-
Notifications
You must be signed in to change notification settings - Fork 15
/
disasme.txt
376 lines (335 loc) · 13.7 KB
/
disasme.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
DISASSEMBLERS WITHIN VIRUSES
----------------------------
(x) 2001
xlated in 2002
The more different features (possibilities) our virus have, and the
more there are relations and reactions between these features and
external environment, the more our virus is alive, and the more complex it
is. Here comes to mind such technologies as modularity, portable viruses
written in own emulated scripts, worms, distributed networks, and other
complex stuff.
In this connexion lots of useful tools, toolkits, include files,
articles and libraries, oriented to help others in coding common stuff,
are required today.
One of such things is disassembler. It can be used everywhere, and
wherever it used, especially in viruses, it gives good effect -- mostly
all good infection- and morphing- related technologies are based on
disassembling.
Code analysis and parsing it into single instructions can be done by
means of sequential calls to length disassembler. Such disassembler is
used in permutation and code integration.
The trivial usage of length-disassembler is hooking functions in
memory or, while infecting file, inserting virus call some commands after
the entrypoint.
The code i'm considering is 32-bit x86 binary code. But,
length-disassembler showed here can be easily changed to work with 16-bit.
Now, what will we disassemble, i.e. which kind of information we want
to extract from instruction flow. Is only length of instructions enough,
or we also want to know something about prefixes, operation code,
arguments and etc.
Some years ago, in 1997, i didnt knew that universal disassembler is
very useful thing, and in ZCME there where the following commands:
inc cx ; 5
cmp al, 0EAh
je @@exit
cmp ax, 3E80h ; cmp [xxxx], yy
je @@exit
inc cx ; 6
...
@@exit: ; return cx
As you can see, this is disassembler for only instructions, which were
present in the ZCME virus. Year after i changed the virus, and so, i had
to change disassembler too. And then once again, and again, until
universal length disassembler (LDE) were written, and then there appeared
different LDE modifications for different tasks.
In the example above i only need to call the length-disassembler, and
then check current instruction opcode for being EB,E8,E9,7x,0F 8x, and
etc., while in more advanced tasks i need to know much more information
about instructions -- for example, knowing register usage, it is possible
to insert own instructions into the middle of the program's code:
mov eax, vir_1
mov eax, [ebx+4] -----> add vir_2, eax
mov eax, [ebx+4]
Also, while permutation, knowing registers and stack usage is
necessary to mix instructions between each other.
In other words, the more advanced our disassembler is, the more our
knowledge about instructions is, and as such our imagination is less
limited by our possibilities, and the more good things can be done.
In the end of this article there is DISASM.CPP, the source of
instruction parser.
It is called as following;
int disasm_ok = disasm( &buf[ip] );
As a result, 1 is returned if instruction is known, and 0 if some
error has been occured.
In case of successful disassembly, disasm function will parse given
instruction into the following parts:
--- RETURNED VARIABLES: ---
DWORD disasm_len; -- total instruction length in bytes, 0 if error
DWORD disasm_flag; -- bitmask, flags, see C_xxx
C_66 -- there is 66-prefix
C_67 -- there is 67-prefix
C_LOCK -- there is LOCK-prefix (F0)
C_REP -- there is REPZ- or REPNZ-prefix, exact value in disasm_rep
C_SEG -- there is seg-prefix, exact value in disasm_seg
C_OPCODE2 -- there is 2nd opcode (1st one is 0x0F), value in disasm_opcode2
C_MODRM -- there is modrm, value in disasm_modrm
C_SIB -- there is sib, value in disasm_sib
DWORD disasm_memsize; -- length of the memory address,
if used in instruction, value in disasm_mem
BYTE disasm_mem[8]; -- memory address (length in disasm_memsize)
DWORD disasm_datasize; -- lemgth of data, used in insructions (in bytes),
value in disasm_data
BYTE disasm_data[8]; -- data (length in disasm_datasize)
BYTE disasm_seg; -- C_SEG: seg-prefix (CS DS ES SS FS GS)
BYTE disasm_rep; -- C_REP: rep-prefix REPZ/REPNZ
BYTE disasm_opcode; -- opcode itself, not depending on flags
BYTE disasm_opcode2; -- C_OPCODE2: 2nd opcode (if 1st one is 0x0F)
BYTE disasm_modrm; -- C_MODRM: value of modxxxrm
BYTE disasm_sib; -- C_SIB: value of sib (scale-index-base)
So, assembling insruction from all the stuff listed above, looks as
following:
if (disasm_flag & C_66) *outptr++ = 0x66;
if (disasm_flag & C_67) *outptr++ = 0x67;
if (disasm_flag & C_LOCK) *outptr++ = 0xF0;
if (disasm_flag & C_REP) *outptr++ = disasm_rep;
if (disasm_flag & C_SEG) *outptr++ = disasm_seg;
*outptr++ = disasm_opcode;
if (disasm_flag & C_OPCODE2) *outptr++ = disasm_opcode2;
if (disasm_flag & C_MODRM) *outptr++ = disasm_modrm;
if (disasm_flag & C_SIB) *outptr++ = disasm_sib;
for (DWORD i=0; i<disasm_memsize; i++) *outptr++ = disasm_mem[i];
for (DWORD i=0; i<disasm_datasize; i++) *outptr++ = disasm_data[i];
Thats all, folks!
