The sacrificial goat file itself contains a small program, which displays its type (COM, EXE or SYS), size in hexadecimal and in decimal (only when goat file is of enough size, i.e., space for code itself is at least 74 bytes). Sacrificial goat file consists of the two parts: the small portion of code (of fixed size, always being 2 bytes or 74 bytes) and a block of zeroes, NOPs or pattern of variable size (00..FF, 0000...FFFE or random pattern). Zeroes (NOPs or pattern) take all space of the file, free from the code. EXE files have additionally an EXE-header. Non-used part of the EXE header is always filled with zeroes. SYS files have SYS header, strategy and interrupt routines in addition to the code given below. Two types of code can be placed into the victim file (COM/EXE). They are given in the table: ┌───┬────────────────────────────────────┬───────────┬───────────┐ │ # │ Code │ Size, dec │ Size, hex │ ├───┼────────────────────────────────────┼───────────┼───────────┤ │ 1 │ int 20h │ 2 │ 2 │ ├───┼────────────────────────────────────┼───────────┼───────────┤ │ 2 │ This code just prints message │ ~80 │ ~50h │ │ │ with the file type/switches/size │ │ │ ├───┼────────────────────────────────────┼───────────┼───────────┤ │ 3 │ This code apart from printing │ ~256 │ ~100h │ │ │ a message selfchecks the size │ │ │ │ │ of host goat file and reports │ │ │ │ │ the size changes (if any) │ │ │ └───┴────────────────────────────────────┴───────────┴───────────┘ Dots (/....) in the message printed by the goat file are replaced with 4 last command line switch letters. Any switches specified in the INI file are not included. All command line switches modify this field (namely - ABGIJKLMNOPRTUVWXZ!#279). Switches that change the mode of GOAT.COM operation (namely - CDEFQY) are not reflected. Switches /E,/Y are not reflected because file extension (EXE) or printout (SYS) is itself an obvious indication. The output of a sample goat file (the size of the sample was 100 bytes and command-line switch /B was given) will be the following: "Goat file (COM/b..). Size=00000064h/0000000100d bytes." File type (COM/EXE/SYS), real numbers and switch letters (if any) are inserted into the goat file message at the moment of creation. ┌───────────┐ │BAIT NAMING│ ──┴───────────┴─────────────────────────────────────────────────────────────── Usually GOAT.COM generator creates output sacrificial files in the following order: GOAT000.COM, GOAT001.COM, GOAT002.COM, etc. The same applies to EXE files, and the order is ascending: GOAT000.EXE, GOAT001.EXE, GOAT002.EXE, etc. If some file in a row (say GOAT050.COM or GOAT050.EXE) already exist - the next file number is selected automatically (it will be GOAT051.COM or GOAT051.EXE). This does not apply to SYS files (i.e., GOAT000.COM and GOAT000.SYS are allowed). This naming strategy is used to give some freedom to companion viruses. Switch /Qnn is used to make it more difficult to virus- writers to build viruses which avoid infecting the goat files using the presense of digits in the filename. If, say, you specify /Q65 in a command line (or in the INI file) all generated goats will have 'AAA', 'AAB', 'AAC'... instead of '000', '001', '002'... You can use any char if its ASCII code is in the range [33; 126], but note that some characters are not allowed by DOS (like ":\><|/."). Such characters will be simply skipped. GOATSET.BAT produces 52 files of the same size. There will be 12 COM, 34 EXE, 2 SYS and 4 SYS-EXE files. GOATSET.LOG is created after each start of GOATSET.BAT. Inspect this log file (GOATSET.LOG) file in order to get the report about the internal structure of generated files, the error