Projects

A boot-sector virus that installs itself into the interrupt vector table and spreads to every floppy disk touched by the infected machine.

Residency mechanism. The virus survives by stealing memory from the system before DOS loads. It reads the BIOS memory-size word at 0040:0013, decrements it twice to shrink the reported total by 2 KB, and computes the segment address of the newly orphaned region. The system never learns that memory exists, so nothing overwrites the virus.

INT 13h hooking. Before relocating, it saves the original disk I/O handler by reading the offset at 0000:004C and the segment at 0000:004E into its own body, then overwrites the IVT entry to point at ES:000E in the hidden 2 KB block. Every subsequent disk operation on the machine routes through the virus first. The relocation itself ends with a jmp dword ptr cs:byte_7C03 that transfers control into the copy in stolen memory.

Infection path. On each INT 13h call, the hook checks whether the request targets drive A. If so, it tests the floppy motor bit at 0040:003F: a running motor means the virus was just loaded from that disk, so no infection is needed; a stopped motor means a newly inserted disk. It then reads the target's MBR, compares the first two words against its own body to detect prior infection, and if clean, copies the disk's real 33-byte partition table into its own image before writing itself to track 0, sector 1. On hard drives it first relocates the original MBR to sector 7, head 0. Calls to other drives fall through to a direct jmp at the saved original handler address.

Payload. On March 6, the virus enters a loop writing garbage from an arbitrary memory segment across the disk, incrementing head and cylinder until the drive is destroyed.

A COM file infector notable for an anti-debugging technique built on interrupt redirection and self-modifying code.

The INT 3 / INT 21h swap. The virus copies the INT 21h handler's offset and segment from 0000:0084 into the INT 3 vector at 0000:000C. INT 3 is the breakpoint interrupt used by debuggers. From that point forward, every DOS service call the virus makes is issued as int 3 rather than int 21h, which means the virus's own system calls are indistinguishable from breakpoints, and a debugger attempting to trap breakpoints intercepts the virus's normal operation instead.

Divide-by-zero dispatch. The virus saves the original INT 0 (divide error) handler, then points INT 0 at one of two addresses depending on execution context. Line seg000:0100 self-modifies the operand at seg000:0107 from 168h to 152h, and a matching instruction later writes whichever value is live into the INT 0 vector. Outside a debugger the sequence resolves to 168h, the legitimate continuation path. Under a debugger the timing differs and 152h is written instead, which lands in a routine that enters an infinite int 13h loop overwriting every sector of the first floppy drive with the virus body. After the check passes, the virus rewrites seg000:0107 back to 168h so the modification leaves no trace.

Mid-instruction jump. At seg000:0157 the byte B8 is placed such that a linear disassembler decodes it as mov ax, 0FE05h, but execution actually jumps into the middle of the instruction stream, where the bytes decode as add ax, 0EBFEh; cld; and realign at seg000:015C. Subsequent arithmetic (sub ax, 0E702h) reconstructs 0301h — the INT 13h write-one-sector command — in a register rather than loading it as an immediate, so the operation never appears as a constant in the disassembly.

Infection. The virus searches for *?.C?M files, reads each candidate, and compares the first word against its own to skip already-infected hosts. It prepends itself to the file, copying only 419 bytes (1A3h) so that the signature region and original file content are preserved. If it finds COMMAND.COM specifically (identified by a second-word comparison against 6015h), it overwrites three strings in the host binary: the copyright banner, the "has no label" volume string, and the "Bad Command" error message, replacing them with taunt text including a claim that DOS 6 antivirus missed it.

A 376-byte worm carried entirely in a single UDP packet to port 1434, requiring no file to be written to disk.

The vulnerability. The SQL Server Resolution Service dispatches on the first byte of the packet as an index into a jump table. Command code 04 routes to a handler that builds a registry path with sprintf into a 128-byte stack buffer, concatenating a 48-byte prefix, the attacker-supplied packet contents as a null-terminated string, and a 28-byte suffix. Any packet body over 52 bytes overflows the buffer and overwrites the saved return address.

