Author Topic: Virus Development  (Read 35356 times)

0 Members and 1 Guest are viewing this topic.

Offline Joe

  • B&
  • x86
  • Hero Member
  • *****
  • Posts: 10319
  • In Soviet Russia, text read you!
    • View Profile
    • Github
Virus Development
« on: September 15, 2005, 08:05:05 pm »
Alright, please, nobody lock/trash/delete/distroy this topic. For those of you who know me, I would never do anything like this (except to a test box of mine, which has nothing to lose anyhow), and the only ones who would want to do this would end up owning themselves before they can do it to anyone else.



The first method of "owning" a computer is very simple. When you start a computer, it goes through the POST (power on self test), detects your floppy drive, RAM ammount (often checking it for errors), CD Drives, hard drives, etc. After that, the BIOS will begin the BIOS boot sequence (call it what you want, thats not the official name (unless I'm lucky)), which is usually something along these lines.
1) Floppy Disk
2) CD Drive(s) (Dells have this after hard disks, press F12 to be given the boot menu)
3) Hard disks



The most simple (IMO) virus that can be written is simply making an MS-DOS startup disk and sticking it in your floppy drive (or a friends (or a non-friends)). Most of the world would have no clue whats going on when they see a DOS prompt. They'll probably hear their floppy drive though, they're pretty loud. Ineffictive, unfun.

Another variant of this method is to to make an MS-DOS bootdisk, and have a simple QB program on it, something allong these lines.
Code: [Select]
10 'Placeholder
20 Goto 10
Configure an autoexec.bat file to start your program (it must be compiled). This will require the QB runtime files, but they can fit on a floppy disk, so its no problem. This will print absolutely nothing to their screen (it will, but it'll disapear quickly). Good way to make a friend (or enemy) think they fried something, asuming they didn't hear their drive.



This is where it gets serious. The above two will cause you no damage no matter how badly you screw it up (ok, theres a limit, but I think we're all above that). The below uses x86 ASM, about as low as you can get (no pun intended, =p).

The simplist ASM virus you can make is a empty bootloader. You'll need a few tools, namely NASM and PARTCOPY (both free). You'll also need a plain-text editor (I suggest UltraEdit-32, but notepad works) to write your code in. Basically, you're fooling the computer to think you've written an operating system (or someone else has), and you want it loaded.
Code: [Select]
[bits 16]
start:
jmp $



Anyhow, thats all for now. Comment, add, correct, etc.
I'd personally do as Joe suggests

You might be right about that, Joe.


Offline Blaze

  • x86
  • Hero Member
  • *****
  • Posts: 7136
  • Canadian
    • View Profile
    • Maide
Re: Virus Development
« Reply #1 on: September 15, 2005, 08:08:42 pm »
All of your "virii" require floppy disks, and they don't do anything.
And like a fool I believed myself, and thought I was somebody else...

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Re: Virus Development
« Reply #2 on: September 15, 2005, 08:27:24 pm »
Mm, sounds like the beginnings of a boot-sector virus.  Those are ancient, and rarely used anymore since Windows NT+ won't load if there is something else loaded. 


Offline Joe

  • B&
  • x86
  • Hero Member
  • *****
  • Posts: 10319
  • In Soviet Russia, text read you!
    • View Profile
    • Github
Re: Virus Development
« Reply #3 on: September 15, 2005, 08:32:50 pm »
Quote
All of your "virii" require floppy disks
No they don't. partcopy that ASM one to your hard disk. It'll work nicely.

Quote
and they don't do anything.
Again, partcopy that to your hard disk, and when you finally get back, tell me that again. =p
I'd personally do as Joe suggests

You might be right about that, Joe.


Offline Joe

  • B&
  • x86
  • Hero Member
  • *****
  • Posts: 10319
  • In Soviet Russia, text read you!
    • View Profile
    • Github
Re: Virus Development
« Reply #4 on: September 15, 2005, 08:33:37 pm »
Quote
Mm, sounds like the beginnings of a boot-sector virus.
Yup.

Quote
and rarely used anymore since Windows NT+ won't load if there is something else loaded.
Exactly. =)
I'd personally do as Joe suggests

You might be right about that, Joe.


Offline Quik

  • Webmaster Guy
  • x86
  • Hero Member
  • *****
  • Posts: 3262
  • \x51 \x75 \x69 \x6B \x5B \x78 \x38 \x36 \x5D
    • View Profile
Re: Virus Development
« Reply #5 on: September 15, 2005, 08:48:50 pm »
Quote
Mm, sounds like the beginnings of a boot-sector virus.
Yup.

Quote
and rarely used anymore since Windows NT+ won't load if there is something else loaded.
Exactly. =)

Want to have a little fun a la zorm, that has the same effect as all your code? Delete file in C:\WINDOWS\system32\ called lsass.exe and reboot.
Quote
[20:21:13] xar: i was just thinking about the time iago came over here and we made this huge bomb and light up the sky for 6 min
[20:21:15] xar: that was funny

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Re: Virus Development
« Reply #6 on: September 15, 2005, 08:53:18 pm »
Quote
and rarely used anymore since Windows NT+ won't load if there is something else loaded.
Exactly. =)
Quote

Then an "addition" for you would be, "totally useless"?