messages, etc. Note, that definitions, given in the INI file may change default file (and sudbirectories) naming. ┌──────────┐ │EXE HEADER│ ──┴──────────┴──────────────────────────────────────────────────────────────── By default, EXE header is 512 bytes in size. You can change EXE header size using /E switch with parameter. For example, /E2 produces shortest possible 32-byte EXE header. Size of EXE header is limited to about 32k. By default, EXE header starts with 'MZ' signature. Use /Z switch to make 'ZM'. When the sacrificial file is less than 256K bytes, the first two fields (pages and remainder in the last page) are assigned according to the real file size. But when code is placed at the beginning of bait file and when the limit of 256K is exceeded, the number of pages is set to 2 (EXE header size plus code size) and code on the last page is set to 64 bytes. This technique makes an "overlaid" EXE file. It is absolutely needed to enable execution of files bigger than the amount of free conventional memory (say, for execution of a 700K file or a 10MB file). Switch /O does not affect the internals of EXE files smaller than 256K. If you specify /B switch (or /Mnnnn or /Knnnn switches), the overlay creation mode is automatically turned off (same as if you write /O in the command line). Otherwise, the code (or stack) will be unaccessible and such a file will not run (DOS will give error message, when attempting to start such a file). If you need a goat file with, say SS:SP equal to 400:1234, use one of the following calls: GOAT 4200h /K1234h GOAT 4020h /K1234h /E2 Value of SP=1234h is obvious. To calculate file size take needed SS, multiply it on 10h (to convert paragraphs into bytes) and add 200h (bytes in standard header) or 20h (for short EXE header). ┌──────────────┐ │DEVICE DRIVERS│ ──┴──────────────┴──────────────────────────────────────────────────────────── To create device driver (SYS) file use switch /Y. Device driver file can be in two formats - simple driver (a'la COM file) and EXE-file driver (with EXE header, a'la SMARTDRV.EXE or SETVER.EXE). Files of the first format can only be invoked from CONFIG.SYS and they will print message "Goat file (SYS). Size=..." when DOS requests an initialization of the driver. Second format (SYS&EXE) can be placed in the CONFIG.SYS and can also be invoked from the DOS command line as a normal EXE file. In both cases this driver file prints the same message. Minimal size of the device driver is around 150 bytes (including SYS header). For EXE drivers this limit increases (it should include additionally the size of the EXE header). Note that device drivers, being simultaneously an EXE files, has a "(SYS)" type designator inside, but are always named as .EXE files (to enable execution from the command line as a normal executable file). Such files can exceed 64K only if device driver routine is placed in the first segment of the goat file (because pointers to Strategy and Interrupt routines in the driver header are limited to 16-bits). So, a command "GOAT 70k /y/b" is illegal, but "GOAT 70k /y/m63k" is OK. Default device driver attribute is set to 0C853h (most usable bits are set). You can vary attribyte with /Annnn switch (or even place this witch setting into the INI file to override default setting). ┌──────────┐ │ERRORLEVEL│ ──┴──────────┴──────────────────────────────────────────────────────────────── GOAT.COM returns ERRORLEVEL=0 after the successful operation. GOAT.COM returns ERRORLEVEL=1, when output victim file was not created or if the current operation failed (say, no more space when creating zillions-of-files). The error message will be printed. GOAT.COM returns ERRORLEVEL=2 