HaCKeRz KrOnIcKLeZ 3/HaCKeRz_KrOnIcKLeZ.iso/chibacity/strange.doc

Text File | 1996-04-22 | 8KB | 198 lines

The Strange Virus


Notes on Disassembly

     by Evgeny Kaspersky and Vadim Bogdanov

     from Virus Bulletin April 1993

     Virus Bulletin Ltd,
     21 The Quadrant,
     Abingdon Science Park,
     Oxon,
     OX14 3YS,
     England


Stealth viruses have been around for a very long time,
and are one of the principal reasons why manufacturers
insist that users execute a clean boot before using
anti-virus software.  Many software vendors attempt to
circumvent this problem by gaining "clean" access to
both INT 13h and INT 21h, the idea being that if clean
disk access can be achieved, the effects of any stealth
virus will be negated.

The STRANGE virus calls into question the logic of such
techniques, as it illustrates a new way for a virus to
avoid detection by a scanner.  By moving to increasingly
low-level interception of hard disk read requests, the
virus authors appear to be attempting that users who
forego elementary safety precautions pay the price.

The STRANGE virus is a master boot sector virus three
sectors long.  However, here its similarity with other
boot sector viruses ends.  When an infected machine is
booted, the virus loads itself into memory and becomes
resident.  The virus decreases the word at address
0040:0013, which specifies the amount of available
conventional memory and then hooks INT 08h ( the timer
interrupt ) rather than the "standard" boot sector virus
interrupt, INT 13h.

The virus uses INT 08h to monitor the bootstrap
procedure of the PC.  When the interrupt vector table is
set up ( this happens when DOS is loaded ) it restores
the original INT 08h handler and hooks INT 21h.  The INT
21h handler simply intercepts the DOS Load and Execute
function.

The rather tortuous route above enables the STRANGE
virus to intercept the loading of the command
interpreter.  This is done immediately after the device
drivers are loaded.  At this point the virus installs
itself as a device driver and restores the original INT
21h handler.  INT 13h is finally hooked, as is INT 09h (
the keyboard interrupt ).  If the virus is unable to
install itself as a device driver, it displays the
message:

Hmm... Strange drivers you have, very strange... ;-)

At first glance this highly complex loading procedure
seems completely unnecessary - after all, the virus
could have picked up INT 13h as soon as the system was
booted.  However, there is a subtle difference between
intercepting this vector now rather than at boot time.
By the time the command interpreter is loaded ( usually
COMMAND.COM ) all the relevant device drivers have been
installed.  Therefore any driver software required to
access the DOS partition of the disk will be installed
and already hooked to INT 13h.

!!! This means that the virus can access the disk at a
sector by sector level safely and reliably even in the
presence of disk compression software....!!!

The virus carefully checks whether another program is
attempting to tunnel the true INT 13h address.  It does
this by comparing the contents of the stack before and
after a PUSH and POP instruction.  While the contents of
the stack are not altered by tracing, the contents of
the memory just above the top of the stack will be, when
the return address is PUSHed.  If this test shows that
tracing of the executable path is occurring, the virus
issues an IRET with the registers containing the error
code for a "disk write protect" error.

!!! Apart from its unusual installation process, the
virus uses a previously unseen method of avoiding
detection - it makes use of hardware interrupts in an
attempt to hide its presence.... !!!

Whenever data is read from the disk drive, a hardware
interrupt occurs which indicates that a read is ready to
take place.  These interrupt requests are handled
differently on the XT and AT, and therefore the first
thing the virus needs to do is to ascertain the
processor type.

There is no built-in method of determining the processor
type; Intel did not include any simple processor ID
instruction in the i8086, and therefore no such function
was built into newer processors.

The virus determines the type of processor by using five
assembler instructions:

     MOV    AX,2
     MOV    CL,41h
     SHR    AX,CL
     TEST   AX,1
     JZ     xt_class_computer

The above example works because of a difference between
the i8086 and more modern Intel chips.  The Intel 80386
Programmers Reference Manual states that " To reduce the
maximum execution time, the 80386 does not allow shift
counts of greater than 31.  If a shift count greater
than 31 is used, only the bottom five bits of the shift
count are used.  ( The 8086 uses all eight bits of the
shift count. )"

The above routine will therefore have different results
when executed on an XT rather than an AT.

XT routine.
On an XT, the virus hooks INT 0Dh - this corresponds to
the hardware interrupt IRQ5 ( the hard disk controller
interrupt ).  Whenever a disk read is requested, the
virus checks the contents of the disk buffer for its own
code. If it is found, it substitutes the contents of the
buffer with the contents of the original master boot
sector.

AT routine.
The INT 76h handler routine is somewhat more
complicated. When a disk access is about to take place
the disk controller issues a hardware interrupt.  This
causes the virus code to be executed.  On the AT, the
virus checks the contents of ports 1F3h to 1F6h.  These
ports contain the data which the hard disk controller
will use for the forthcoming disk access.

If these numbers correspond to a read of the master boot
sector of the hard drive, the STRANGE virus alters the
contents of these ports so that the original master boot
sector is read instead.

This means that even if an anti-virus program has clean
INT 13h access, it is still entirely capable of being
"stealthed".  This serves as yet another illustration of
the danger of not clean booting the machine.

The virus contains a number of different trigger
routines.  Firstly, if the virus encounters an error
during installation it displays a silly text message (
see above ).

In addition, the virus uses INT 09h to add occasional
mistyped keystrokes.  By far the strangest trigger
however is the fact that the virus intercepts disk
writes which start with the letters 'MZ', which are used
to indicate that a file has an EXE format.

When the virus encounters such a sector, the disk write
is allowed to pass unmolested except for the first two
letters, which are swapped about.  This is a bizarre
action to take, as EXE files edited in this way should
still function correctly, since 'ZM' is also a valid EXE
file qualifier.

The virus is not particularly difficult to disinfect:
the original master boot record is stored in sector 11
of the hard disk and can easily be copied back to its
original position.

However, the way this virus uses stealth is particularly
interesting, as the manipulation the virus employs in
order to avoid detection is at a lower level than usual.
The author of the virus appears to have an in-depth
knowledge of the IBM PC and it is lamentable that a
reasonably competent programmer would wish to waste his
time on such a pointless ( and malicious ) project as
this virus.

The new method of stealth does have some repercussions
for those who insist that a clean boot is an unnecessary
luxury.
Anyone advocating such a technique had better be sure
that they have considered all the ways to subvert their
product - or else risk users ire when they find
themselves the victim of the next crop of stealth
viruses.