return To index

Visual Basic .NET Source Code Infection
---------------------------------------
alcopaul/brigada ocho
may 16, 2011


Intro
-----

Source code infection is not new, but it is interesting to implement especially in new
languages. So far, there has been no appearance of a Visual Basic. .NET source code infector 
on the internet, until now.

Simple Method
-------------

A VB.NET source code infector can just copy itself to all *.vb files with "Sub Main()" or "Form_Load()"
in the hard disk. But we don't wanna do that. Why? To make things elegant (hehehhe) and to save the 
virus some computing time. We don't wanna read *.vb files that are uninfectable (*.Designer.vb, 
AssemblyInfo.vb and other .vb files that are usually within \My Project folder).

Our Method
----------

We can make our virus

1.) Search for a Visual Project file (*.vbproj) to ensure that there are compilable VB.NET projects
in the harddisk. A .vbproj file is an xml file that contains information about a project. Important
keys are Project/PropertyGroup/StartupObject and (Reference Include="namespace" /).

2.) Parse a .vbproj file and get the value of Project/PropertyGroup/StartupObject. The possible
values are:

    a.) (Anyname).My.MyApplication - A Windows Forms Application and the Startup Class name is stored
        in .\My Project\Application.myapp. In Application.myapp, the key MyApplicationData/MainForm 
        holds the Startup Class name.  
    b.) (Anyname).(ModuleName) - A Non-Forms/Console Application and the the Startup Module name is \
        (ModuleName). Most likely to contain a Sub Main().
    c.) Sub Main - Most likely a Console Application that starts on Sub Main().

3.) After it acquires the project type (Windows Form which probably has a "_Load(" or A non-Form/Console
which probably has a "Sub Main()"), examine the *.vb files that comes along and is usually in
the same directory with the .vbproj file.

4.) If the project is a Windows Form, check a .vb file for the Startup Class Name. If found, the file 
is set up as a startup and most probably contain a "_Load(". To be sure, check again for "_Load(".  If 
found, it means we can infect the file. Otherwise, examine next .vb file.

5.) If the project is a non-Form/Console, check a .vb file for the Startup Module Name. If found, 
the file is set up as a startup and most probably contain a "Sub Main()". To be sure, check again for 
"Sub Main()". If found, it means we can infect the file. Otherwise, examine next .vb file.

6.) Infect the file. Read the source from itself then write to the .vb file.


How Is This Possible?
---------------------

When we run a source in the IDE, it is compiled in the IDE and the resulting .exe is run. The .exe
generates the source code from itself (through quining) and does the file searching and infecting.

Demo Code
---------

A demo code comes with this article. Check it out in the Sources section.

Conclusion
----------

Visual Basic .NET source code infection is not rocket science. Go search a programming language and make
a source code infector.