when user pressed Ctrl-Break (this feature is used in batch file GOATSET.BAT). GOAT.COM returns ERRORLEVEL=3 when selfchecking has failed (Note, that /C switch turns off selfchecking). ┌───────────────────────────────┐ │SELFCHECKING OF GENERATED GOATS│ ──┴───────────────────────────────┴─────────────────────────────────────────── Generated goat files (except SYS files) check their own size by default (this option works only under DOS 3.0 or later). If goat file has been changed - the difference is reported both in decimal and hexadecimal notation: Goat file (COM/....). Size=00002710h/0000010000d bytes. Size change=0CDAh/03290d. If size change is more than 64k - the goat file will print question marks instead of digits: Goat file (EXE/....). Size=00002710h/0000010000d bytes. Size change=????h/?????d. If you wish size change report might be accompanied by a PC speaker's BEEP. Use switch /7 to activate this option. Note that not all infections will be reported - file system infectors (like DIR-II, Byway) will not be detected. Cavity viruses (like BootEXE, Zerohunt) and companion viruses (like Gold Bug, Little Brother, HLLC) will be missed too. Most of the others are caught without problems (please let me know if you find any). To suppress the selfchecking code use switch /S. For example this may be needed to create shorter goats, as selfchecking code is long enough. Goat file returns ERRORLEVEL=0 if selfcheck was OK and non-zero if selfcheck failed. ┌────────────────────────┐ │SELFCHECKING OF GOAT.COM│ ──┴────────────────────────┴────────────────────────────────────────────────── GOAT.COM program checks its own health. Selfchecking has three levels (selectable with /Cn switch): 0 - no checks 1 - check of the file disk image (includes file time stamp and COM extension) 2 - check of the file disk image and of the file size (default level) If the checksum of the file on disk is invalid you will see a warning after program termination: "GOAT.COM altered! Size change=00001000h/000004096d bytes." If you need to turn off file contents checking - use switch /C0 (or simply /C). Therefore, do not try to pack GOAT.COM with PKLITE or similar compressors. That will result in the "GOAT.COM altered!" report. If program file extension is not COM you will see (if switch /C is not specified): "GOAT.COM altered by companion virus!" All selfchecking is automatically turned off (same as /C0) for DOS versions prior to 3.00 (because the location of the original file on disk cannot be found). ┌─────────────────┐ │PATCHING GOAT.COM│ ──┴─────────────────┴───────────────────────────────────────────────────────── This paragraph is for experienced users only! Do not try to modify GOAT.COM if you do not 100% understand what is written below. Although the core of the GOAT.COM program is protected from modification (partial checksumming of GOAT.COM file is done), you can patch the program to better meet your requirements because data area near the end of the file is not checksummed. When doing any of descibed modifications to GOAT.COM preserve the original timestamp of the file - it is checked too. (For example, you can use HIEW to modify the file without touching the timestamp.) Near the eof you can see the code of the created GOAT files (starting with bytes E9 00 00 E8 ...), its messages ("Goat file (COM)" and "bytes." You see also image of the EXE header (4D 5A ...), SYS file code (56 E8 00 00 ...) and NOPS (90 90 90) replacing the jump (E9 00 00) when you specify /J switch. You can patch these areas to make GOAT more unique. That's worth doing because some viruses may start trying to recognize the goats produced by this package and will refuse