---[begin DISASM.CPP]--------------------------------------------------------
// disasm_flag values:
#define C_66 0x00000001 // 66-prefix
#define C_67 0x00000002 // 67-prefix
#define C_LOCK 0x00000004 // lock
#define C_REP 0x00000008 // repz/repnz
#define C_SEG 0x00000010 // seg-prefix
#define C_OPCODE2 0x00000020 // 2nd opcode present (1st==0F)
#define C_MODRM 0x00000040 // modrm present
#define C_SIB 0x00000080 // sib present
#define C_ANYPREFIX (C_66|C_67|C_LOCK|C_REP|C_SEG)
DWORD disasm_len; // 0 if error
DWORD disasm_flag; // C_xxx
DWORD disasm_memsize; // value = disasm_mem
DWORD disasm_datasize; // value = disasm_data
DWORD disasm_defdata; // == C_66 ? 2 : 4
DWORD disasm_defmem; // == C_67 ? 2 : 4
BYTE disasm_seg; // CS DS ES SS FS GS
BYTE disasm_rep; // REPZ/REPNZ
BYTE disasm_opcode; // opcode
BYTE disasm_opcode2; // used when opcode==0F
BYTE disasm_modrm; // modxxxrm
BYTE disasm_sib; // scale-index-base
BYTE disasm_mem[8]; // mem addr value
BYTE disasm_data[8]; // data value
// returns: 1 if success
// 0 if error
int disasm(BYTE* opcode0)
{
BYTE* opcode = opcode0;
disasm_len = 0;
disasm_flag = 0;
disasm_datasize = 0;
disasm_memsize = 0;
disasm_defdata = 4;
disasm_defmem = 4;
retry:
disasm_opcode = *opcode++;
switch (disasm_opcode)
{
case 0x00: case 0x01: case 0x02: case 0x03:
case 0x08: case 0x09: case 0x0A: case 0x0B:
case 0x10: case 0x11: case 0x12: case 0x13:
case 0x18: case 0x19: case 0x1A: case 0x1B:
case 0x20: case 0x21: case 0x22: case 0x23:
case 0x28: case 0x29: case 0x2A: case 0x2B:
case 0x30: case 0x31: case 0x32: case 0x33:
case 0x38: case 0x39: case 0x3A: case 0x3B:
case 0x62: case 0x63:
case 0x84: case 0x85: case 0x86: case 0x87:
case 0x88: case 0x89: case 0x8A: case 0x8B:
case 0x8C: case 0x8D: case 0x8E: case 0x8F:
case 0xC4: case 0xC5:
case 0xD0: case 0xD1: case 0xD2: case 0xD3:
case 0xD8: case 0xD9: case 0xDA: case 0xDB:
case 0xDC: case 0xDD: case 0xDE: case 0xDF:
case 0xFE: case 0xFF:
disasm_flag |= C_MODRM;
break;
case 0xCD: disasm_datasize += *opcode==0x20 ? 1+4 : 1;
break;
case 0xF6:
case 0xF7: disasm_flag |= C_MODRM;
if (*opcode & 0x38) break;
// continue if <test ..., xx>
case 0x04: case 0x05: case 0x0C: case 0x0D:
case 0x14: case 0x15: case 0x1C: case 0x1D:
case 0x24: case 0x25: case 0x2C: case 0x2D:
case 0x34: case 0x35: case 0x3C: case 0x3D:
if (disasm_opcode & 1)
disasm_datasize += disasm_defdata;
else
disasm_datasize++;
break;
case 0x6A:
case 0xA8:
case 0xB0: case 0xB1: case 0xB2: case 0xB3:
case 0xB4: case 0xB5: case 0xB6: case 0xB7:
case 0xD4: case 0xD5:
case 0xE4: case 0xE5: case 0xE6: case 0xE7:
case 0x70: case 0x71: case 0x72: case 0x73:
case 0x74: case 0x75: case 0x76: case 0x77:
case 0x78: case 0x79: case 0x7A: case 0x7B:
case 0x7C: case 0x7D: case 0x7E: case 0x7F:
case 0xEB:
case 0xE0: case 0xE1: case 0xE2: case 0xE3:
disasm_datasize++;
break;
case 0x26: case 0x2E: case 0x36: case 0x3E:
case 0x64: case 0x65:
if (disasm_flag & C_SEG) return 0;
disasm_flag |= C_SEG;
