VX Heaven

Library Collection Sources Engines Constructors Simulators Utilities Links Forum

Disassemblers within viruses


[Back to index] [Comments]

xlated in 2002

The more different features (possibilities) our virus have, and the more there are relations and reactions between these features and external environment, the more our virus is alive, and the more complex it is. Here comes to mind such technologies as modularity, portable viruses written in own emulated scripts, worms, distributed networks, and other complex stuff.

In this connexion lots of useful tools, toolkits, include files, articles and libraries, oriented to help others in coding common stuff, are required today.

One of such things is disassembler. It can be used everywhere, and wherever it used, especially in viruses, it gives good effect -- mostly all good infection- and morphing- related technologies are based on disassembling.

Code analysis and parsing it into single instructions can be done by means of sequential calls to length disassembler. Such disassembler is used in permutation and code integration.

The trivial usage of length-disassembler is hooking functions in memory or, while infecting file, inserting virus call some commands after the entrypoint.

The code i'm considering is 32-bit x86 binary code. But, length-disassembler showed here can be easily changed to work with 16-bit.

Now, what will we disassemble, i.e. which kind of information we want to extract from instruction flow. Is only length of instructions enough, or we also want to know something about prefixes, operation code, arguments and etc.

Some years ago, in 1997, i didnt knew that universal disassembler is very useful thing, and in ZCME there where the following commands:

                inc     cx              ; 5
                cmp     al, 0EAh
                je      @@exit
                cmp     ax, 3E80h       ; cmp [xxxx], yy
                je      @@exit
                inc     cx              ; 6
@@exit:         ; return cx

As you can see, this is disassembler for only instructions, which were present in the ZCME virus. Year after i changed the virus, and so, i had to change disassembler too. And then once again, and again, until universal length disassembler (LDE) were written, and then there appeared different LDE modifications for different tasks.

In the example above i only need to call the length-disassembler, and then check current instruction opcode for being EB,E8,E9,7x,0F 8x, and etc., while in more advanced tasks i need to know much more information about instructions -- for example, knowing register usage, it is possible to insert own instructions into the middle of the program's code:

                                        mov    eax, vir_1
      mov   eax, [ebx+4]     ----->     add    vir_2, eax
                                        mov    eax, [ebx+4]

Also, while permutation, knowing registers and stack usage is necessary to mix instructions between each other.

In other words, the more advanced our disassembler is, the more our knowledge about instructions is, and as such our imagination is less limited by our possibilities, and the more good things can be done.

In the end of this article there is DISASM.CPP, the source of instruction parser.

It is called as following;

       int disasm_ok = disasm( &buf[ip] );

As a result, 1 is returned if instruction is known, and 0 if some error has been occured.

In case of successful disassembly, disasm function will parse given instruction into the following parts:

DWORD disasm_len; total instruction length in bytes, 0 if error
DWORD disasm_flag; bitmask, flags, see C_xxx
C_66 there is 66-prefix
C_67 there is 67-prefix
C_LOCK there is LOCK-prefix (F0)
C_REP there is REPZ- or REPNZ-prefix, exact value in disasm_rep
C_SEG there is seg-prefix, exact value in disasm_seg
C_OPCODE2 there is 2nd opcode (1st one is 0x0F), value in disasm_opcode2
C_MODRM there is modrm, value in disasm_modrm
C_SIB there is sib, value in disasm_sib
DWORD disasm_memsize; length of the memory address, if used in instruction, value in disasm_mem
BYTE disasm_mem[8]; memory address (length in disasm_memsize)
DWORD disasm_datasize; lemgth of data, used in insructions (in bytes), value in disasm_data
BYTE disasm_data[8]; data (length in disasm_datasize)
BYTE disasm_seg; C_SEG: seg-prefix (CS DS ES SS FS GS)
BYTE disasm_rep; C_REP: rep-prefix REPZ/REPNZ
BYTE disasm_opcode; opcode itself, not depending on flags
BYTE disasm_opcode2; C_OPCODE2: 2nd opcode (if 1st one is 0x0F)
BYTE disasm_modrm; C_MODRM: value of modxxxrm
BYTE disasm_sib; C_SIB: value of sib (scale-index-base)

So, assembling insruction from all the stuff listed above, looks as following:

        if (disasm_flag & C_66)      *outptr++ = 0x66;
        if (disasm_flag & C_67)      *outptr++ = 0x67;
        if (disasm_flag & C_LOCK)    *outptr++ = 0xF0;
        if (disasm_flag & C_REP)     *outptr++ = disasm_rep;
        if (disasm_flag & C_SEG)     *outptr++ = disasm_seg;
        *outptr++ = disasm_opcode;
        if (disasm_flag & C_OPCODE2) *outptr++ = disasm_opcode2;
        if (disasm_flag & C_MODRM)   *outptr++ = disasm_modrm;
        if (disasm_flag & C_SIB)     *outptr++ = disasm_sib;
        for (DWORD i=0; i<disasm_memsize;  i++)  *outptr++ = disasm_mem[i];
        for (DWORD i=0; i<disasm_datasize; i++)  *outptr++ = disasm_data[i];

Thats all, folks!

