40hex nº13:(40HEX-13.003):29/05/1994 << Back To 40hex nº 13
40Hex Number 13 Volume 4 Issue 1 File 003 =============================================================================== Extracting virus signatures from F-PROT by Peter Vincent The program included here does just that: Extracts signatures used by the notorious anti-virus product F-PROT. Before we get to the code though, there are a couple of things that need to be said. There are two sets of signatures used in F-PROT. One is used by F-PROT.EXE, and is included in a file named SIGN.DEF, while the other is used by VIRSTOP.EXE and is included in VIRSTOP.EXE itself. A virus signature is defined as a sequence of hex bytes, which can also include one or more wildcards. A wildcard, represented here as "??", matches any given hex byte. F-PROT does not use wildcards that can match more than one byte. Note that F-PROT defines at least two different signatures for each virus. This is apparently aimed at better identification of viruses. Also, the search algorithm used ignores any hex bytes of value 90 or CC. This means that code that contains a F-PROT signature with some of these bytes inserted into it will still match the signature. In addition to signatures for detecting known viruses, there are a few other signatures included that can presumably detect some unknown viruses. These signatures are named as "unknown". How to extract signatures from F-PROT: easy as 1-2-3. Extract the source code included here and store it to a file named GETFP211.PAS. Compile this program with Turbo Pascal (version 4.0 or later). Copy SIGN.DEF and VIRSTOP.EXE from F-PROT distribution to the default DOS directory, and run GETFP211. On successful completion, two text files will be created: F-PROT.STR and VIRSTOP.STR. They will contain the signatures found in SIGN.DEF and VIRSTOP.EXE, respectively. Each line of these files will contain a signature, and the corresponding virus name on every line. VIRSTOP signatures for boot sector viruses are not included. The program has been tested to work successfully with F-PROT 2.11; it might or might not work with future versions if they change the formats. The internal format used by F-PROT to store signatures can be easily retrieved by reading the source code by any knowledgeable programmer. And now for the source code: --- Begin GETFP211.PAS -------------------------------------------------------- { GETFP211.PAS: Extract virus signatures from F-PROT version 2.11. This program is in the Public Domain. Courtesy of Peter Vincent. } {$i-,r-} program getfpstr; type ba = array[0..$fffe] of byte; wa = array[0..$7ffe] of word; bp = ^ba; wp = ^wa; function alloc(i: word): pointer; var p: pointer; begin if maxavail < i then begin writeln('Error: Not enough memory.'); halt(1); end; getmem(p,i); alloc := p end; procedure writesig(var f: text; var s, name: string; x: char); const hexstr: string[16] = '0123456789ABCDEF'; var i: word; c: char; begin for i := 1 to length(s) do begin c := s[i]; if c = x then write(f,'?? ') else write(f,hexstr[ord(c) shr 4+1],hexstr[ord(c) and 15+1],' '); end; for i := length(s)*3 to 79-length(name) do write(f,' '); writeln(f,name); end; procedure dovirstop; var len: longint; virstop: pointer; adj: word; procedure readvirstop; var f: file; begin writeln('Reading VIRSTOP.EXE...'); assign(f,'VIRSTOP.EXE'); reset(f,1); if ioresult <> 0 then begin writeln('Error: Cannot open VIRSTOP.EXE.'); halt(1); end; len := filesize(f); if len > $fffe then begin writeln('Error: VIRSTOP.EXE too big.'); halt(1); end; virstop := alloc(len); blockread(f,virstop^,len); if ioresult <> 0 then begin writeln('Error: Cannot read VIRSTOP.EXE.'); halt(1); end; close(f); case wp(virstop)^[0] of $5a4d, $4d5a: else begin writeln('Error: VIRSTOP.EXE is invalid.'); halt(1); end; end; adj := wp(virstop)^[4]*16 end; procedure writesigs; var i,j,k,l,startpos,endpos,sigcnt: word; found: boolean; f: text; buf: array[0..2047] of byte; sig, name: string; procedure chkioerr; begin if ioresult <> 0 then begin writeln('Error: Cannot write to VIRSTOP.STR.'); halt(1); end; end; begin found := false; j := 0; k := 0; for i := 0 to len-1 do if chr(bp(virstop)^[i]) = '$' then begin if i-j > 30 then if found then begin endpos := j-adj; i := len-1; end else startpos := i-adj-30 else if not found then begin inc(k); if k = 20 then inc(found); end; j := i; end; sigcnt := 0; if found