disasm_seg = disasm_opcode;
goto retry;
case 0xF0:
if (disasm_flag & C_LOCK) return 0;
disasm_flag |= C_LOCK;
goto retry;
case 0xF2: case 0xF3:
if (disasm_flag & C_REP) return 0;
disasm_flag |= C_REP;
disasm_rep = disasm_opcode;
goto retry;
case 0x66:
if (disasm_flag & C_66) return 0;
disasm_flag |= C_66;
disasm_defdata = 2;
goto retry;
case 0x67:
if (disasm_flag & C_67) return 0;
disasm_flag |= C_67;
disasm_defmem = 2;
goto retry;
case 0x6B:
case 0x80:
case 0x82:
case 0x83:
case 0xC0:
case 0xC1:
case 0xC6: disasm_datasize++;
disasm_flag |= C_MODRM;
break;
case 0x69:
case 0x81:
case 0xC7:
disasm_datasize += disasm_defdata;
disasm_flag |= C_MODRM;
break;
case 0x9A:
case 0xEA: disasm_datasize += 2 + disasm_defdata;
break;
case 0xA0:
case 0xA1:
case 0xA2:
case 0xA3: disasm_memsize += disasm_defmem;
break;
case 0x68:
case 0xA9:
case 0xB8: case 0xB9: case 0xBA: case 0xBB:
case 0xBC: case 0xBD: case 0xBE: case 0xBF:
case 0xE8:
case 0xE9:
disasm_datasize += disasm_defdata;
break;
case 0xC2:
case 0xCA: disasm_datasize += 2;
break;
case 0xC8:
disasm_datasize += 3;
break;
case 0xF1:
return 0;
case 0x0F:
disasm_flag |= C_OPCODE2;
disasm_opcode2 = *opcode++;
switch (disasm_opcode2)
{
case 0x00: case 0x01: case 0x02: case 0x03:
case 0x90: case 0x91: case 0x92: case 0x93:
case 0x94: case 0x95: case 0x96: case 0x97:
case 0x98: case 0x99: case 0x9A: case 0x9B:
case 0x9C: case 0x9D: case 0x9E: case 0x9F:
case 0xA3:
case 0xA5:
case 0xAB:
case 0xAD:
case 0xAF:
case 0xB0: case 0xB1: case 0xB2: case 0xB3:
case 0xB4: case 0xB5: case 0xB6: case 0xB7:
case 0xBB:
case 0xBC: case 0xBD: case 0xBE: case 0xBF:
case 0xC0:
case 0xC1:
disasm_flag |= C_MODRM;
break;
case 0x06:
case 0x08: case 0x09: case 0x0A: case 0x0B:
case 0xA0: case 0xA1: case 0xA2: case 0xA8:
case 0xA9:
case 0xAA:
case 0xC8: case 0xC9: case 0xCA: case 0xCB:
case 0xCC: case 0xCD: case 0xCE: case 0xCF:
break;
case 0x80: case 0x81: case 0x82: case 0x83:
case 0x84: case 0x85: case 0x86: case 0x87:
case 0x88: case 0x89: case 0x8A: case 0x8B:
case 0x8C: case 0x8D: case 0x8E: case 0x8F:
disasm_datasize += disasm_defdata;
break;
case 0xA4:
case 0xAC:
case 0xBA:
disasm_datasize++;
disasm_flag |= C_MODRM;
break;
default:
return 0;
} // 0F-switch
break;
} //switch
if (disasm_flag & C_MODRM)
{
disasm_modrm = *opcode++;
BYTE mod = disasm_modrm & 0xC0;
BYTE rm = disasm_modrm & 0x07;
if (mod != 0xC0)
{
if (mod == 0x40) disasm_memsize++;
if (mod == 0x80) disasm_memsize += disasm_defmem;
if (disasm_defmem == 2) // modrm16
{
if ((mod == 0x00)&&(rm == 0x06)) disasm_memsize+=2;
}
else // modrm32
{
if (rm==0x04)
{
disasm_flag |= C_SIB;
disasm_sib = *opcode++;
rm = disasm_sib & 0x07;
}
if ((rm==0x05)&&(mod==0x00)) disasm_memsize+=4;
}
}
} // C_MODRM
for(DWORD i=0; i<disasm_memsize; i++)
disasm_mem[i] = *opcode++;
for(DWORD i=0; i<disasm_datasize; i++)
disasm_data[i] = *opcode++;
disasm_len = opcode - opcode0;
return 1;
} //disasm
---[end DISASM.CPP]----------------------------------------------------------