---[begin DISASM.CPP]--------------------------------------------------------

// disasm_flag values:
#define C_66           0x00000001       // 66-prefix
#define C_67           0x00000002       // 67-prefix
#define C_LOCK         0x00000004       // lock
#define C_REP          0x00000008       // repz/repnz
#define C_SEG          0x00000010       // seg-prefix
#define C_OPCODE2      0x00000020       // 2nd opcode present (1st==0F)
#define C_MODRM        0x00000040       // modrm present
#define C_SIB          0x00000080       // sib present
#define C_ANYPREFIX    (C_66|C_67|C_LOCK|C_REP|C_SEG)

DWORD disasm_len;                       // 0 if error
DWORD disasm_flag;                      // C_xxx
DWORD disasm_memsize;                   // value = disasm_mem
DWORD disasm_datasize;                  // value = disasm_data
DWORD disasm_defdata;                   // == C_66 ? 2 : 4
DWORD disasm_defmem;                    // == C_67 ? 2 : 4

BYTE  disasm_seg;                       // CS DS ES SS FS GS
BYTE  disasm_rep;                       // REPZ/REPNZ
BYTE  disasm_opcode;                    // opcode
BYTE  disasm_opcode2;                   // used when opcode==0F
BYTE  disasm_modrm;                     // modxxxrm
BYTE  disasm_sib;                       // scale-index-base
BYTE  disasm_mem[8];                    // mem addr value
BYTE  disasm_data[8];                   // data value

// returns: 1 if success
//          0 if error

int disasm(BYTE* opcode0)
  BYTE* opcode = opcode0;

  disasm_len = 0;
  disasm_flag = 0;
  disasm_datasize = 0;
  disasm_memsize = 0;
  disasm_defdata = 4;
  disasm_defmem = 4;

  disasm_opcode = *opcode++;

