DISASSEMBLERS WITHIN VIRUSES ---------------------------- (x) 2001 xlated in 2002 The more different features (possibilities) our virus have, and the more there are relations and reactions between these features and external environment, the more our virus is alive, and the more complex it is. Here comes to mind such technologies as modularity, portable viruses written in own emulated scripts, worms, distributed networks, and other complex stuff. In this connexion lots of useful tools, toolkits, include files, articles and libraries, oriented to help others in coding common stuff, are required today. One of such things is disassembler. It can be used everywhere, and wherever it used, especially in viruses, it gives good effect -- mostly all good infection- and morphing- related technologies are based on disassembling. Code analysis and parsing it into single instructions can be done by means of sequential calls to length disassembler. Such disassembler is used in permutation and code integration. The trivial usage of length-disassembler is hooking functions in memory or, while infecting file, inserting virus call some commands after the entrypoint. The code i'm considering is 32-bit x86 binary code. But, length-disassembler showed here can be easily changed to work with 16-bit. Now, what will we disassemble, i.e. which kind of information we want to extract from instruction flow. Is only length of instructions enough, or we also want to know something about prefixes, operation code, arguments and etc. Some years ago, in 1997, i didnt knew that universal disassembler is very useful thing, and in ZCME there where the following commands: inc cx ; 5 cmp al, 0EAh je @@exit cmp ax, 3E80h ; cmp [xxxx], yy je @@exit inc cx ; 6 ... @@exit: ; return cx As you can see, this is disassembler for only instructions, which were present in the ZCME virus. Year after i changed the virus, and so, i had to change disassembler too. And then once again, and again, until universal length disassembler (LDE) were written, and then there appeared different LDE modifications for different tasks. In the example above i only need to call the length-disassembler, and then check current instruction opcode for being EB,E8,E9,7x,0F 8x, and etc., while in more advanced tasks i need to know much more information about instructions -- for example, knowing register usage, it is possible to insert own instructions into the middle of the program's code: mov eax, vir_1 mov eax, [ebx+4] -----> add vir_2, eax mov eax, [ebx+4] Also, while permutation, knowing registers and stack usage is necessary to mix instructions between each other. In other words, the more advanced our disassembler is, the more our knowledge about instructions is, and as such our imagination is less limited by our possibilities, and the more good things can be done. In the end of this article there is DISASM.CPP, the source of instruction parser. It is called as following; int disasm_ok = disasm( &buf[ip] ); As a result, 1 is returned if instruction is known, and 0 if some error has been occured. In case of successful disassembly, disasm function will parse given instruction into the following parts: --- RETURNED VARIABLES: --- DWORD disasm_len; -- total instruction length in bytes, 0 if error DWORD disasm_flag; -- bitmask, flags, see C_xxx C_66 -- there is 66-prefix C_67 -- there is 67-prefix C_LOCK -- there is LOCK-prefix (F0) C_REP -- there is REPZ- or REPNZ-prefix, exact value in disasm_rep C_SEG -- there is seg-prefix, exact value in disasm_seg C_OPCODE2 -- there is 2nd opcode (1st one is 0x0F), value in disasm_opcode2 C_MODRM -- there is modrm, value in disasm_modrm C_SIB -- there is sib, value in disasm_sib DWORD disasm_memsize; -- length of the memory address, if used in instruction, value in disasm_mem BYTE disasm_mem[8]; -- memory address (length in disasm_memsize) DWORD disasm_datasize; -- lemgth of data, used in insructions (in bytes), value in disasm_data BYTE disasm_data[8]; -- data (length in disasm_datasize) BYTE disasm_seg; -- C_SEG: seg-prefix (CS DS ES SS FS GS) BYTE disasm_rep; -- C_REP: rep-prefix REPZ/REPNZ BYTE disasm_opcode; -- opcode itself, not depending on flags BYTE