Exploitation. The worm fills the overflow with 01 filler bytes, then places 0x42B0C9DC at the return address slot — the address of a jmp esp instruction inside sqlsort.dll. On return, execution transfers to jmp esp, which redirects to the next byte on the stack, a short jump into the worm body.

Stack reconstruction and self-relocation. Because the vulnerable function's epilogue popped the stack, the worm rebuilds its own frame: it pushes the jmp esp address back, loads 0x01010101 into eax, and pushes it 24 times via a loop, then XORs to produce 0x04000000 and pushes that. It sets ebp to the current stack pointer so the worm body sits above ebp (accessible via positive offsets) and its working stack below (negative offsets), making the whole payload position-independent.

API resolution. It calls LoadLibraryA (resolved from a fixed address in sqlsort.dll) on ws2_32.dll and kernel32.dll, keeping both module handles on the stack. It resolves GetProcAddress by reading the first four bytes at the candidate address and comparing against 0x51EC8B55 (the standard function prologue push ebp; mov ebp,esp; sub esp,...) to verify it found the right function, falling back to an alternate address if the check fails. It then resolves GetTickCount, socket, and sendto.

Propagation. GetTickCount seeds a linear congruential generator implemented entirely in lea and shl instructions: successive operations compute 3×, 13×, 208×, 209×, 53504×, 53503×, and finally 214013× the seed, then add a value derived from the GetProcAddress address XORed with a constant. The result is used directly as a target IPv4 address. It opens a UDP socket (AF_INET, SOCK_DGRAM, IPPROTO_UDP) and calls sendto in a tight loop with a 376-byte payload pointer at ebp+3, skipping the leading zeros of its own body, flooding randomly generated addresses on port 1434.

Position independence and encryption. The virus establishes its own load address with a call $+5 / pop ebp / sub ebp, 401005h sequence, then checks a key stored at [ebp+401061h] — a value of zero indicates the body is unencrypted (first generation), non-zero triggers the decryptor.

PEB-based kernel32 discovery. Rather than relying on imports, it walks fs:[eax+48] to reach the Process Environment Block, follows the PEB_LDR_DATA pointer at offset 12, reads the module list pointer at offset 28, and extracts the base address from the first LDR_MODULE entry. A sign check on the PEB pointer selects an alternate Win9x-compatible discovery path. From that base it parses the PE export table to resolve roughly 17 functions by name (LoadLibrary, FindFirstFile, CreateFileMapping, MapViewOfFile, mutex APIs, and others).

Recursive infection. Seeded by GetTickCount, it calls SetCurrentDirectory and recurses through the directory tree: for each entry it calls GetFileAttributes, skips names beginning with ., descends into directories (recursing, then SetCurrentDirectory("..") to return), and for files runs an extension check that builds a 4-byte value via lodsb/rol and compares against 2E657865h (".exe").

PE modification. For each target it opens the file, computes a new mapping size (original + 0xC31 virus body + 4 KB slack), and reads the PE headers. It checks OptionalHeader.CheckSum against 0xFFFF as an infection marker, unmapping and closing if already infected. It scans section headers to find the last section with initialized data, computes the insertion point at that section's PointerToRawData + VirtualSize, and enlarges both VirtualSize and SizeOfRawData to accommodate the body.

Control-flow hijacking via CALL patching. Rather than modifying the entry point, the virus locates the section containing the original entry point, scans it with repne scasb for the first 0xE8 byte (CALL rel32), and rewrites that instruction's relative displacement to point at the injected body. It saves the original displacement and appends a push <original_target>; ret stub after the virus code, so the hijacked call returns to its intended destination after the payload runs. The host appears to execute normally.

Encryption. The body is encrypted with a Lehmer-style PRNG (constants 0x41A7, 0x1F31D, 0xB14) generating a keystream XORed byte by byte into the target. Only the first 0x61 bytes — the decryptor stub and key — are written in plaintext.

