GPGPU using OpenGL roy g biv / defjam -= defjam =- since 1992 bringing you the viruses of tomorrow today! About the author: Former DOS/Win16 virus writer, author of several virus families, including Ginger (see Coderz #1 zine for terrible buggy example, contact me for better sources ;), and Virus Bulletin 9/95 for a description of what they called Rainbow. Co-author of world's first virus using circular partition trick (Orsam, coded with Prototype in 1993). Designer of world's first XMS swapping virus (John Galt, coded by RT Fishel in 1995, only 30 bytes stub, the rest is swapped out). Author of world's first virus using Thread Local Storage for replication (Shrug, see Virus Bulletin 6/02 for a description, but they call it Chiton), world's first virus using Visual Basic 5/6 language extensions for replication (OU812), world's first Native executable virus (Chthon), world's first virus using process co-operation to prevent termination (Gemini, see Virus Bulletin 9/02 for a description), world's first virus using polymorphic SMTP headers (JunkMail, see Virus Bulletin 11/02 for a description), world's first viruses that can convert any data files to infectable objects (Pretext), world's first 32/64-bit parasitic EPO .NET virus (Croissant, see Virus Bulletin 11/04 for a description, but they call it Impanate), world's first virus using self-executing HTML (JunkHTMaiL, see Virus Bulletin 7/03 for a description), world's first virus for Win64 on Intel Itanium (Shrug, see Virus Bulletin 6/04 for a description, but they call it Rugrat), world's first virus for Win64 on AMD AMD64 (Shrug), world's first cross-infecting virus for Intel IA32 and AMD AMD64 (Shrug), world's first viruses that infect Office applications and script files using the same code (Macaroni, see Virus Bulletin 11/05 for a description, but they call it Macar), world's first viruses that can infect both VBS and JScript using the same code (ACDC, see Virus Bulletin 11/05 for a description, but they call it Cada), world's first virus that can infect CHM files (Charm, see Virus Bulletin 10/06 for a description, but they call it Chamb), world's first IDA plugin virus (Hidan, see Virus Bulletin 3/07 for a description), world's first viruses that use the Microsoft Script Encoder to dynamically encrypt the virus body (Screed), world's first virus for StarOffice and OpenOffice (Starbucks), world's first virus IDC virus (ID10TiC), world's first polymorphic virus for Win64 on AMD AMD64 (Boundary, see Virus Bulletin 12/06 for a description, but they call it Bounds), world's first virus that can infect Intel-format and PowerPC-format Mach-O files (MachoMan, see Virus Bulletin 1/07 for a description, but they call it Macarena), world's first virus that uses Unicode escapes to dynamically encrypt the virus body (Unicycle), world's first self-executing PIF (Spiffy), world's first self-executing LNK (WeakLNK), world's first virus that uses virtual code (Relock, see Virus Bulletin 3/10 for a description, but they call it Lerock), world's first virus to use FSAVE for instruction reordering (Mimix, see Virus Bulletin 1/10 for a description, but they call it Fooper), world's first virus for ODbgScript (Volly), world's first Hiew plugin virus (Hiewg), world's first virus that uses fake BOMs (Bombastic), world's first virus that uses JScript prototypes to run itself (Protato), world's first virus that uses Heaven's Gate for replication (Heaven, see Virus Bulletin 12/11 for a description, but they call it Sobelow), world's first virus for 010 Editor script (To_Be), and world's first truly polymorphic Batch virus (Polymer, see Virus Bulletin 5/12 for a description, but they call it Lymer). Author of various retrovirus articles (eg see Vlad #7 for the strings that make your code invisible to TBScan). This is my ninteenth virus for Win32. It is the world's first virus that uses the GPU for decryption. What is it? This is a project which I started in 2007. At that time, I had only ATI card which did not support fragment programs, and High Level Shader Language did not even exist. I did not make good progress from then until now, but finally in 2012, I spent one day to write most of the code. Many things have changed since I started, but ATI cards are still not good. ;) GPGPU stands for General Purpose Graphics Processing Unit. It means to do non-video calculations using the video card hardware. We want to do that because video card hardware runs very fast and operations can be done in the background. It is also super anti-emulation environment. How can we do that? Video card supports memory blocks called textures. Textures are just array of 32-bit floating-point values. For some cards, textures must be squares (number of elements must have integer square root). Some cards allow array to be any size. We can allocate several textures and work with them at the same time. It is common to allocate two or even more textures, with one or more for input values and one for output values. We can perform operations (by running shader program) on the input texture(s) and result will be stored in output texture. We can run more than one shader program on the textures, by swapping input and output textures. This is called "ping-pong" technique. Shader programs are written in high-level language that looks like C. Set up environment To use shader program, we must create a window, and then set a pixel format that says to use OpenGL. Window does not have to be visible at any time, and can be almost any class. We create a context for OpenGL and make it current. Even we don't care about the window, we must still behave like we do. We create a framebuffer object and bind it to our context. We set a viewport for the texture mapping. Viewport must be size of our texture, otherwise some values will be clipped and lost. We create some textures, and set the environment mode for the textures. Now we are ready for our shader program. Shader program We create one or more shader programs, and bind one of them to a shader for immediate use. We bind some shader source to the shader, and then compile and link the shader program. If our shader program has variables, then we need to query the location of each of them, and pass the returned values as the index when setting the variables. We need to attach the textures to the framebuffer and enable the shader program. Variables To use textures requires to set a variable with the id of the texture. We activate the texture to use, bind the id to the texture, and then use the variable index when setting the texture id. We can set values for other variables by using the variable index, too. Run it! Finally, it's time to run the shader program. We use the texture size so that the operation occurs over the whole array, by passing the co-ordinates of each corner. After the rendering is complete, we must read back the result. Since the values are floating-point, we might need to convert them back to integers, if we want to use the result for running code. I can't understand why the whole thing seems so complicated, but I suppose that people did not have this idea in mind when they designed the system. ;) Greets to friendly people (A-Z): Active - Benny - herm1t - hh86 - jqwerty - Malum - Obleak - Prototype - Ratter - Ronin - RT Fishel - sars - SPTH - The Gingerbread Man - Ultras - uNdErX - Vallez - Vecna - Whitehead rgb/defjam jun 2012 iam_rgb@hotmail.com