  switch (disasm_opcode)
    case 0x00: case 0x01: case 0x02: case 0x03:
    case 0x08: case 0x09: case 0x0A: case 0x0B:
    case 0x10: case 0x11: case 0x12: case 0x13:
    case 0x18: case 0x19: case 0x1A: case 0x1B:
    case 0x20: case 0x21: case 0x22: case 0x23:
    case 0x28: case 0x29: case 0x2A: case 0x2B:
    case 0x30: case 0x31: case 0x32: case 0x33:
    case 0x38: case 0x39: case 0x3A: case 0x3B:
    case 0x62: case 0x63:
    case 0x84: case 0x85: case 0x86: case 0x87:
    case 0x88: case 0x89: case 0x8A: case 0x8B:
    case 0x8C: case 0x8D: case 0x8E: case 0x8F:
    case 0xC4: case 0xC5:
    case 0xD0: case 0xD1: case 0xD2: case 0xD3:
    case 0xD8: case 0xD9: case 0xDA: case 0xDB:
    case 0xDC: case 0xDD: case 0xDE: case 0xDF:
    case 0xFE: case 0xFF:
               disasm_flag |= C_MODRM;
    case 0xCD: disasm_datasize += *opcode==0x20 ? 1+4 : 1;
    case 0xF6:
    case 0xF7: disasm_flag |= C_MODRM;
               if (*opcode & 0x38) break;
               // continue if <test ..., xx>
    case 0x04: case 0x05: case 0x0C: case 0x0D:
    case 0x14: case 0x15: case 0x1C: case 0x1D:
    case 0x24: case 0x25: case 0x2C: case 0x2D:
    case 0x34: case 0x35: case 0x3C: case 0x3D:
               if (disasm_opcode & 1)
                 disasm_datasize += disasm_defdata;
    case 0x6A:
    case 0xA8:
    case 0xB0: case 0xB1: case 0xB2: case 0xB3:
    case 0xB4: case 0xB5: case 0xB6: case 0xB7:
    case 0xD4: case 0xD5:
    case 0xE4: case 0xE5: case 0xE6: case 0xE7:
    case 0x70: case 0x71: case 0x72: case 0x73:
    case 0x74: case 0x75: case 0x76: case 0x77:
    case 0x78: case 0x79: case 0x7A: case 0x7B:
    case 0x7C: case 0x7D: case 0x7E: case 0x7F:
    case 0xEB:
    case 0xE0: case 0xE1: case 0xE2: case 0xE3:
    case 0x26: case 0x2E: case 0x36: case 0x3E:
    case 0x64: case 0x65:
               if (disasm_flag & C_SEG) return 0;
               disasm_flag |= C_SEG;
               disasm_seg = disasm_opcode;
               goto retry;
    case 0xF0:
               if (disasm_flag & C_LOCK) return 0;
               disasm_flag |= C_LOCK;
               goto retry;
    case 0xF2: case 0xF3:
               if (disasm_flag & C_REP) return 0;
               disasm_flag |= C_REP;
               disasm_rep = disasm_opcode;
               goto retry;
    case 0x66:
               if (disasm_flag & C_66) return 0;
               disasm_flag |= C_66;
               disasm_defdata = 2;
               goto retry;
    case 0x67:
               if (disasm_flag & C_67) return 0;
               disasm_flag |= C_67;
               disasm_defmem = 2;
               goto retry;
    case 0x6B:
    case 0x80:
    case 0x82:
    case 0x83:
    case 0xC0:
    case 0xC1:
    case 0xC6: disasm_datasize++;
               disasm_flag |= C_MODRM;
    case 0x69:
    case 0x81:
    case 0xC7:
               disasm_datasize += disasm_defdata;
               disasm_flag |= C_MODRM;
    case 0x9A:
    case 0xEA: disasm_datasize += 2 + disasm_defdata;
    case 0xA0:
    case 0xA1:
    case 0xA2:
    case 0xA3: disasm_memsize += disasm_defmem;
    case 0x68:
    case 0xA9:
    case 0xB8: case 0xB9: case 0xBA: case 0xBB:
    case 0xBC: case 0xBD: case 0xBE: case 0xBF:
    case 0xE8:
    case 0xE9:
               disasm_datasize += disasm_defdata;
    case 0xC2:
    case 0xCA: disasm_datasize += 2;
    case 0xC8:
               disasm_datasize += 3;
    case 0xF1:
               return 0;
    case 0x0F:
      disasm_flag |= C_OPCODE2;
      disasm_opcode2 = *opcode++;
      switch (disasm_opcode2)
        case 0x00: case 0x01: case 0x02: case 0x03:
        case 0x90: case 0x91: case 0x92: case 0x93:
        case 0x94: case 0x95: case 0x96: case 0x97:
        case 0x98: case 0x99: case 0x9A: case 0x9B:
        case 0x9C: case 0x9D: case 0x9E: case 0x9F:
        case 0xA3:
        case 0xA5:
        case 0xAB:
        case 0xAD:
        case 0xAF:
        case 0xB0: case 0xB1: case 0xB2: case 0xB3:
        case 0xB4: case 0xB5: case 0xB6: case 0xB7:
        case 0xBB:
        case 0xBC: case 0xBD: case 0xBE: case 0xBF:
        case 0xC0:
        case 0xC1:
                   disasm_flag |= C_MODRM;
        case 0x06:
        case 0x08: case 0x09: case 0x0A: case 0x0B:
        case 0xA0: case 0xA1: case 0xA2: case 0xA8:
        case 0xA9:
        case 0xAA:
        case 0xC8: case 0xC9: case 0xCA: case 0xCB:
        case 0xCC: case 0xCD: case 0xCE: case 0xCF:
        case 0x80: case 0x81: case 0x82: case 0x83:
        case 0x84: case 0x85: case 0x86: case 0x87:
        case 0x88: case 0x89: case 0x8A: case 0x8B:
        case 0x8C: case 0x8D: case 0x8E: case 0x8F:
                   disasm_datasize += disasm_defdata;
        case 0xA4:
        case 0xAC:
        case 0xBA:
                   disasm_flag |= C_MODRM;
                   return 0;
      } // 0F-switch

  } //switch

  if (disasm_flag & C_MODRM)
    disasm_modrm = *opcode++;
    BYTE mod = disasm_modrm & 0xC0;
    BYTE rm  = disasm_modrm & 0x07;
    if (mod != 0xC0)
      if (mod == 0x40) disasm_memsize++;
      if (mod == 0x80) disasm_memsize += disasm_defmem;
      if (disasm_defmem == 2)           // modrm16
        if ((mod == 0x00)&&(rm == 0x06)) disasm_memsize+=2;
      else                              // modrm32
        if (rm==0x04)
          disasm_flag |= C_SIB;
          disasm_sib = *opcode++;
          rm = disasm_sib & 0x07;
        if ((rm==0x05)&&(mod==0x00)) disasm_memsize+=4;
  } // C_MODRM

  for(DWORD i=0; i<disasm_memsize; i++)
    disasm_mem[i] = *opcode++;
  for(DWORD i=0; i<disasm_datasize; i++)
    disasm_data[i] = *opcode++;

  disasm_len = opcode - opcode0;

  return 1;
} //disasm

---[end DISASM.CPP]----------------------------------------------------------
[Back to index] [Comments]
By accessing, viewing, downloading or otherwise using this content you agree to be bound by the Terms of Use! aka