gavz / beautifulsky-1

Cross-platform x86/x64 single execution path code base.

BeautifulSky

It is a cross-platform W32/W64 single execution path x86/x64 code base for self-replicators.
For a detailed description, read https://86hh.github.io/sky.html

What's new in BeautifulSky

– uses the same code to run in both x86/x64 modes, single execution path
– fully x86/x64 compatible encoding
– no self-modifying code to achieve compatibility
– position independent-code and compatible with Address Space Layout Randomization
– uses Process Environment Block (PEB) to get kernel32/ntdll directly on both platforms
– stdcall/x64 calling convention compatible
– own GetProcAddress() that supports PE32/PE32+
– uses CRC32 instead of name strings
– uses Vectored Exception Handler for common exception handling on both platforms

BeautifulSky searches the current directory for any file (e.g find mask .). To open and map files for infection it uses an adapted and more efficient version of a technique used by W32.Cabanas virus by Jacky Qwerty in 1998.

Compilation

Compile with masm32:

ml /c /coff /Cp "beautifulsky.asm"
link /SUBSYSTEM:CONSOLE /SECTION:.text,erw /OUT:"beautifulsky.asm" "beautifulsky.obj"

Options:
When mode64 option is defined (uncommented), SkyBeautiful64.exe is generated, but it must be run manually.
When usefsgs is defined (uncommented), BeautifulSky uses the fs/gs procedure to get PEB address.
When usefsgs is undefined (commented), BeautifulSky uses the cmov procedure to get PEB address from registers.

Contact

Contact me for comments, bug reports to: com.gmail@fsendjinn