                                    PS-MPC
                   Pretty Slick Multimedia Personal Computer
                                   (WRONG!)
               Phalcon/Skism Mass-Produced Code Generator 0.91á
                             Created by Dark Angel
                                17 August 1992
                                       
                       "It's not a bug, it's a feature!"
  
  TABLE OF CONTENTS
  
  TABLE OF CONTENTS                                          i
  DEDICATION                                                 i
  DISCLAIMER                                                ii
  PURPOSE                                                   ii
  WHAT IS THE PS-MPC?                                        1
  USING THE PS-MPC                                           1
  NO ACTIVATION ROUTINES                                     1
  WHY NO IDE                                                 2
  SOURCE CODE AVAILABILITY                                   2
  PROBLEMS                                                   2
  FUTURE ENHANCEMENTS                                        2
  HISTORY OF VIRUS TOOLKITS                                  A
  
  DEDICATION:
  
       The author  hereby releases  this program and its source code into the
  public domain  as "freeware."   All  code generated  by the  program  must,
  however, retain  the designation  of said program, although all other parts
  may be  modified at  the user's  discretion.   The  author  dedicates  this
  program to  both the virus and anti-virus communities, both of which profit
  from the introduction of the Phalcon/Skism Mass-Produced Code Generator.
  
       Thanks are  due to  NoWhere Man  for his  excellent program VCL, which
  served as the inspiration for this package.
  

  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
       PS-MPC Documentation             - i -             Phalcon/Skism 1992
  
  
  DISCLAIMER
  
       This  program  may  cause  either  the  intentional  or  unintentional
  disruption of  normal brain  wave activity  of the  user due to the extreme
  shock quality  of the  program.   The author hereby absolves himself of all
  liability.  Persons with pacemakers beware!
  
       The code  produced by  the Phalcon/Skism  Mass-Produced Code Generator
  is not  designed to be damaging; however, the author is not responsible for
  incidental damages  caused by  use of  the program.  Further, the author is
  not responsible  for damages caused by changes to the code generated by the
  PS-MPC.   The author does not condone the illegal spread of executable code
  created in  part by  the PS-MPC.   All  source code  and  executable  files
  created with the aid of the PS-MPC must be distributed with the recipient's
  full knowledge  of the  contents.   Malicious use  of the  code is strictly
  prohibited.
  
  PURPOSE
  
       The Phalcon/Skism  Mass-Produced Code  Generator is  not  designed  to
  create malicious  code; rather,  it is  a learning tool from which a person
  may learn  to write effective viral code.  The code generated by the PS-MPC
  is highly  optimised for  both size  and speed  and is  therefore the  code
  generated can  be used  by the fledgling virus writer as a model for future
  endeavours.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
       PS-MPC Documentation             - ii -             Phalcon/Skism 1992
  
  
  WHAT IS THE PS-MPC?
  
       The  Phalcon/Skism  Mass-Produced  Code  Generator  is  a  tool  which
  generates viral  code according  to user-designated  specifications.    The
  output is  in Masm/Tasm-compatible  Intel 8086 assembly and it is up to the
  user to  assemble the output into working executable form.  The features of
  the PS-MPC include the following:
  
    o Over  150 encryption  techniques, randomly generated during each run of
      the PS-MPC
    o Compact, commented code, much tighter than VCL
    o COM/EXE infections
    o Both resident and nonresident viruses
    o Two types of traversals for nonresident viruses
    o Three types of high memory residency routines for TSR viruses
    o Optional infection of Command.Com
    o Critical error handler support
  
  USING THE PS-MPC
  
       The syntax of the PS-MPC is simple:
  
       PS-MPC <file1> <file2> <file3>...
  
       The parameters  given to the PS-MPC are the names of the configuration
  files.  For example, to create two separate viruses using the configuration
  files  FOOBAR1.CFG   and  FOOBAR2.CFG,   simply  type  "PS-MPC  FOOBAR1.CFG
  FOOBAR2.CFG" at the prompt.
  
       The configuration  file is  a text file containing a set of parameters
  which define  the output  of the  PS-MPC.   A  sample  configuration  file,
  SKELETON.CFG is  included  with  the  package.    This  configuration  file
  contains all the acceptable parameters to the PS-MPC.  It also includes the
  defaults to  each of  these parameters.   The  configuration file  is self-
  explanatory, so there is no need to go into further detail at this time.
  
       When the  Generator has  completed creating  the source  code  file/s,
  simply assemble  the output  file/s  with  your  favorite  assembler/linker
  combination.  A multi-pass assembler is recommended.  Masm is a poor choice
  for an  assembler; try  Tasm.   Masm requires  the code  to  include  extra
  segment overrides which unnecessarily add to the code length.  Masm 6.0 may
  fix these  problems (I'm  not sure  since I  don't have  it).  Tasm, on the
  other hand,  is an  excellent, fast,  multipass assembler  far superior  to
  Masm.
  
       When linking  resident viruses,  it is important to have EXE2BIN or an
  equivalent.  For ease of coding, resident viruses are generated with org 0.
  However, TLink  refuses to generate a COM file from the OBJ.  Simply create
  an EXE file and run it through EXE2BIN.  Note that some options are not yet
  available with resident viruses.  This will be fixed in the next release.
  
