Mutation Engines
by
JHB
Since I first heard about the idea of a Mutation engine I was
interested to see the code that would explain how such a devious piece of
code could work. I had taken apart several viruses, but most mutation
engines due to thier nature are difficult to dissassemble. So after
seeing other people's code I decide to try my hand at this type of coding.
This article will illustrate the path I took in designing and building a
Mutation Engine.
To start I will try to define what a Mutation engine is, its code that
can be link or added to a regular program or virus that will:
1 Encrypt itself as well as the program that is linked to it
2 Create a Decryptor that will be run first before the main program
3 Each Decryptor that it creates has a different signature
Ok, now lets explain the defination, a signature (when refering to code)
is a piece of code that should be unique to that code. An example of this
is the signature:
EA 05 00 C0 07
Which is the hex code for
jmp 07c0:0005
This (which some may reconize) is the first line of code for the Stoned
virus though it is short piece of code, placing this piece of code in the
first part of the boot sector use to cause many Av products to false
alarm. (not tested lately)
Now a true mutation engine could alter this code to some other code
that would accomplish the same thing, though this is possible it would
make the engine huge. Mutation Engine writers have taken a easier way out
they encrypt the main code and the engine then put a decryptor as the
first thing that is run.
This means that the only signature that has to alter is the decryptor,
this is the main type of engine that is created these days.
The first part of the creation process is to create a
encryptor/decryptor that this should be fairly simply encrytion. I played
with the standard xor/add/sub but they were spotted immeditaly by TBAV and
F-prot as encrypted code. Since the main idea of a mutation engine is to
fool both people and scanners this was not a good start. Well while
reading the usenet group I saw a mention of a encryption that uses
shl/shr. Many people may wonder if you use a shl/shr the leading bit or
end bit is lost this is not true it is moved the carry flag. By simply
adding this to the front or end of the register (or word) you can have
reversible encrytion. Now TBAV will find most of these except for even
number shifts like 2,4,8 while F-prot seems to miss most of these( only
in heurstices and the /parnoid). (I was told this is because the shl 2,4,8
code can also be used as a quick multiply or divide, so tbav will not flag
this encryption). So I soon had this as a decryption module
mov bx,offset virus_code
decrypt:
mov cx,4 ;encrytion key
mov ax,cs:[bx] ;get the word to encrypt
again:
clc ;not needed I was young forgive me
shl 1 ;ok so ax before this code is
; ax 1000 0000 0000 0000 cf = 0
;after the shl
; ax 0000 0000 0000 0000 cf = 1
jnc no_high_bit ;
inc ax ;this simpy makes ax =
; ax 0000 0000 0000 0001
no_high_bit:
dec cx
jcxz done_unencr ;ok done shifting it again
jmp short again ;shift it again
done_enencr:
mov cs:[bx],ax ;Store the decrypted code
add bx,2 ; move our pointer
dec dx ;track how much is left
jnz decrypt
virus_code:
Ok, so there we have a decryptor now use a shr and you have the
encryption routine (its in the code read it ;) ).
Ok now at this point I have a encryption engine that will fool TBAV
and F-prot ( unless you use the f-prot /paranoid which the average user
just does not do) but this is not a mutation engine. Well one simple
mutation is to change the registers its a simple thing just requires some
research that debug or a decent assembly book will show. All assemble
instructions are built in a pattern take
push ax which in hex is
50h or 1001 0000b
now
push bx is
53h or 10010 011b
note that the 3 last bits are they only thing that changes this follows
through so that for the word registers
ax = 000 0
cx = 001 1
dx = 010 2
bx = 011 3
sp = 100 4
bp = 101 5
si = 110 6
di = 111 7
Ok so with some simple and/or instruction we can change the registers
any other register of course we must not just randomly change registers
we have to track which register we have use and make sure that we change
all bx to cx.
This is where some people start to get lost because we start treating
code we are going to run as data. Take this example:
mov cx,0004 ;b90400h
becomes
shift_reg:
db 0b9h ;10111 001 <- cx
dw 0004
Now the mutation for this code might look like this
mov ax,[shift_reg] ;
and ax,11111000h ;this will isolate the mov
;instruction
or ax,00000111 ;this would make the instruction
;mov di
A better way would be to use a random number generator and get a number
between 0-7 then OR that into it rather than the constant I used. Of
course you must track what registers you use as you go.
Now using this technique we have a limited mutation engine and just so
you do not forget F-prot still catches it. So the next simple mutation use
a sorta undocumented form of the shl instruction.
shl AX,1 D1 E0 1101 000 1 1110 0000 <-USUAL CODE
SHL AX,1 D1 F0 1101 111 1 1110 0000 <-UNDOC
SHL AX,1 C1 E0 01 <-USUAL CODE
SHL AX,1 C1 F0 01 <-UNDOC
D1 F0 <-APPEARS THAT NEITHER FP OR TB FIND IT
Now the unuasual part while all of the above code does the same thing
shift the bits in the AX reg left the ones with the F0h are not used by
many assemblers. (Though I have read that a shareware Assembler may use
these codes maybe to track code that was produced by it). Using the
"undocumented" form will fool f-prot every time but the c1 f0 01 will flag
tbav with (and I love this flag) " 1 found instruction that will require
an 80186 processor or above" Like they have add no instructions to the
code set after the 8086!! But for a virus generated code this would not be
a flag you want. Since any flag that was not there before will cause a
problem.
Ok so we have a simple mutation a reversible simple encryption and at
least 4 forms of the decryptor code not including the mutation of the
registers. The next part is to add do nothing or noise code. This is
where careful creativity comes into play. Noise instructions or Do
nothing bytes are instructions that actauly do, do something they just do
not affect your code. NOP, XCHG AX,AX are some examples of do nothing
code. In the early days of mutation engines and herustic scanners just
adding nops and xchg code could make the virus unscannable. But as
scanners improved they now will watch for such do nothing code, either
ignoring it and seeing the real code or warning the user that there is
code that serves no purpose but to hide a virus. Again I found that you
could use some of these ideas say 1 or two nops in a row but too many and
TBAV went to red alert. So I thought instead of using just one byte
instructions why not have routines that called interrupts. just find
ones that do not affect to many regs or put push regs code pop regs this
way none of the real code is affected. An Example
noise_6:
push ax ;1 get the shift flags only affects the
mov ax,0200h ;3 ax reg so push it then pop it.
int 16h ;2
pop ax ;1
end_noise_6:
Combine all these ideas togther and you can have an interesting piece
of code that will produce several differnt variations on the decryptor.
Well thats about all for me. If your realy interested in fooling with
making a mutation engine get ahold of of as many source codes as you can
and examine them then attempt one on your own. Even if you fail in
making a viable mutation engine you will understand them far better. I
did not bother to make my code a true engine its an example thats all.