


                        MDL - Mass Destruction Library
                                Version 0.10b
                            Written by Evil Avatar

  Table of Contents
  -----------------

  Table of Contents...................................................1
  Greetings...........................................................1
  License.............................................................2
  What is MDL?........................................................2
  How MDL works.......................................................2
  Using the MDL.......................................................2
  Source code availability............................................3
  Problems............................................................3
  The Future..........................................................4
  Virus Toolkit History...............................................4


Greetings
---------
     Greetings go out to Dark Angel, Hellraiser, the rest of the Phalcon/Skism
group, and Dark Avenger, who are, in my humble opinion, the greatest virus 
authors today.  MDL is dedicated to John McAfee, for he will benefit the most
from this package.                         

































     
     
     
     MDL Documentation               -1-              Evil Avatar 1993



License
-------
     The author hereby releases this program as freeware.  You are free to use
the MDL in viruses.  It is prohibited to use it in other ways (i.e. Trojan
Horse).  You may distribute this archive and associated files only to virus
programmers.

What is MDL?
------------
     MDL is a library that can be linked to any virus.  MDL has been written
using Intel 8086 assembly language.  MDL is used as an easy method to destroy
data on a disk without having to do all the tedious coding.

How MDL works
-------------
     MDL is distributed with many routines, seven of them intending to destroy
data.  Some are very basic; some are fairly complex.  One routine that is not
destructive is a random number generator.  This is used by some routines in
the library.  This can also be called for your own use to create random
numbers for an encryption system.

Using the MDL
-------------
     MDL consists of several modules.  I assume you are using assembly to
write your virus.  If you are using a high level language then you are on your
own.  At the beginning of your virus put this:

        .model tiny
        .code

        extrn kill_br: near, pot_shot: near, pt_trash:near, sec_buf:near
        extrn screw_file: near, alter_fat: near, fat_fuck: near, rip_hd: near
        extrn rnd_num: near, load_sec: near

Then you just write your virus.  When you are ready to kill some data, you
have several options, explained in detail below.  Parameters are passed in
registers.  All is left is to link MDL.LIB to your virus.  All registers are
preserved.  Now to create havoc!

1. KILL_BR
     This is your first option.  This call to the MDL will overwrite the boot
record of any disk you specify with data that you get to specify.  All
parameters are mandatory.  They are as follows.

     AL - Drive number (i.e. A=0, B=1, C=2, etc.).

     DS:BX - Start of text/code you want the boot sector to be overwritten
             with.  You can get real creative with this.  You can kill the
             disk with the right text.  You might even want this to point to a
             new boot record of your own!

2. POT_SHOT
     This option will destroy a sector of your choice on the default drive.
You can also choose a random sector to destroy.
     
     AX - Sector to destroy (to get a random number, call RND_NUM just
          previous to calling this command).




     MDL Documentation               -2-              Evil Avatar 1993



3. PT_TRASH
     With this routine, you can kill the Partition table on the hard disk.
This will make all data there inaccessible.  There are no parameters to this
routine.

4. SCREW_FILE
     The fifth option will open a specified file and overwrite it with random
data.  There is only one parameter.

     DS:BX - Offset to the name of the file to screw.

Note:  The file name cannot be a wildcard.  Changes are also made to the
date/time stamp, so if you want stamp kept the same, you will have to do it
yourself.  I thought that this would help in flexability.

5. ALTER_FAT
     This will change random bytes in both FATs.  This will irrevocably cause
crosslinks.  There are no parameters.

6. FAT_FUCK
     This routine will overwrite both copies of the FAT with random data
making the data on the disk inaccessible.  There are no parameters.

7. RIP_HD
     Last of the destruction routines, RIP_HD will overwrite the contents of
the entire disk, making recovery of data impossible.  Once again, there are
no parameters.  This command does not return.  It keeps formating until the
computer locks up, or there is an exception error.

8. RND_NUM
     This routine will generate 16-bit random numbers.  The random number is
returned in ax.

9. LOAD_SEC
     This routine will load a specified sector into a buffer.  This routine 
has two parameters.

        AL - Drive number (i.e. 0=A, 1=B, etc.).
        DX - Logical sector to read.

This option returns with ES:BX pointing to the start of the sector buffer.

Source code availability
------------------------
     Source code is made available partly because I think by the time this
program is a threat to anyone, the virus scanners will be able to detect it,
partly because It'll help you learn how to create your own malicious code,
and partly because it'll help me out by allowing others to check for bugs in
my code.  This code is to be used as a learning tool.  It is to allow real
virus writers to spend their time on stealth techniques and other things then
having to worry about activation routines.  This is not to be used with PS-MPC
or any other code generator and distributed.  That is not virus writing.  This
program was written in Turbo Assembler 2.02.  I trust that you will not alter
it and re-release it as your own.

Problems
--------
     This code was written over a weekend and very hastily.  It is not very



     MDL Documentation               -3-              Evil Avatar 1993



optimized.  Also, I didn't give it alot of testing (I don't have a spare hard
drive to kill).  However, I did test some routines on floppy disks and they
worked fine.  This code is bound to have tons of bugs (note the 0.10b 
release).  Report any bugs to Evil Avatar.  If you can, please suggest 
alternate code (you will be given credit for it).

The Future
----------
     For the future of MDL, I plan on fixing all bugs.  I also plan on adding
any other routines that come to my head (one that comes to mind is a file 
crosslinker).  I don't plan on spending too much time to this project as I 
don't endorse the idea of trashing every hard drive in existence.  I made MDL 
to see if I could do it.  I am only releasing it in hopes that someone can 
learn from it.  Remember the most memorable viruses don't always have 
malicious code!  For my future, I plan on releasing more toolkits 
(i.e. polymorphic engine, construction kits, etc.).  I also plan on joining a
virus group and creating more viruses.

Virus Toolkit History
---------------------
GENVIR - This was the first attempt at a virus toolkit.  If was written in
1990 by a French virus writer.  It was never released as a functional program.

Virus Construction Set (VCS) - VCS was written in 1991 by Verband Deutscher
Virenliebhaber, a German group.  VCS is very primitive compared to modern
construction kits.

MuTation Engine (MtE) - MtE was written in 1991 in Bulgaria by Dark Avenger.
It is a polymorphic engine that allows a virus to exist in over 4 billion
variants.

Virus Construction Lab (VCL) - VCL was written in 1992 by Nowhere Man of NuKE.
It uses a graphical user interface to allow a user to create a virus.

Phalcon/Skism Mass Produced Code Generator (PS-MPC) - PS-MPC was written in
1992 by Dark Angel of Phalcon/Skism.  It is based on VCL, however, it creates
more compact code than VCL.

Instant Virus Production Kit (IVP) - IVP was written be Admiral Bailey of YAM
(Youngsters Against McAfee).  It is rumored to be a rewrite of PS-MPC with
some rudimentary changes.

TridenT Polymorphic Engine (TPE) - TPE was written in late 1992 by the TridenT
group.  It is similar to MtE.

G2 (G squared) - G2 was written in 1993 by Dark Angel of Phalcon/Skism.  It
is the most powerful construction kit to date.  It allows the use of different
code packages to do different tasks.

Evil Avatar's Mass Destruction Library (MDL) - MDL was written in 1993 by Evil
Avatar.  It is a library that allows easy destruction of data.








     
     
     MDL Documentation               -4-              Evil Avatar 1993