  NO ACTIVATION ROUTINES
  
       I have  not included  any activation  routines in  the package  simply
  because I  do not  think  the  power  of  creating  potentially-destructive
  viruses should  be in  the hands  of persons  incapable of  coding a simple
  activation routine  in assembly.   If  you can rip a simple FAT-annihilator
  out of  another trojan,  then I  cannot stop  you from  doing so.  But just
  remember that  the most  memorable viruses  are not  necessarily those that
  cause the  most damage,  but are usually those that have unusual activation
  
       PS-MPC Documentation             - 1 -             Phalcon/Skism 1992
  
  
  routines.
  
       Upon finding  activation conditions,  the PS-MPC will generate a short
  stub for  the activation  routine.   This is  located immediately after the
  code for  the restoration of the executable files.  It is identified by the
  label "activate"  and is  followed by a return.  Insert your own activation
  routine between those two lines.
  
  WHY NO IDE (Integrated Development Environment)
  
       Everyone agrees  that Microsoft  Windows is  for cripples.  Obviously,
  you, the  user of  the PS-MPC, are no cripple, so you need no puny IDE with
  colourful, deluxe  windows to  aid you.  If you are a cripple, go ahead and
  create the  configuration file in your favorite Windows text editor.  Hell,
  port the  code to  the Macintosh  and you  can be  truly crippled (although
  you'll have your pretty windows and icons).
  
  SOURCE CODE AVAILABILITY
  
       This program  is distributed  with full  source code.    Although  the
  source should  be self-explanatory,  I have gone back and commented several
  portions in  order to facilitate understanding.  The program was written in
  Turbo C  2.0 and compiled in the tiny memory model.  Make sure the unsigned
  characters option  is on or else the code will not compile properly.  It is
  in the  Options/Compiler menu.  I trust that you will not hack this program
  and call  it your  own.   Source code  is available only because I think it
  will aid in your understanding of the program.
  
       If you  make any  improvements to  the source  code, please  show me a
  copy; I  may incorporate  the changes  into the next release of the PS-MPC.
  Please note the changes in the source.
  
  PROBLEMS
  
       This program  was written  hastily.    The  bulk  of  the  coding  was
  completed in  under two  days.   Features were  added  by  the  process  of
  accretion during  the following  week.   Needless to  say, the  code is now
  extremely unmanageable.  If there is enough interest in the package, I will
  rewrite it  in order  to alleviate  the strain  caused in  maintaining such
  code.  This will help in adding features as the need arises.
  
       Version 0.91á  is somewhat  better coded  than 0.90á,  but I  will  be
  continuing to work on improvements as time permits.  Please report any bugs
  to me and I will send you a fixed version as soon as I can.
  
  FUTURE ENHANCEMENTS
  
       As you  may have already noticed, this is a pre-1.0 release version of
  the Generator.   There  are several  features which  I wish  to add  before
  version 1.0.   These  include, but  are  not  limited  to  limited  stealth
  techniques,   padded-EXE   infections   (shorter   routine),   and   better
  documentation(!).   A few  surprises will  be thrown  in as well.  I do not
  plan on  increasing the  size of  the PS-MPC.COM file dramatically, so with
  every addition  will come  code to  keep the  increase in  file size  to  a
  minimum.   I do  not intend  to devote  too much  time to  the project as I
  personally don't actually use the generator to spew out code for the group.
  
  
  
  
  
       PS-MPC Documentation             - 2 -             Phalcon/Skism 1992
  
  
  HISTORY OF VIRUS TOOLKITS
  
       The first  known virus  toolkit was  called VCS, or Virus Construction
  Set.   This program  generated a  new virus each time it was run.  However,
  there were  no code differences at all between any two viruses generated by
  VCS.   All viruses  generated were  1077 bytes  in length  and all could be
  detected with  the identical  scan string.   The advantage in this approach
  was that  the user  needed absolutely no knowledge of 8086 assembly to take
  advantage of this program.  This program of limited usefulness spawned only
  one well-known variant called Manta.  It is not even worth mentioning here.
  
       The second  virus toolkit  was CrazySoft, Inc.'s Dark Avenger Mutation
  Engine (MtE).   This  magnificent work  of Bulgarian  coding allowed  virus
  authors to  create viruses  with an  almost limitless  number of decryption
  routines.   Although the  author needed  to know how to write 8086 assembly
  code, no  knowledge of  the inner workings of MtE save the entry parameters
  was needed  to use  this toolkit.   It  has since  spawned several viruses,
  including Dedicated, Pogue, Fear, and Groove.
  
       The next  virus toolkit  to be released was VCL, or Virus Construction
  Laboratory.  This was written by NoWhere Man of NuKE.  This toolkit allowed
  the user  many options,  including the creation of parasitic COM infectors,
  spawning EXE infectors, trojan horses and logic bombs.  Since it could only
  handle parasitic  infections of  the COM  file format,  it was  of  limited
  usefulness.   Additionally, it  incorporated only  one decryption  formula,
  once again  limiting its usefulness.  Further, the initial release included
  a quirky  installation program  which  failed  to  install  properly  under
  certain conditions.   However,  this  package  contained  a  colourful  IDE
  loosely based  on the Borland interface.  This IDE was incredibly simple to
  use and  even the  average Joe  could understand  how  to  use  it  without
  understanding 80x86  assembly.    Unfortunately,  the  activation  routines
  included with  the package  were of  limited usefulness.    Most  of  these
  involved manipulating the BIOS memory area at segment 40h.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
       PS-MPC Documentation             - A -             Phalcon/Skism 1992
  
  