then for i := 0 to len-1 do begin j := i; k := 0; found := true; while found do begin l := bp(virstop)^[j]; if (l-1 > 24) or (wp(@bp(virstop)^[j+l+1])^[0]-startpos > endpos) then dec(found) else begin inc(k); inc(j,l+3); end; end; if k >= 20 then begin if sigcnt = 0 then begin writeln('Writing VIRSTOP.STR...'); assign(f,'VIRSTOP.STR'); settextbuf(f,buf,sizeof(buf)); rewrite(f); chkioerr; end; k := i; repeat sig := ''; for l := bp(virstop)^[k] downto 1 do begin inc(sig[0]); sig[length(sig)] := chr(bp(virstop)^[k+l]); end; inc(k,bp(virstop)^[k]+3); name := ''; l := wp(@bp(virstop)^[k-2])^[0]+adj; while chr(bp(virstop)^[l]) <> '$' do begin inc(name[0]); name[length(name)] := chr(bp(virstop)^[l]); inc(l); end; writesig(f,sig,name,#$fe); chkioerr; inc(sigcnt); until k = j; writeln(f); chkioerr; i := k; end; end; if sigcnt <> 0 then begin close(f); chkioerr; writeln(sigcnt,' signatures found in VIRSTOP.EXE.'); end else writeln('Error: No signatures found in VIRSTOP.EXE.'); end; begin readvirstop; writesigs; freemem(virstop,len); end; procedure dosigndef; var sigs, nameidx, names: pointer; procedure readsigndef; var f: file; date: record y: word; d,m: byte end; procedure chkioerr; begin if ioresult <> 0 then begin writeln('Error: Cannot read SIGN.DEF.'); halt(1); end; end; procedure checksigndef; var buf: array[0..4095] of byte; i: word; l,c0,c1: longint; function rol(l: longint): longint; begin rol := l shl 1 or l shr 31 end; begin l := filesize(f)-4; c0 := 0; repeat c1 := 0; i := sizeof(buf); if l < i then i := l; blockread(f,buf,i); chkioerr; dec(l,i); for i := 0 to i-1 do c1 := rol(c1) xor buf[i]; c0 := c0 xor c1; until l = 0; blockread(f,c1,sizeof(c1)); chkioerr; if c0 <> c1 then begin writeln('Error: SIGN.DEF has an invalid checksum.'); halt(1); end; end; procedure readsigs; const frisk: string[15] = 'Copyright (c) F'; var l: longint; i,c: word; x: byte; function ror(x: byte): byte; begin ror := x shr 1 or x shl 7; end; begin seek(f,0); blockread(f,l,sizeof(l)); chkioerr; seek(f,l+4); blockread(f,i,sizeof(i)); chkioerr; sigs := alloc(i-8); blockread(f,sigs^,i-8); chkioerr; c := -wp(@bp(sigs)^[i-10])^[0]; for i := 0 to i-11 do begin x := not ror(bp(sigs)^[i]) xor ord(frisk[i mod 100 mod 15+1]); x := x xor i mod 100; bp(sigs)^[i] := x; inc(c,x xor i mod 100) end; if c <> 0 then begin writeln('Error: Invalid signatures checksum.'); halt(1); end; end; procedure readnames; var i: word; begin blockread(f,i,sizeof(i)); chkioerr; nameidx := alloc(i*2); blockread(f,nameidx^,i*2); chkioerr; i := filesize(f)-filepos(f)-4; names := alloc(i); blockread(f,names^,i); chkioerr; date.y := not wp(@bp(names)^[i-4])^[0]; date.d := not bp(names)^[i-2]; date.m := not bp(names)^[i-1]; end; begin writeln('Reading SIGN.DEF...'); assign(f,'SIGN.DEF'); reset(f,1); if ioresult <> 0 then begin writeln('Error: Cannot open SIGN.DEF.'); halt(1); end; checksigndef; readsigs; readnames; writeln('Signatures created ',date.m,'-',date.d,'-',date.y); close(f); end; procedure writesigs; var buf: array[0..2047] of byte; i,sigcnt: word; f: text; sig, name: string; procedure chkioerr; begin if ioresult <> 0 then begin writeln('Error: Cannot write to F-PROT.STR.'); halt(1); end; end; procedure extract(n: word); var i,j,k: word; begin inc(sig[0]); for i := 1 to bp(sigs)^[n] do begin sig[length(sig)] := chr(bp(sigs)^[n+i+1]); j := wp(@bp(sigs)^[n+bp(sigs)^[n]])^[i]; if i > bp(sigs)^[n+1] then extract(j-8) else begin inc(j,512); for k := bp(sigs)^[j] downto 1 do begin inc(sig[0]); sig[length(sig)] := chr(bp(sigs)^[j+k]); end; k := wp(@bp(sigs)^[j+bp(sigs)^[j]+1])^[0]; if k = 0 then name := 'unknown' else begin k := wp(nameidx)^[k-1]; name := ''; while bp(names)^[k] <> 0 do begin inc(name[0]); name[length(name)] := chr(bp(names)^[k]); inc(k); end; end; writesig(f,sig,name,#$90); chkioerr; dec(sig[0],bp(sigs)^[j]); inc(sigcnt); end; end; dec(sig[0]); end; begin writeln('Writing F-PROT.STR...'); assign(f,'F-PROT.STR'); settextbuf(f,buf,sizeof(buf)); rewrite(f); chkioerr; sigcnt := 0; for i := 0 to 255 do begin sig := chr(i); if wp(sigs)^[i] >= 512 then extract(wp(sigs)^[i]-8); end; writeln(f); chkioerr; close(f); chkioerr; writeln(sigcnt,' signatures found in SIGN.DEF.'); end; begin readsigndef; writesigs; end; begin dovirstop; dosigndef; writeln('Done.'); end. --- End GETFP211.PAS ---------------------------------------------------------- <<< end of file >>>