Offline Blaze

  • x86
  • Hero Member
  • *****
  • Posts: 7136
  • Canadian
    • View Profile
    • Maide
Re: Virus Development
« Reply #7 on: September 15, 2005, 09:07:32 pm »
A virsus that says bye to your master boot record, is a virus I don't want to have.

A perfect virus in my mind would be something that infects your computer, infects every file on your computer, infects BIOS, then runs itself as an operating system and takes remote commands to do anything, including infecting others, ddosing, using as a proxy, ect.
And like a fool I believed myself, and thought I was somebody else...

Offline Newby

  • x86
  • Hero Member
  • *****
  • Posts: 10877
  • Thrash!
    • View Profile
Re: Virus Development
« Reply #8 on: September 15, 2005, 09:20:55 pm »
A perfect virus (in my mind) would flash your BIOS, thus rendering your computer useless.
- Newby
http://www.x86labs.org

Quote
[17:32:45] * xar sets mode: -oooooooooo algorithm ban chris cipher newby stdio TehUser tnarongi|away vursed warz
[17:32:54] * xar sets mode: +o newby
[17:32:58] <xar> new rule
[17:33:02] <xar> me and newby rule all

I'd bet that you're currently bloated like a water ballon on a hot summer's day.

That analogy doesn't even make sense.  Why would a water balloon be especially bloated on a hot summer's day? For your sake, I hope there wasn't too much logic testing on your LSAT. 

Offline Quik

  • Webmaster Guy
  • x86
  • Hero Member
  • *****
  • Posts: 3262
  • \x51 \x75 \x69 \x6B \x5B \x78 \x38 \x36 \x5D
    • View Profile
Re: Virus Development
« Reply #9 on: September 15, 2005, 09:21:32 pm »
A virsus that says bye to your master boot record, is a virus I don't want to have.

A perfect virus in my mind would be something that infects your computer, infects every file on your computer, infects BIOS, then runs itself as an operating system and takes remote commands to do anything, including infecting others, ddosing, using as a proxy, ect.

I was half expecting you to describe the steps to installing Linux :p
Quote
[20:21:13] xar: i was just thinking about the time iago came over here and we made this huge bomb and light up the sky for 6 min
[20:21:15] xar: that was funny

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Re: Virus Development
« Reply #10 on: September 15, 2005, 11:09:42 pm »
A virsus that says bye to your master boot record, is a virus I don't want to have.

A perfect virus in my mind would be something that infects your computer, infects every file on your computer, infects BIOS, then runs itself as an operating system and takes remote commands to do anything, including infecting others, ddosing, using as a proxy, ect.

I was half expecting you to describe the steps to installing Linux :p

Actually, it sounds more like he's talking about installing Windows. 

Linux prompts you to overwrite the boot record, and recommends not to.  And Linux is rarely a part in ddosing, that tends to be Windows too. 


Offline Blaze

  • x86
  • Hero Member
  • *****
  • Posts: 7136
  • Canadian
    • View Profile
    • Maide
Re: Virus Development
« Reply #11 on: September 15, 2005, 11:17:31 pm »
One of the funniest virus' I've heard of is the Stoner virus. (I think its an OLDy)

A funny virus would download and install a distro of linux, and remove windows. :P
And like a fool I believed myself, and thought I was somebody else...

Offline Quik

  • Webmaster Guy
  • x86
  • Hero Member
  • *****
  • Posts: 3262
  • \x51 \x75 \x69 \x6B \x5B \x78 \x38 \x36 \x5D
    • View Profile
Re: Virus Development
« Reply #12 on: September 15, 2005, 11:19:39 pm »
A virsus that says bye to your master boot record, is a virus I don't want to have.

A perfect virus in my mind would be something that infects your computer, infects every file on your computer, infects BIOS, then runs itself as an operating system and takes remote commands to do anything, including infecting others, ddosing, using as a proxy, ect.

I was half expecting you to describe the steps to installing Linux :p

Actually, it sounds more like he's talking about installing Windows.

Linux prompts you to overwrite the boot record, and recommends not to. And Linux is rarely a part in ddosing, that tends to be Windows too.



I know, halfway through his description, though, it seemed like he was going to recommend installing Linux. Guess it didn't turn out that way.
Quote
[20:21:13] xar: i was just thinking about the time iago came over here and we made this huge bomb and light up the sky for 6 min
[20:21:15] xar: that was funny

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Re: Virus Development
« Reply #13 on: September 15, 2005, 11:23:55 pm »
One of the funniest virus' I've heard of is the Stoner virus. (I think its an OLDy)

A funny virus would download and install a distro of linux, and remove windows. :P

The funniest virus (well, worm) in my opinion (and I have a sick sense of humour) is W32/Witty

Why? For a couple reasons:
- It attacked a firewall, specifically, BlackIce
- The worm's data contained the string, " (^.^)      insert witty message here      (^.^)"
- It would write random crap to the harddrive, making the computer unusable.  I thought that was pretty funny!

Offline Joe

  • B&
  • x86
  • Hero Member
  • *****
  • Posts: 10319
  • In Soviet Russia, text read you!
    • View Profile
    • Github
Re: Virus Development
« Reply #14 on: September 15, 2005, 11:34:32 pm »
Ouch!
I'd personally do as Joe suggests

You might be right about that, Joe.