disasm_opcode2; -- C_OPCODE2: 2nd opcode (if 1st one is 0x0F) BYTE disasm_modrm; -- C_MODRM: value of modxxxrm BYTE disasm_sib; -- C_SIB: value of sib (scale-index-base) So, assembling insruction from all the stuff listed above, looks as following: if (disasm_flag & C_66) *outptr++ = 0x66; if (disasm_flag & C_67) *outptr++ = 0x67; if (disasm_flag & C_LOCK) *outptr++ = 0xF0; if (disasm_flag & C_REP) *outptr++ = disasm_rep; if (disasm_flag & C_SEG) *outptr++ = disasm_seg; *outptr++ = disasm_opcode; if (disasm_flag & C_OPCODE2) *outptr++ = disasm_opcode2; if (disasm_flag & C_MODRM) *outptr++ = disasm_modrm; if (disasm_flag & C_SIB) *outptr++ = disasm_sib; for (DWORD i=0; i case 0x04: case 0x05: case 0x0C: case 0x0D: case 0x14: case 0x15: case 0x1C: case 0x1D: case 0x24: case 0x25: case 0x2C: case 0x2D: case 0x34: case 0x35: case 0x3C: case 0x3D: if (disasm_opcode & 1) disasm_datasize += disasm_defdata; else disasm_datasize++; break; case 0x6A: case 0xA8: case 0xB0: case 0xB1: case 0xB2: case 0xB3: case 0xB4: case 0xB5: case 0xB6: case 0xB7: case 0xD4: case 0xD5: case 0xE4: case 0xE5: case 0xE6: case 0xE7: case 0x70: case 0x71: case 0x72: case 0x73: case 0x74: case 0x75: case 0x76: case 0x77: case 0x78: case 0x79: case 0x7A: case 0x7B: case 0x7C: case 0x7D: case 0x7E: case 0x7F: case 0xEB: case 0xE0: case 0xE1: case 0xE2: case 0xE3: disasm_datasize++; break; case 0x26: case 0x2E: case 0x36: case 0x3E: case 0x64: case 0x65: if (disasm_flag & C_SEG) return 0; disasm_flag |= C_SEG; disasm_seg = disasm_opcode; goto retry; case 0xF0: if (disasm_flag & C_LOCK) return 0; disasm_flag |= C_LOCK; goto retry; case 0xF2: case 0xF3: if (disasm_flag & C_REP) return 0; disasm_flag |= C_REP; disasm_rep = disasm_opcode; goto retry; case 0x66: if (disasm_flag & C_66) return 0; disasm_flag |= C_66; disasm_defdata = 2; goto retry; case 0x67: if (disasm_flag & C_67) return 0; disasm_flag |= C_67; disasm_defmem = 2; goto retry; case 0x6B: case 0x80: case 0x82: case 0x83: case 0xC0: case 0xC1: case 0xC6: disasm_datasize++; disasm_flag |= C_MODRM; break; case 0x69: case 0x81: case 0xC7: disasm_datasize += disasm_defdata; disasm_flag |= C_MODRM; break; case 0x9A: case 0xEA: disasm_datasize += 2 + disasm_defdata; break; case 0xA0: case 0xA1: case 0xA2: case 0xA3: disasm_memsize += disasm_defmem; break; case 0x68: case 0xA9: case 0xB8: case 0xB9: case 0xBA: case 0xBB: case 0xBC: case 0xBD: case 0xBE: case 0xBF: case 0xE8: case 0xE9: disasm_datasize += disasm_defdata; break; case 0xC2: case 0xCA: disasm_datasize += 2; break; case 0xC8: disasm_datasize += 3; break; case 0xF1: return 0; case 0x0F: disasm_flag |= C_OPCODE2; disasm_opcode2 = *opcode++; switch (disasm_opcode2) { case 0x00: case 0x01: case 0x02: case 0x03: case 0x90: case 0x91: case 0x92: case 0x93: case 0x94: case 0x95: case 0x96: case 0x97: case 0x98: case 0x99: case 0x9A: case 0x9B: case 0x9C: case 0x9D: case 0x9E: case 0x9F: case 0xA3: case 0xA5: case 0xAB: case 0xAD: case 0xAF: case 0xB0: case 0xB1: case 0xB2: case 0xB3: case 0xB4: case 0xB5: case 0xB6: case 0xB7: case 0xBB: case 0xBC: case 0xBD: case 0xBE: case 0xBF: case 0xC0: case 0xC1: disasm_flag |= C_MODRM; break; case 0x06: case 0x08: case 0x09: case 0x0A: case 0x0B: case 0xA0: case 0xA1: case 0xA2: case 0xA8: case 0xA9: case 0xAA: case 0xC8: case 0xC9: case 0xCA: case 0xCB: case 0xCC: case 0xCD: case 0xCE: case 0xCF: break; case 0x80: case 0x81: case 0x82: case 0x83: case 0x84: case 0x85: case 0x86: case 0x87: case 0x88: case 0x89: case 0x8A: case 0x8B: case 0x8C: case 0x8D: case 0x8E: case 0x8F: disasm_datasize += disasm_defdata; break; case 0xA4: case 0xAC: case 0xBA: disasm_datasize++; disasm_flag |= C_MODRM; break; default: return 0; } // 0F-switch break; } //switch if (disasm_flag & C_MODRM) { disasm_modrm = *opcode++; BYTE mod = disasm_modrm & 0xC0; BYTE rm = disasm_modrm & 0x07; if (mod != 0xC0) { if (mod == 0x40) disasm_memsize++; if (mod == 0x80) disasm_memsize += disasm_defmem; if (disasm_defmem == 2) // modrm16 { if ((mod == 0x00)&&(rm == 0x06)) disasm_memsize+=2; } else // modrm32 { if (rm==0x04) { disasm_flag |= C_SIB; disasm_sib = *opcode++; rm = disasm_sib & 0x07; } if ((rm==0x05)&&(mod==0x00)) disasm_memsize+=4; } } } // C_MODRM for(DWORD i=0; i