Flash bios!
+---------+
Flash Memory : Non-Volatile memory which augments EPROM functionality
with in-circuit electrical erasure and reprogramming.
Flash BIOS : Flash Memory used for storing BIOS software to allow easy
upgrade.
- Desmond Yuen, Intel's SL Architecture, 1993.
Qark's translation : A new place to store virii!
Non-Volatile memory is like normal memory but when you turn your
computer off, the stuff you put on it earlier is still there! But this
isn't actually useful to us VXers unless the code stored is executed later
on. Thanx to Intel this dream is a reality due to the advent of Flash
BIOS! This memory is present in 90% of laptop computers, most pentiums,
most 486 DX2?? and 486DX4?? and also found in some ordinary computers.
It is always present in the 386SL processor.
As you all know, (or should do) BIOS is executed when you boot your
machine. So, all your average funky VXer has to do is modify the BIOS
slightly to run your virus before actually booting.
Imagine the looks on the faces of the AVers when they remove the
virus from all their boot sectors and files only to reboot and have it
back again! Even funnier - they _can't_ boot clean! Even if they boot
from a write protected disk the virus will still be there fiddling with
the interrupts! They'd probably have to remove their memory and install
a whole new set to remove the damn thing. Infact if the memory has been
surface mounted (welded) they will have to buy a whole new motherboard!
I'm not quite sure if flash BIOS is mapped or if BIOS shadowing affects
it at all but I think this will work on most of them... if it doesn't
infect properly it'll just completely fuck their computer up so that's
half the job done there :)
Anyway here is a short algorithm I just made up quickly. I'm not quite
sure of what I'm doing but remember that noone has done this before.
;This pseudocode assumes it's in a virus executed somewhere.
Test for flash BIOS
Test to see if BIOS already infected (Fuck off if so)
Read Int19h vector from interrupt table. (The boot interrupt)
Read first five bytes from the Int19h entry point.
Scan the BIOS for a buffer of zero's the size of the virus.
Set Flash BIOS to write mode (Normally its readonly)
Write the virus to the buffer we found.
Write a jump to our virus at the int19h entry point
Set flash BIOS to read mode
;;;
Ok, that looks like a workable algorithm. (Made it up as I went :)
Int19h is only called during the boot process and it's only purpose
is to load the boot sector into memory and then execute it. Thus a good
interrupt to choose methinks. By the time its called all the interrupts
are set and everything is done.
Also take into account that you can't read and write from flash BIOS at
the same time. This means you can't store temporary variables when the
virus is run, therefore I'd suggest doing the conventional boot sector
thing and moving it above the memory allocation and setting the int13h to
it from there. (This is pretty tough stuff!)
Anyway, I'll have a go at doing the worlds first Flash BIOS infector
here is the information you'll need to write your own... the AMI-FLASH!
(Thanx AMI for this ! We'll put it to good use fucking you up hehe)
AMI BIOS has it's specification written up for flash BIOSes to use.
It's based around int16h function 0e0h. The funny thing is that once
the virus is loaded it can snatch that function and stop any AV software
from using it to clean! hehe then you'll have things like AVers trying
to tunnel int16h to get the original vector... and viruses will bung in
their own anti-tunneling code... and so on...
It's fucking scarey when you think about it. You'll have the hardest
time ever removing one from your memory. They'll probably have to
remove their chips and replace them. hehe and they'll forget one of
their disks is infected and they'll be fucked again...
The AMI Flash specification is in another article.
Also check the books :
Intel's SL Architecture, Desmond Yuen, 1993, McGraw Hill
Dipert,D., and D. Verner, "Designing an Updatable BIOS Using Flash
Memory,"Intel Corporation, 1991.
(I wish I had this book, but I ripped this from the references at the
bottom of chapter 14 in the top one hehe)
Qark/VLAD
- VLAD #2 INDEX -