ÜÛÛÛÛÛÜ ÜÛÛÛÛÛÜ ÜÛÛÛÛÛÜ ÚÄ Fuckin' AVs in Win32 enviroment Ä¿ ÛÛÛ ÛÛÛ ÛÛÛ ÛÛÛ ÛÛÛ ÛÛÛ ³ by ³ ÜÜÜÛÛß ßÛÛÛÛÛÛ ÛÛÛÛÛÛÛ ÀÄÄÄÄÄÄÄÄÄÄÄ Benny / 29A ÄÄÄÄÄÄÄÄÄÄÄÙ ÛÛÛÜÜÜÜ ÜÜÜÜÛÛÛ ÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛ ÛÛÛÛÛÛß ÛÛÛ ÛÛÛ ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ 1. Disclamer ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ The followin' document is an education purpose only. Author isn't responsible for any misuse of the things written in this document. ÚÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ 2. Foreword ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÙ Nowadays, when we r able to infect any Win32 executable file, when heuristic scanners r better and better and when AVs r able to find 100% of all known viruses, it is very important to make our virus harder to detect by AVs and unnoticable by user. What technologies should I use? This article is all about them, but do not expect any code here. Everything written and described here is 100% theoretical... ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ 3. Introduction ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ There r many ways, how to hide virus and make it able to survive in the wild. Nowadays viruses uses these techniques: - Polymorphism - Metamorphism (will be very discussed theme in near future) - Stealthin' - Anti-Bait - Anti-Heuristix - Anti-Debug All these techniques, their positives and negatives, r discussed bellow. ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ 4. Polymorphism - hi-tech of 80's/90's ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ Every good virus uses this technique (Win98.HPS, Win95.Inca, Win32/WM.Cocaine, my best virus Win98.BeGemot, etc). It's one of many ways, how to hide virus in infected file. Polymorphism means, that every new generation of virus is encrypted by another encryption/decryption key and/or aritmetical/logical intruction and decryptor has another code than in previous generation. The only way, how to detect polymorphic virus is heuristicaly. AV scanner won't find it, becoz there ain't string, that matches at all virus generations. Heuristic scanner will try to trace decryptor, so decrypt virus body and then will call scanner, which will scan decrypted code for string, that it knows. "Another decryptor" means, that decryptor will decrypt encrypted code by same way, but usin' different opcodes. Example: U can increment register by INC, ADD SHORT +value, ADD NEAR +value, SUB SHORT -value, SUB NEAR -value etc... If AVers will want to catch our virus, they will infect thousands of baits and catch a scan string. That scan string will use scanner to scan decrypted code. Our virus is found! Let's make job to AVerz harder. Solution is slow polymorphism. If we use only one decryptor shape for session, AVerz will have to reboot their computer many times to see all engines abilities and so to get scan string. And if AVerz won't infect enough files, they will get scan string, that will work only for some virus generations and next generation, that will have wholy another decryptor won't be detected. Yeah, yeah, that's cruel X-D. But what will happen, if AVs will make enough files and get right scan string? Heuristic scanner will leave decryptor to decrypt virus body and scanner will find virus usin' scan string. What then? Last thing, how can u make harder to detect your virus by poly-engine is makin' your poly poly-layer. It means, that decryptor won't be one, but two, three and more. It will be harder to decrypt too many layers, nevertheless new heuristic scanners r able to work with poly-layer polymorphic engines. What then? ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ 5. Metamorphism - new technology of the fate ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ Metamorhism is the solution. Metamorhism (as I think) is the perfect technology to fuck all AVs. Since polymorphic engine will create only variable decryptor, metamorphic engine will create variable whole code. This ain't easy to code. This ain't hard to code tho. I think, it's one of the hardest things on virus codin'. If u wanna code some meta-engine, u will have to calculate all possible fails, u will have to be very patient and be very smart, otherwise u won't ever finish it. In metamorphism is the future. Every generation of virus will have another shape and the only one solution will be heuristic analysis. But not analysis of these days. That analysis must have at least a little inteligency. But, that's another story... ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ 6. Stealthin' - I'm not here ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ Stealth is way, how to hide virus presency. Semi-stealth viruses hides file size only, so users won't detect any changes - file has still same length. That's nice, but how many users r watchin' file sizes? Minimum. Win95.Zerg came with thing well known from D0S, full stealthin'. Program is fully disinfected on open and infected on close, so user nor AVs will detect any modifications. It worx perfect, but only on Win95 machines by hookin' IFSMGR. On WinNT not. There is one little problem. Files and all kernel objects r closin' by common CloseHandle API. Problem is that we can't check, if the handle handles file or not. I was thinkin' about GetFileType API, that can tell us, what type of file it is. If we used invalid handle, API quits with error. Well, we could check by this if it is file or not and infect it. I haven't tried it yet, but I think it should work fine. If u will experiment with it, let me know. Thnx. However, stealth mechanism seems as very good technique to hide our virus. In Win95/98/NT/32 enviroments, AV won't detect virus, if virus will be in memory, and AV won't be able to use any ANTI-STEALTH techniques tho. It will seem, that all files r clean. That's great, ain't it? ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ 7. Anti-Bait - Why da fuck it can't be infected? ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ Baits r mostly silly do-nothing programs and the only one purpose of their existency is to be infected by virus. That program can be easily analysed, easier than winword.exe, for example. And becoz we wanna make job to AVs as hard as possible, we r tryin' to not infect those shitty programs. Baits r usualy named as 00000000.EXE, 00000001.EXE, 00000002.EXE, etc. The first advice is don't infect files with digits in its name. But take care! Many normal programs has digits in its name, such as winrar95.exe or wincmd32.exe. So, if u don't wanna infect baits, but wanna infect standard applications, check, if filename contains digits at all 4, 6 or 8 positions. How easy...X-D ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ 8. Anti-Heuristix - This proggy is OK ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ Heuristic emulator, what da fuck is that? Emulator is program, that simulates execution of opcodes. If it will find something suspicious, flag will be set. If there r many flags set, program is probably infected by virus. And becoz heuristic analysis was at least perfect idea, we have to fight against it. Anti-Heuristix is a strong weapon. Every virus should contain several trix to fuck some AVs. Perfect trick, how to fuck many AVs is to use SEH and make some GP faults. I think, none of all AVs has 100%-ly solved this "problem". Every AV will hang on that. Next trick is usin' of undocumented/Pentium+/MMX opcodes. Many of these opcodes aren't emulated, so if emulators will try to emulate it, it will get invalid opcode and won't continue emulatin' next opcodes (or will emulate it, but with wrong results). Next, more kewl idea is to use threads or fibers. Emulator will emulate code, but won't reach important (virus) code, that will be executed in another thread/fiber. There r many ways, how to make your virus heuristic-proof. Just open one article from any VX-zine and read. ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ 9. Anti-Debug - Let's fuck AVerz ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ Debuggers r made to debug programs. Logicaly. But becoz viriis r computer programs, AVerz r usin' to analyse our viruses debuggers tho. That ain't good. Fortunately, there r many ways how to check for debug presency (and then do something really baaaaad X-D). First way is the most legal. Use Win98/NT IsDebuggerPresent API. This API will say u, if aplication level debugger is present or not. Next trick is usin' SEH. TD32 will continue executin' code until it will reach any breakpoint. If stupid AVer won't set any breakpoint, whole virus will be executed X-D. Easier way, how to fuck debugger is to jump INTO the instructions. If AVer won't carefuly trace code, he could encounter something really strange and weird...8-). And again, there r many tutes describin' this, just find one and read it... ÚÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ 10. Closin' ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÙ That's all for this time. I hope u understood everything described above. If not, u know, where u can find me. ÚÄÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ» ³ Benny / 29A, 1999 º ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