to infect them. For example, you can set your own MINALLOC, MAXALLOC, CHKSUM fields in the EXE header. You might like to change 90 90 90 to any reasonable and appropriate processor commands (like ex., MOV/INC/ROR/etc.) But still you will have to fit into 3 bytes only! You can also modify "Goat file " string to whatever you want. This will change the message your goats are printing when executed. And again - the size of this string should be preserved. ┌──────────────┐ │AUTHENTICATION│ ──┴──────────────┴──────────────────────────────────────────────────────────── If you have PGP program installed on your machine you can check the authenticity of GOAT.COM file. I include below my PGP public key. It can be used to check the validity of GOAT.COM (even for future versions). -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQCNAiz3uywAAAEEAKRvzeHdrUT1tlgIbpPoVmI51qiDctKIKGlY82cLCsnKs3Mh c0d73bjprJqpgFGy/DmLARJj15FcnTjwT2lS4DCBX/+Um3PMZTUpoDDcHwV+LbC+ CfUf/4vupkjdhqIt8LzFwoPYaPH0wG6Wh3WJpaqYkRsgPQMagzqaFa593YhRAAUR tCNJZ29yIEcuIE11dHRpayA8bWlnQGx0LnBoeXMubXN1LnN1PokAlQMFEDL/TBE6 mhWufd2IUQEBRIUD/0hZPyvKyKn7kmyJ2k9JPyAOAzjMjM6UHGpLx3A1XaF2R0ia amkYfm1xCHYsp82wmBhyROImpE7DurU1k/KmxuMPS8UifxsE3NkwUnc1NRH7VOvc lH/Pa9nfQ/lItMQNEcr9DQOYmCl3uI+taXW4Wog43spFyCNNLWti3aHgMGBetCNJ Z29yIEcuIE11dHRpayA8TUlHQGx0LnBoeXMubXN1LnN1PokAlQMFEDLmEDdQK/tU ud7FuQEB6AYD+waV+Ji92OWh22mnZdoBsdPXEbkRCh2J0+KTCqtFtZ6GdNBSxaFi 4wpPgqkxlMIwDtRZLU/dl+NSKzhk45EDU5f6blM5OnhC32b1BlnFY99jzfsM4xAT aVDWnCn+zhnshIcU8elTgz1p/y3GJhGyxCw9lEAa26XBWtSSdmS/SpygiQCVAwUQ MW0uxDqaFa593YhRAQE/HgP/dc+nrly5FKbpEF5vLN/5WvKt2JXGoY2Y3/UdZBCT HQr5BKMGhnvwnArdagi+fgdHhzNgsrxp1n5FT5piyzwsKBSQOAw5YCgpNqpwD5XN /XiMjXgEkSJiST1didLrelHw8xmE96VjWDFvtdy/q0QAjjkLNLNWxoyvg+tYIkxa Gg2JAJUCBRAs+z1cMIAgxAYM3PEBAQbGA/9sIuNXpUhhk0j+oSc5s8+xHBVwxa9B 9Atu926CoxavNrzXjQMvSS0pKcszuH2ZkLto0FGs5X7+8DGtfMi01K/yHRxHlsFJ vrChfv/Qm8ADCUCkl12Fz5uR2Nd11LcR+iqmuS5U5kByxGnUsPAKErVdqSPpPVAW cGJiTsrONyTwNokAlQIFEC7bAyY2VpfGMt2Y2QEBjTAEAJGSlkFtC2zHN4IDKQKb g+4aFiOmBfclfTv64PgXPmkTL8IAZ10HZYKm75H6+zZ+/9j5ZgLQeUz+GEq+qJXH MigNIdHbIRwi4ny9SFMi+oyzA78GMqJtUkUAg+RXziQC4xxf9GE+8PXq7b17dsb8 5WzlX9HC4IOyYJ3cN5XnVsIFiQCVAgUQLXMOD5qVRRb01TllAQGZJwQAw0qxT4HC iGF+oYdXnwGuFj5xHCvMgk+V199LMn7kNOpIbmdOK6vLaa/pDDHkyMnaPlTOSlsG QwWqJjodnIXFs7NglYfRlN9zfKQcV9zoMxhWBmjpdkL2CJsq13Rh0ttLnHVSQZCW timEMBfN6xAFQIWFZJDSE+fgkwTK9Sk4XHW0HjxJZ29yLk11dHRpa0B1ay5kcnNv bG9tb24uY29tPokAlQMFEDL/SUI6mhWufd2IUQEBWEwD/3w60OlWajPMgqaKEue8 tGB5W4jBanWamRxQvTGJDT8+e1FSOiC+flIPyHRtJxDBvnbFqjG7Ls4H7bE8NjXk fO2nL2anYefQyN+hXm5ninbWq2lRQJjJQrUn03EszwyBIfmqMMLejxfVHIiIMdcG 76datnxIhFdEOuTrDQ0dCBKTtBU8bWlnQG1pZy5waHlzLm1zdS5zdT6JAJUDBRAy 5g9mOpoVrn3diFEBAa8NA/9keCujOMshcp9JoO73X6OWBaajHoTCZfdC14SaBSkH 22zafIWtEZSF2mCoKt3TGdNHoZnNZOjQ1yfPdm9bUO4pfw43+XT5mxyo0RDnMa8d rkc4pMJ2qvorz+HR/Ed4lo5E+RhoUXfVazivLPTPUaCDzSKttEkenZ+7AWcZqOhT MbQVPGlnb3JAZGlhbC5waXBleC5jb20+iQCVAwUQMuYOozqaFa593YhRAQHYwwP8 DeRVwKVaNPcgULB8Wx3Ag1gnLSV5sm6Jm59pck9+5Unbe+tFgCzeWSBK+qzHjFau yAgVvmkqOWf/7ioEnLW7XGhDA1bI0mYYkNLvXlKlXCDqIVVegyOZsjw3B6Q8IhUp 1SxwZlC9CvgodEiDZwnHC+h2GgSRnYkfHt4wJIzHBUk= =bfzJ -----END PGP PUBLIC KEY BLOCK----- Provided PGP key has some signatures of well-known antivirus people but if none is recognized - feel free to contact me to check the validity of this public key). You can also try "finger mig@mig.phys.msu.su" to get my PGP key. First, add my public key to your PGP keyring: PGP -KA GOAT.DOC To check the validity of GOAT.COM use the following command: PGP GOAT.ASC GOAT.COM ┌────────────────────────┐ │VERSIONS ON THE INTERNET│ ──┴────────────────────────┴────────────────────────────────────────────────── I would be happy to send the latest version of