Payload. After infection it loads user32, resolves MessageBoxA through the same export-parsing routine, displays a dialog captioned "Win32.Lucius" reading "...I am Lucius, Prince of Ruin...", then zeroes its working buffer.

The most heavily defended sample, combining SEH-based anti-debugging, hardware-level VM detection, two layers of encryption, and a runtime-assembled polymorphic decryptor.

SEH anti-debugging. The virus installs a custom EXCEPTION_REGISTRATION_RECORD by pushing its own return address as the handler and repointing fs:0 at the new frame, then deliberately dereferences a null pointer. Without a debugger, Windows walks the SEH chain and lands on the virus's handler, which jumps to the delta-offset routine. With a debugger attached, the debugger intercepts the exception first and the intended control flow never occurs.

Anti-VM checks. Two independent tests. The first executes SLDT and inspects the returned Local Descriptor Table Register value; a zero result indicates virtualization and the routine returns immediately. The second calls CPUID with eax=0 (returning the maximum supported leaf), pushes that, calls CPUID again with eax=1 (returning the version/signature), and XORs the two values — a match indicates a VM and the virus exits.

kernel32 discovery by backward scan. Instead of the PEB, Harulf takes the return address from the stack and scans backward through memory: at each candidate it reads the potential e_lfanew field, discards values with any of the top five bits set (too large for a valid PE header offset), verifies that the address at [edx+ecx+34h] matches the candidate base (confirming the ImageBase field), and checks for the MZ signature (5A4Dh). It then parses the export directory to locate GetProcAddress by string comparison, and from there resolves functions from kernel32.dll, advapi32.dll, and shell32.dll.

Two-layer encryption. The virus body (0x1720 bytes) is encrypted in two stages. An inner layer uses a rotate-based scheme: for each word, xchg ch, cl followed by rol ch, cl, applied across the body minus the 72-byte encryption loop itself. An outer layer XORs the entire body with a random single-byte key (1–255) generated per infection.

Polymorphic decryptor construction. Three functionally equivalent decryptor variants exist in the virus body, dispatched by selector values 00h, 1Dh, and 40h. They differ in register allocation and instruction selection: one uses pop edx and nop padding between every operation, another manipulates the stack with add esp, 4 and push [edx], and the third uses adc esi, 1 instead of inc esi and xchg ecx, ecx as an effective no-op. At infection time the virus randomly selects variants, measures each one's length with a bundled length-disassembler routine (VirXasm32), and assembles them into a zeroed buffer at the host's entry point — so no two infected files carry byte-identical decryptors.

Entry point patching. It writes a MOV EAX, <virus_data_VA XOR key> instruction at the host entry point, so even the address of the virus body in the infected file is obfuscated, then copies the assembled decryptor and body after it.

Storage via resources. Rather than only appending to a section, the virus stores its encrypted body as a resource: BeginUpdateResourceA, then UpdateResourceA with type RT_RCDATA and resource ID 0x4D2 (which doubles as an infection marker), then EndUpdateResourceA.

UAC bypass. It calls IsUserAnAdmin from shell32.dll; without admin rights it displays an error box and exits. With admin rights, it opens HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System with KEY_SET_VALUE and sets EnableLUA to 0 via RegSetValueExA, disabling User Account Control on Windows Vista and later.

Propagation. Three vectors. It copies itself to eight hardcoded P2P shared folders (including C:\Program Files\Kazaa Lite\My Shared Folder\vista_crack.exe) under enticing filenames. It enumerates all logical drives with GetLogicalDrives, and for each present drive infects executables at the root, copies itself as harulf.exe, and writes an autorun.inf containing open=harulf.exe and shell\open\command=harulf.exe so the payload runs when the drive is opened. It also recursively infects .exe files in the working directory tree.

Date-triggered payload. It calls GetDateFormatA with a dd format string and compares the day of month against 09. On a match, it loads urlmon.dll, resolves URLDownloadToFileA, downloads a JPEG from a remote server to C:\saddamsfamily.jpg, sleeps three seconds, and opens the image with WinExec on explorer.exe.