GOAT package to everybody who needs it. Do not hesitate to contact me personally via Email. Copies of the program are available on Simtel, Garbo and their mirrors worldwide. You can usually download the latest copy from: ftp://ftp.informatik.uni-hamburg.de/pub/soft/virus/progs/tools/goat42.zip ┌───────┐ │HISTORY│ ──┴───────┴─────────────────────────────────────────────────────────────────── Version 4.2 - A bug with /Qnn switch was fixed. The bug demonstrated itself only when more than 10 files were created in one subdirectory. Version 4.1 - DOC file was slightly rewritten - false alarm of McAfee SCAN was found ("STRAT.486" - see below "BUGS" section). Version 4.0 - All programs were joined into one - GOAT.COM. Goat file output changed - now it includes the printout of switches used when created this file. All limitations on the number of files (used to be 1000) were removed (now, after 000...999 go AAA...ZZZ, etc.). New switches introduced - /Qnn, /Gnn, /L, /!, /#, /7. Redefined switches - /W, /X, /S. Parameter added to switches /Enn, /Rnn. Goat code is now able to selfcheck the goat file. GOAT.COM now checks its own size/checksum and reports the change (if any). Version 3.1 - Some small improvements were made: programs now do not report "Your PC might be infected" under Novell. New switch /U introduced. Switch /D behaviour was improved. And, finally, EXE header now contains 1C as an offset of relocation entries list (although the list itself is empty; helps to handle a couple of viruses, which need non-zero word in 001C). No bugs were reported for more than a year since release of 3.0 so no fixes were needed. Version 3.0 - Goat file contents changed - the string, indicating type of goat file, added to the printed message (COM/EXE/SYS). Device driver creation mode added: switches /Y (make SYS file) and /Annnn (set device attribute) appeared. "SYSname=" definition added to the INI file processor (this name appears in the SYS file header). Help screen redesigned - now switches are listed in the alphabetical order. FLOCK.COM, when running on an almost full drive entered very long loop - corrected. GOATSET.BAT creates now 6 device driver files. Version 2.1 - Motto string added to the INI file. INI file processor allows quoted strings now in the "Motto=" and "STACKfill=" definitions. New switches /N[nnnn] (random fill with possible seed definition) and /X (supress Motto string defined in the INI file) added. GOAT.INI was not found by FLOCK and GOATS thru path, fixed. Version 2.01 - Some portion of code (common to GOAT, GOATS and FLOCK, version >1.5) alerted F-Prot (it reported "Probably new variant of BootEXE"). I rewrote it in order to avoid this false alarm. Version 2.0 - INI file processing added. FLOCK.COM appeared instead of FLOCK.BAT. FLOCK.COM switches /F (# of files in dir) and /D (max # of subdirectories) appeared. Selfchecking level added (switch /Cn). Switches /O and /V do not force EXE now (to allow including /O, /V into INI file). Word pattern (/W) fixup corrected. GOATSET operation (when GOAT.COM selfcheck fails) was corrected. Version 1.6 - Switches /K, /M, /W, /C, /I added. Many enhancements in the code were made. Selfchecking is double now (in-memory copy and file on disk), check for companion virus infection added. Rare conflict of /R and /T switches fixed. Removing of non-fully created readonly files fixed. Version 1.5 - Switch /P (pattern fill) added. Selfchecking of timestamp added. /J/B/E or /J/B/S forced NOP-filling for EXE files, corrected. When making a series of files with GOATS.COM on 5 (and 67) byte boundary, additional JMP appeared even with /J switch, corrected. Version 1.4 - File numeration changed, it is common for EXE and COM files now. Ex., if GOAT000.COM exist, created EXE file will be GOAT001.EXE (to give some freedom to companion viruses). Version 1.3 - Added switch /Tnn. Bug with attribute in GOATS fixed (always set 0000, even with /R switch). When modified, GOATS.COM reported "GOAT.COM probably infected!", corrected. Minalloc field in EXE header changed to zero (ver. <1.3 always set 20h). Version 1.2 - DOC file written. BAT files FLOCK and GOATSET added. Decimal printout of goat file size added. Added rotating symbol "|" (when creating goat files longer than 64k). Selfchecking added. Version 1.1 - Many switches added (/S,/O,/B,/J,/Z,/V,/9,/R). Version 1.0 - First version, without documentation, supported only switch /E. No decimal size in the printout of goat files. ┌────┐ │BUGS│ ──┴────┴────────────────────────────────────────────────────────────────────── All EXE files >=1024k, created with /O and /E2 switches (short header, not overlaid) hang old DOS versions (<5.0) upon execution. For a very similar file with normal 512- bytes header, DOS behaves normally. It reports "Program too big to fit in memory" or "Cannot execute GOAT000.EXE". This DOS bug is no longer present in DOS 5.0 and 6.0. Old DOS versions were obviously confused with such a strange goat file (the file without overlaid structure and greater than 640K cannot fit into DOS memory and have no real sense). DOS should report a load error, because a load size is definitely >640K. Unfortunately it hangs instead. One known bug: if EXE file generated is longer than 1MB and code is at bottom (ex., 1025k /e/b) - CS:IP will be assigned incorrectly. But I do not feel like correcting this as DOS cannot load/execute such files anyway. Some versions of McAfee SCAN (at least 2.5.2 dated September 1996) produce a false alarm ("Found the STRAT.486 virus") in all SYS files created using GOAT package and in the GOAT.COM generator itself (versions 3.x and 4.x). The alarm is caused by the code responsible for creation of the SYS files. This has been reported to McAfee and fixed in November 1996 release 2.5.2 of McAfee SCAN. ┌───────────────┐ │ACNOWLEDGEMENTS│ ──┴───────────────┴─────────────────────────────────────────────────────────── I am greatly acknowledged to Frans Veldman (Esass, the Netherlands). Discussions of some aspects of a goat file generation were very fruitful. I also got some useful suggestions from Igor Danilov (Sald, St.Petersburg) and Vesselin Bontchev (FSI, Iceland). I benefited from the usage of HIEW.EXE (Hacker's View) program by Eugene Suslikov. HIEW.EXE, being the viewer of an executable files, is very useful for the examination of the contents of goat files. I recommend HIEW for all users of GOAT package. Try the following Internet URLs to get a copy: http://palantiri.spb.su/English/Misc/GSS/toolsoft/hiew.html http://www.kiarchive.ru:8098/msdos/sys/hack_tools/ ftp://ftp.cdrom.com/.2/dresden/edit/hiew524.zip ┌──────┐ │FLAMES│ ──┴──────┴──────────────────────────────────────────────────────────────────── Send flames, questions, etc. directly to the author (preferably via Email). All ideas, comments and corrections will be appreciated. Sorry for possible errors in this manual - English is not my native language. ┌──────┐ │AUTHOR│ ──┴──────┴──────────────────────────────────────────────────────────────────── Dr. Igor G. Muttik Virus Laboratory Dr Solomon's Software Ltd. Alton House, Gatehouse Way Aylesbury, Bucks, HP19 3XU United Kingdom Email addresses : Igor.Muttik@uk.drsolomon.com MIG@uk.drsolomon.com igor@dial.pipex.com MIG@mig.phys.msu.su MIG@lt.phys.msu.su MIG@sands.co.uk Phone: +44 1296 318700 ext.2756 Fax: +44 1296 318734